From 45738b24fc91b6d3afa3508d88586c4f52aac661 Mon Sep 17 00:00:00 2001
From: Karn <mail@karngyan.com>
Date: Mon, 10 Aug 2026 03:37:53 +0530
Subject: [PATCH 1/3] =?UTF-8?q?wip(fleet):=20fleet=20key,=20certs,=20and?=
 =?UTF-8?q?=20the=20daemon=20acceptance=20rule=20=E2=80=94=20incomplete?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Stage 2 of spec/fleet-trust.md, interrupted mid-implementation (the agent
writing it ran out of credits while adding channel_test.go coverage for
the acceptance rule). Committed to preserve the work, NOT reviewed and
NOT known to pass: transport tests were reported green, the acceptance
rule's own tests were still being written.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 cmd/flue/main.go                         |  33 +-
 cmd/flue/relay.go                        |  60 ++-
 cmd/flue/relayui.go                      |  36 +-
 internal/config/relay.go                 |  12 +
 internal/crypto/devices.go               | 204 +++++++++-
 internal/crypto/devices_test.go          | 108 +++++-
 internal/crypto/handshake.go             |  51 ++-
 internal/crypto/handshake_test.go        |  45 ++-
 internal/crypto/vectors_test.go          | 158 ++++++--
 internal/daemon/pairing.go               |  34 +-
 internal/daemon/server.go                |  50 +++
 internal/daemon/server_test.go           |   2 +-
 internal/daemon/transport_test.go        |   4 +-
 internal/fleet/fixture_test.go           | 213 +++++++++++
 internal/fleet/fleet.go                  | 456 +++++++++++++++++++++++
 internal/fleet/fleet_test.go             | 207 ++++++++++
 internal/transport/relay/channel.go      | 100 ++++-
 internal/transport/relay/channel_test.go | 238 +++++++++++-
 internal/transport/relay/relay.go        |  26 +-
 internal/transport/relay/relay_test.go   |  51 ++-
 testdata/fleet/certs.json                |  56 +++
 testdata/noise/ik-payload.json           |  29 ++
 22 files changed, 2057 insertions(+), 116 deletions(-)
 create mode 100644 internal/fleet/fixture_test.go
 create mode 100644 internal/fleet/fleet.go
 create mode 100644 internal/fleet/fleet_test.go
 create mode 100644 testdata/fleet/certs.json
 create mode 100644 testdata/noise/ik-payload.json

diff --git a/cmd/flue/main.go b/cmd/flue/main.go
index e54a1ce..8d713ab 100644
--- a/cmd/flue/main.go
+++ b/cmd/flue/main.go
@@ -25,6 +25,7 @@ import (
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/crypto"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/service"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
@@ -323,7 +324,27 @@ func loadIdentity() (daemon.Identity, error) {
 	if err != nil {
 		return daemon.Identity{}, fmt.Errorf("load the daemon static key: %w", err)
 	}
-	return daemon.Identity{Key: key, Devices: crypto.NewDeviceStore(dir)}, nil
+	id := daemon.Identity{Key: key, Devices: crypto.NewDeviceStore(dir)}
+
+	// The fleet key rides relay.json (spec/fleet-trust.md), so it is read
+	// here beside the other identity material rather than by the relay
+	// startup: pairing mints device certs and revocation mints revocations
+	// whether or not the transport ever comes up. An unreadable or absent
+	// relay.json leaves the identity fleet-less — startRelay reports the
+	// unreadable case, and a daemon without a fleet key pairs exactly as it
+	// always did. A relay.json that parses but carries a seed this daemon
+	// cannot use is fatal, by the same reasoning as the static key above: a
+	// daemon that started anyway would sign nothing and verify nothing while
+	// looking perfectly healthy, and a corrupted credential file is a thing
+	// to say out loud, not to route around.
+	if rc, ok, err := config.LoadRelay(); err == nil && ok && rc.FleetSeed != "" {
+		fk, err := fleet.Parse(rc.FleetSeed)
+		if err != nil {
+			return daemon.Identity{}, fmt.Errorf("relay.json carries a fleet seed this daemon cannot use: %w", err)
+		}
+		id.Fleet = fk
+	}
+	return id, nil
 }
 
 // startRelay dials the configured relay, if there is one, and keeps it dialled
@@ -359,7 +380,15 @@ func startRelay(ctx context.Context, srv *daemon.Server, identity daemon.Identit
 		return false
 	}
 
-	cfg := relay.Config{URL: rc.URL, Secret: rc.Secret, Origin: rc.Origin, MachineID: rc.MachineID}
+	// The public half only: signing stays with the daemon (pairing,
+	// revocation), while the transport verifies the certs strangers present.
+	// identity.Fleet is the parsed form of this same file's seed — loaded by
+	// loadIdentity, which is fatal on a seed that does not parse — so a nil
+	// Public() here means relay.json carries no fleet key at all, and
+	// relay.New refuses that by name: the file predates the fleet key, and
+	// the re-join line is the way forward (spec/fleet-trust.md keeps no
+	// compatibility with pre-fleet files, deliberately).
+	cfg := relay.Config{URL: rc.URL, Secret: rc.Secret, Origin: rc.Origin, MachineID: rc.MachineID, FleetPub: identity.Fleet.Public()}
 	t, err := relay.New(cfg, srv, identity.Key, identity.Devices, logger)
 	if err != nil {
 		logger.Warn("relay not started", "err", err)
diff --git a/cmd/flue/relay.go b/cmd/flue/relay.go
index 99e0d0d..7a3afa2 100644
--- a/cmd/flue/relay.go
+++ b/cmd/flue/relay.go
@@ -19,6 +19,7 @@ import (
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaydeploy"
 	relaybundle "github.com/karnstack/flue/relay"
 	"github.com/karnstack/flue/web"
@@ -273,6 +274,20 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 	}
 	origin := "https://" + host
 
+	// The fleet key, minted beside the fresh secret and — unlike it — never
+	// sent anywhere: no binding, no secret upload, no log line
+	// (spec/fleet-trust.md). It travels only in relay.json below and in the
+	// join line printed at the end, and it is what signs the device certs
+	// every machine on this relay honours. Fresh on every setup for the same
+	// reason the secret is: setup is the recovery path, and rotating the
+	// fleet key is what un-trusts every cert a compromised machine could
+	// have signed.
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		return err
+	}
+	fmt.Fprintln(w, "  ✓ fleet key minted (stays on your machines; Cloudflare never sees it)")
+
 	// This machine's identity on the relay: the id is the slot it dials
 	// (/daemon/<id>) and the name is its human label. Minted fresh on every
 	// run like the secret — setup is the recovery path, and a stale id would
@@ -297,6 +312,7 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://" + host,
 		Secret:      secret,
+		FleetSeed:   fleetKey.Seed(),
 		Origin:      origin,
 		MachineID:   machineID,
 		MachineName: machineName,
@@ -318,11 +334,15 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 		}
 	}
 
-	// The one line another machine needs, exactly as it should be run there.
-	// It carries the secret — that is the point: the relay is shared by
-	// machines that share it, and this is the deliberate hand-off, printed
-	// once at the moment the user is wiring their fleet up.
-	fmt.Fprintf(w, "\nto add another machine, run this on it:\n\n  flue relay join wss://%s --secret %s\n", host, secret)
+	// The one line another machine needs, exactly as it should be run there,
+	// spelled by joinCommand so this print and the Remote screen's copy can
+	// never drift. It carries the secret and now the fleet key — that is the
+	// point: the relay is shared by machines that share them, and this is
+	// the deliberate hand-off, printed once at the moment the user is wiring
+	// their fleet up. Its weight changed when the fleet key came aboard:
+	// leaking this line used to buy disruption, and now it buys the fleet —
+	// docs/RELAY.md says so where it teaches the line.
+	fmt.Fprintf(w, "\nto add another machine, run this on it:\n\n  %s\n", joinCommand(host, secret, fleetKey.Seed()))
 
 	fmt.Fprint(w, relaySetupDone)
 	return nil
@@ -333,7 +353,7 @@ func runRelaySetup(w io.Writer, r io.Reader, api *cloudflare.Client, args []stri
 // a machine list rendering as a list.
 const machineNameMaxRunes = 64
 
-const relayJoinUsage = "usage: flue relay join <url> --secret <secret> [--name <label>]"
+const relayJoinUsage = "usage: flue relay join <url> --secret <secret> --fleet <fleet key> [--name <label>]"
 
 // relayJoinDone mirrors relaySetupDone's restart note without the token line:
 // join never saw a Cloudflare credential, so there is nothing to tell the user
@@ -360,6 +380,7 @@ func runRelayJoin(w io.Writer, args []string) error {
 	fs := flag.NewFlagSet("relay join", flag.ContinueOnError)
 	fs.SetOutput(io.Discard)
 	secret := fs.String("secret", "", "the relay's daemon secret, from flue relay setup")
+	fleetSeed := fs.String("fleet", "", "the fleet key, from flue relay setup")
 	name := fs.String("name", "", "a display name for this machine (defaults to the hostname)")
 	if err := fs.Parse(args[1:]); err != nil {
 		return fmt.Errorf("%w; %s", err, relayJoinUsage)
@@ -370,6 +391,27 @@ func runRelayJoin(w io.Writer, args []string) error {
 	if *secret == "" {
 		return errors.New("no --secret was given; " + relayJoinUsage)
 	}
+	// Required unconditionally, not "when the relay was set up with one".
+	// Join is a local command — it never talks to the relay, so it cannot
+	// ask how setup ran — and every setup from this flue on mints a fleet
+	// key, so the only line without --fleet is one printed by an older
+	// setup, whose relay the compatibility rules retire anyway
+	// (spec/fleet-trust.md): its ids stopped routing on the Worker this
+	// binary deploys, and the fix is re-running setup, which prints a line
+	// this check accepts. One rule, no state to consult, and a lost flag —
+	// the ordinary paste accident — is caught here rather than as a daemon
+	// that quietly cannot admit its fleet's devices.
+	if *fleetSeed == "" {
+		return errors.New("no --fleet was given; " + relayJoinUsage)
+	}
+	fleetKey, err := fleet.Parse(*fleetSeed)
+	if err != nil {
+		// The parse error says what the value failed to be (base64url, 32
+		// bytes) and never echoes it: the seed is the fleet's signing key,
+		// and a near-miss paste is close enough to the credential to keep
+		// out of the transcript.
+		return fmt.Errorf("--fleet: %w", err)
+	}
 	if utf8.RuneCountInString(*name) > machineNameMaxRunes {
 		return fmt.Errorf("--name is longer than %d characters", machineNameMaxRunes)
 	}
@@ -395,10 +437,14 @@ func runRelayJoin(w io.Writer, args []string) error {
 
 	// The same shape setup writes, derived the same way: bare wss:// URL, the
 	// https origin on the same host. SaveRelay is 0600 — the file holds the
-	// relay's whole credential.
+	// relay's whole credential, the fleet key now included. The seed is
+	// stored as the parsed key re-spells it, which for a value that passed
+	// fleet.Parse is the input verbatim; going through the round trip means
+	// the file can only ever hold a spelling Parse accepts.
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://" + host,
 		Secret:      *secret,
+		FleetSeed:   fleetKey.Seed(),
 		Origin:      "https://" + host,
 		MachineID:   machineID,
 		MachineName: machineName,
diff --git a/cmd/flue/relayui.go b/cmd/flue/relayui.go
index 5496530..2e8ff6b 100644
--- a/cmd/flue/relayui.go
+++ b/cmd/flue/relayui.go
@@ -18,6 +18,7 @@ import (
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaydeploy"
 	relaybundle "github.com/karnstack/flue/relay"
 )
@@ -339,13 +340,19 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	}
 
 	// The same record `flue relay setup` writes, for the same reasons — see
-	// runRelaySetup for why the id and secret are fresh, why the id is minted
-	// under the fresh secret, and why the write is last.
+	// runRelaySetup for why the id, the secret and the fleet key are fresh,
+	// why the id is minted under the fresh secret, why the fleet key goes
+	// nowhere but this file and the join line, and why the write is last.
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		return daemon.RelayUIDeployResult{}, err
+	}
 	machineID := config.MintMachineID(hostname, secret, rand.Reader)
 	machineName := truncateRunes(hostname, machineNameMaxRunes)
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://" + host,
 		Secret:      secret,
+		FleetSeed:   fleetKey.Seed(),
 		Origin:      "https://" + host,
 		MachineID:   machineID,
 		MachineName: machineName,
@@ -353,6 +360,7 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	}); err != nil {
 		return daemon.RelayUIDeployResult{}, fmt.Errorf("save the relay configuration: %w", err)
 	}
+	steps = append(steps, "fleet key minted (stays on your machines; Cloudflare never sees it)")
 	steps = append(steps, fmt.Sprintf("this machine joined as %s (%s)", machineName, machineID))
 
 	if fromRequest {
@@ -369,7 +377,7 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	res := daemon.RelayUIDeployResult{
 		Steps:       steps,
 		Origin:      "https://" + host,
-		JoinCommand: joinCommand(host, secret),
+		JoinCommand: joinCommand(host, secret, fleetKey.Seed()),
 	}
 	if started, already := s.runtime.startOnce(); already {
 		// A transport is already up, dialling whatever relay.json said when it
@@ -387,10 +395,13 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	return res, nil
 }
 
-// joinCommand is the one spelling of the hand-off line, shared by the deploy
-// result and the join endpoint so the two can never drift.
-func joinCommand(host, secret string) string {
-	return fmt.Sprintf("flue relay join wss://%s --secret %s", host, secret)
+// joinCommand is the one spelling of the hand-off line, shared by the CLI's
+// setup print, the deploy result and the join endpoint so the three can
+// never drift. It carries the secret and the fleet key seed, which is the
+// line's whole point and its whole weight: docs/RELAY.md and
+// spec/fleet-trust.md both say what leaking it now costs.
+func joinCommand(host, secret, fleetSeed string) string {
+	return fmt.Sprintf("flue relay join wss://%s --secret %s --fleet %s", host, secret, fleetSeed)
 }
 
 // SetAddress is `flue relay address` behind the card: the user routed a
@@ -445,12 +456,17 @@ func (s *relayUIService) JoinCommand(ctx context.Context) (string, bool, error)
 	if err != nil || !ok {
 		return "", false, err
 	}
-	if cfg.Secret == "" {
-		// A relay.json without a secret cannot join anything.
+	if cfg.Secret == "" || cfg.FleetSeed == "" {
+		// A relay.json without a secret cannot join anything, and one
+		// without a fleet key cannot be joined faithfully: join requires
+		// --fleet, and a line rebuilt without it would be one the command
+		// refuses. A file missing the seed predates the fleet key, and the
+		// path back is re-running setup — which mints one and makes this
+		// answer true again — not a synthesized line.
 		return "", false, nil
 	}
 	host := strings.TrimPrefix(cfg.URL, "wss://")
-	return joinCommand(host, cfg.Secret), true, nil
+	return joinCommand(host, cfg.Secret, cfg.FleetSeed), true, nil
 }
 
 func (s *relayUIService) Update(ctx context.Context, req daemon.RelayUIDeployRequest) (daemon.RelayUIDeployResult, error) {
diff --git a/internal/config/relay.go b/internal/config/relay.go
index 5dee03f..0b13edf 100644
--- a/internal/config/relay.go
+++ b/internal/config/relay.go
@@ -42,6 +42,18 @@ type Relay struct {
 	// (docs/RELAY.md says so where the line is printed).
 	Secret string `json:"secret,omitempty"`
 
+	// FleetSeed is the fleet key's Ed25519 seed, unpadded base64url —
+	// exactly the value `flue relay join --fleet` was given, minted by
+	// `flue relay setup` alongside the secret (spec/fleet-trust.md and
+	// internal/fleet own its meaning; this package only stores the string).
+	// It is the one credential in this file the Worker never holds: the
+	// secret's other copy lives on Cloudflare, the fleet key's copies live
+	// only in the fleet's relay.json files and the join line that carried
+	// it between them. Never logged, never sent anywhere, and the second
+	// reason this file is 0600 — a leaked seed signs device certs every
+	// machine in the fleet honours.
+	FleetSeed string `json:"fleet_seed,omitempty"`
+
 	// MachineID is the slot this machine holds on the relay: the <id> in the
 	// /daemon/<id> leg the daemon dials and the /client/<id> URLs browsers
 	// open. Minted by `flue relay setup` and `flue relay join` (MintMachineID),
diff --git a/internal/crypto/devices.go b/internal/crypto/devices.go
index 0484dbe..b5efada 100644
--- a/internal/crypto/devices.go
+++ b/internal/crypto/devices.go
@@ -5,6 +5,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"os"
 	"path/filepath"
@@ -19,6 +20,15 @@ type Device struct {
 	PublicKey []byte    `json:"publicKey"`
 	PairedAt  time.Time `json:"pairedAt"`
 	LastSeen  time.Time `json:"lastSeen"`
+
+	// Cert is the fleet device certificate for this key — the signed blob
+	// exactly as internal/fleet produces it — when there is one: minted by
+	// this machine's own pairing ceremony, or presented by the device in
+	// its handshake after pairing elsewhere (spec/fleet-trust.md). Opaque
+	// to this package, kept so the machine can hand the cert onward — the
+	// fleet directory will publish it — and empty for devices paired
+	// before the fleet key existed.
+	Cert []byte `json:"cert,omitempty"`
 }
 
 // DeviceID derives the identity from the key itself, so an entry cannot
@@ -60,7 +70,13 @@ func (s *DeviceStore) save(devices []Device) error {
 	if err != nil {
 		return err
 	}
-	tmp, err := os.CreateTemp(filepath.Dir(s.path), "devices.json.*")
+	return s.writeFileLocked(s.path, blob)
+}
+
+// writeFileLocked writes one registry file atomically at 0600. Callers hold
+// s.mu; the name says so.
+func (s *DeviceStore) writeFileLocked(path string, blob []byte) error {
+	tmp, err := os.CreateTemp(filepath.Dir(path), filepath.Base(path)+".*")
 	if err != nil {
 		return err
 	}
@@ -93,7 +109,7 @@ func (s *DeviceStore) save(devices []Device) error {
 	if err := tmp.Close(); err != nil {
 		return err
 	}
-	return os.Rename(tmp.Name(), s.path)
+	return os.Rename(tmp.Name(), path)
 }
 
 func (s *DeviceStore) List() ([]Device, error) {
@@ -102,7 +118,10 @@ func (s *DeviceStore) List() ([]Device, error) {
 	return s.load()
 }
 
-func (s *DeviceStore) Add(label string, publicKey []byte) (Device, error) {
+// Add registers a freshly paired device. cert is its fleet device
+// certificate — nil on a daemon with no fleet key, which pairs exactly as it
+// always did.
+func (s *DeviceStore) Add(label string, publicKey, cert []byte) (Device, error) {
 	if len(publicKey) != 32 {
 		return Device{}, fmt.Errorf("crypto: device key must be 32 bytes, got %d", len(publicKey))
 	}
@@ -123,7 +142,62 @@ func (s *DeviceStore) Add(label string, publicKey []byte) (Device, error) {
 		}
 	}
 	now := time.Now().UTC()
-	d := Device{ID: id, Label: label, PublicKey: slices.Clone(publicKey), PairedAt: now, LastSeen: now}
+	d := Device{ID: id, Label: label, PublicKey: slices.Clone(publicKey), PairedAt: now, LastSeen: now, Cert: slices.Clone(cert)}
+	if err := s.save(append(devices, d)); err != nil {
+		return Device{}, err
+	}
+	return d, nil
+}
+
+// ErrDeviceRevoked is AddFromFleetCert refusing a key on the revocation
+// list. A revocation permanently outranks a device cert for the same key,
+// whatever either one's timestamp says (spec/fleet-trust.md): the check is
+// membership, never a time comparison, and it happens in the same critical
+// section as the add so a concurrent revoke cannot slip between them.
+var ErrDeviceRevoked = errors.New("crypto: this device key is revoked")
+
+// AddFromFleetCert registers a device this machine never paired itself — it
+// arrived with a fleet certificate another machine's ceremony minted — and
+// is what makes the Devices screen show it and LastSeen work.
+//
+// It is idempotent where Add is not: two channels racing the same new
+// device both succeed, the second finding the entry the first wrote. That
+// is the honest semantic — "make sure this certified key is registered" —
+// where Add's is "record the ceremony that just happened", which must never
+// happen twice. An existing entry is returned untouched, label and cert
+// included: the registry is this machine's record, and a reconnect is not
+// an edit.
+//
+// pairedAt is the cert's iat — when the device joined the fleet, which is
+// the fact the column shows — while LastSeen starts now.
+func (s *DeviceStore) AddFromFleetCert(label string, publicKey, cert []byte, pairedAt time.Time) (Device, error) {
+	if len(publicKey) != 32 {
+		return Device{}, fmt.Errorf("crypto: device key must be 32 bytes, got %d", len(publicKey))
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if revoked, err := s.isRevokedLocked(publicKey); err != nil {
+		return Device{}, err
+	} else if revoked {
+		return Device{}, ErrDeviceRevoked
+	}
+	devices, err := s.load()
+	if err != nil {
+		return Device{}, err
+	}
+	for _, d := range devices {
+		if bytes.Equal(d.PublicKey, publicKey) {
+			return d, nil
+		}
+	}
+	d := Device{
+		ID:        DeviceID(publicKey),
+		Label:     label,
+		PublicKey: slices.Clone(publicKey),
+		PairedAt:  pairedAt.UTC(),
+		LastSeen:  time.Now().UTC(),
+		Cert:      slices.Clone(cert),
+	}
 	if err := s.save(append(devices, d)); err != nil {
 		return Device{}, err
 	}
@@ -176,6 +250,23 @@ func (s *DeviceStore) UpdateLastSeen(id string, now time.Time) (bool, error) {
 	return false, nil
 }
 
+// FindByID looks a device up by its display identity — what the revocation
+// path holds — without changing anything.
+func (s *DeviceStore) FindByID(id string) (Device, bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	devices, err := s.load()
+	if err != nil {
+		return Device{}, false, err
+	}
+	for _, d := range devices {
+		if d.ID == id {
+			return d, true, nil
+		}
+	}
+	return Device{}, false, nil
+}
+
 func (s *DeviceStore) FindByKey(publicKey []byte) (Device, bool, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
@@ -198,3 +289,108 @@ func (s *DeviceStore) FindByKey(publicKey []byte) (Device, bool, error) {
 	}
 	return Device{}, false, nil
 }
+
+// --- the revocation set ---
+
+// Revocations live in revocations.json beside devices.json, under the same
+// lock, because the two are one fact with two signs: a device is paired, or
+// its key is dead. Removing an entry from devices.json stopped being a
+// complete revocation the day fleet certs existed — the cert would walk the
+// device straight back in through AddFromFleetCert — so the revocation is
+// recorded here, permanently. Un-revoking is pairing again under a fresh
+// key (spec/fleet-trust.md); nothing ever deletes from this file.
+//
+// Each entry keeps the signed revocation blob the fleet key produced, so
+// the record that refuses the key locally is the same artifact the fleet
+// directory will publish to every other machine.
+
+// revocationsFileName is the set's file, 0600 like devices.json — not
+// because revocations are secret (they are signed, public artifacts) but
+// because one loose mode in this directory would be one to explain.
+const revocationsFileName = "revocations.json"
+
+// StoredRevocation is one dead key: the key itself, and the signed
+// fleet revocation for it.
+type StoredRevocation struct {
+	PublicKey []byte `json:"publicKey"`
+	Cert      []byte `json:"cert"`
+}
+
+func (s *DeviceStore) revocationsPath() string {
+	return filepath.Join(filepath.Dir(s.path), revocationsFileName)
+}
+
+func (s *DeviceStore) loadRevocations() ([]StoredRevocation, error) {
+	raw, err := os.ReadFile(s.revocationsPath())
+	if os.IsNotExist(err) {
+		return nil, nil
+	}
+	if err != nil {
+		return nil, err
+	}
+	var out []StoredRevocation
+	if err := json.Unmarshal(raw, &out); err != nil {
+		return nil, fmt.Errorf("crypto: %s is not a revocation list: %w", s.revocationsPath(), err)
+	}
+	return out, nil
+}
+
+func (s *DeviceStore) isRevokedLocked(publicKey []byte) (bool, error) {
+	revs, err := s.loadRevocations()
+	if err != nil {
+		return false, err
+	}
+	for _, r := range revs {
+		if bytes.Equal(r.PublicKey, publicKey) {
+			return true, nil
+		}
+	}
+	return false, nil
+}
+
+// IsRevoked reports whether publicKey is on the revocation list. An
+// unreadable list is an error, not a false: the caller deciding whether to
+// admit a key must refuse when it cannot know, the same direction FindByKey
+// errors push.
+func (s *DeviceStore) IsRevoked(publicKey []byte) (bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.isRevokedLocked(publicKey)
+}
+
+// AddRevocation records a dead key with its signed revocation. Idempotent
+// by key — revoking twice, or hearing the same revocation again from the
+// directory one stage on, is one entry — and the first blob recorded wins,
+// which is safe because any verifying revocation for a key is exactly as
+// dead as any other.
+func (s *DeviceStore) AddRevocation(publicKey, cert []byte) error {
+	if len(publicKey) != 32 {
+		return fmt.Errorf("crypto: device key must be 32 bytes, got %d", len(publicKey))
+	}
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	revs, err := s.loadRevocations()
+	if err != nil {
+		return err
+	}
+	for _, r := range revs {
+		if bytes.Equal(r.PublicKey, publicKey) {
+			return nil
+		}
+	}
+	revs = append(revs, StoredRevocation{PublicKey: slices.Clone(publicKey), Cert: slices.Clone(cert)})
+	blob, err := json.MarshalIndent(revs, "", "  ")
+	if err != nil {
+		return err
+	}
+	return s.writeFileLocked(s.revocationsPath(), blob)
+}
+
+// Revocations is the whole set — what the directory publisher one stage on
+// pushes for the machines that were not in the room when the revoke
+// happened.
+func (s *DeviceStore) Revocations() ([]StoredRevocation, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	return s.loadRevocations()
+}
diff --git a/internal/crypto/devices_test.go b/internal/crypto/devices_test.go
index c33747e..0a8e970 100644
--- a/internal/crypto/devices_test.go
+++ b/internal/crypto/devices_test.go
@@ -5,6 +5,7 @@ import (
 	"crypto/rand"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"slices"
@@ -52,7 +53,7 @@ func TestDeviceStoreRoundTrip(t *testing.T) {
 	s := NewDeviceStore(dir)
 
 	key := testKey(t)
-	d, err := s.Add("karn's phone", key)
+	d, err := s.Add("karn's phone", key, nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -83,14 +84,14 @@ func TestDeviceStoreRoundTrip(t *testing.T) {
 
 func TestDeviceStoreRejectsBadAndDuplicateKeys(t *testing.T) {
 	s := NewDeviceStore(t.TempDir())
-	if _, err := s.Add("short", []byte{1, 2, 3}); err == nil {
+	if _, err := s.Add("short", []byte{1, 2, 3}, nil); err == nil {
 		t.Fatal("accepted a non-32-byte key")
 	}
 	key := testKey(t)
-	if _, err := s.Add("first", key); err != nil {
+	if _, err := s.Add("first", key, nil); err != nil {
 		t.Fatal(err)
 	}
-	if _, err := s.Add("second", key); err == nil {
+	if _, err := s.Add("second", key, nil); err == nil {
 		t.Fatal("accepted the same key twice")
 	}
 }
@@ -168,7 +169,7 @@ func TestAddDecidesDuplicatesOnTheWholeKey(t *testing.T) {
 	fresh := testKey(t)
 	writeRegistry(t, dir, []Device{planted(DeviceID(fresh), paired)})
 
-	d, err := s.Add("second phone", fresh)
+	d, err := s.Add("second phone", fresh, nil)
 	if err != nil {
 		t.Fatalf("Add refused a key the registry does not hold: %v", err)
 	}
@@ -177,7 +178,7 @@ func TestAddDecidesDuplicatesOnTheWholeKey(t *testing.T) {
 	}
 
 	// The true duplicate is still refused, on the bytes.
-	if _, err := s.Add("again", fresh); err == nil {
+	if _, err := s.Add("again", fresh, nil); err == nil {
 		t.Fatal("Add accepted the same key twice")
 	}
 }
@@ -187,7 +188,7 @@ func TestAddDecidesDuplicatesOnTheWholeKey(t *testing.T) {
 // a connection may be stamping itself at the moment it is revoked.
 func TestUpdateLastSeen(t *testing.T) {
 	s := NewDeviceStore(t.TempDir())
-	dev, err := s.Add("phone", testKey(t))
+	dev, err := s.Add("phone", testKey(t), nil)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -218,9 +219,100 @@ func TestUpdateLastSeen(t *testing.T) {
 	}
 }
 
+// TestAddFromFleetCert: the fleet-admission write is idempotent — two
+// channels racing the same new device both succeed on one entry — and the
+// entry carries the cert, the cert's pairing time, and a fresh LastSeen.
+func TestAddFromFleetCert(t *testing.T) {
+	s := NewDeviceStore(t.TempDir())
+	key := testKey(t)
+	cert := []byte("a signed blob, opaque to this package")
+	pairedAt := time.Now().Add(-24 * time.Hour).Truncate(time.Second)
+
+	d, err := s.AddFromFleetCert("attic phone", key, cert, pairedAt)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if d.Label != "attic phone" || !bytes.Equal(d.Cert, cert) || !d.PairedAt.Equal(pairedAt) {
+		t.Fatalf("admitted device = %+v", d)
+	}
+	if !d.LastSeen.After(pairedAt) {
+		t.Fatalf("LastSeen = %v, want now rather than the cert's iat", d.LastSeen)
+	}
+
+	// Again, with a different label: the existing entry wins, untouched.
+	again, err := s.AddFromFleetCert("someone renamed it", key, []byte("another blob"), time.Now())
+	if err != nil {
+		t.Fatal(err)
+	}
+	if again.Label != "attic phone" || !bytes.Equal(again.Cert, cert) {
+		t.Fatalf("a second admission rewrote the entry: %+v", again)
+	}
+	if list, _ := s.List(); len(list) != 1 {
+		t.Fatalf("registry holds %d entries, want 1", len(list))
+	}
+}
+
+// TestRevocationOutranksTheCert is the spec's precedence rule at the store:
+// a revoked key is refused by AddFromFleetCert however fresh the cert that
+// presents it, because the check is set membership and never a timestamp.
+func TestRevocationOutranksTheCert(t *testing.T) {
+	s := NewDeviceStore(t.TempDir())
+	key := testKey(t)
+
+	if err := s.AddRevocation(key, []byte("signed revocation")); err != nil {
+		t.Fatal(err)
+	}
+	if revoked, err := s.IsRevoked(key); err != nil || !revoked {
+		t.Fatalf("IsRevoked = %v, %v", revoked, err)
+	}
+	if _, err := s.AddFromFleetCert("it's back", key, []byte("a newer cert"), time.Now()); !errors.Is(err, ErrDeviceRevoked) {
+		t.Fatalf("AddFromFleetCert on a revoked key = %v, want ErrDeviceRevoked", err)
+	}
+	if list, _ := s.List(); len(list) != 0 {
+		t.Fatalf("the revoked key reached the registry: %+v", list)
+	}
+
+	// A different key is unaffected, and Add — this machine's own ceremony —
+	// deliberately is too: rule 1 of the acceptance order is "pairing on
+	// this machine works as before", and a fresh ceremony mints a fresh key
+	// anyway.
+	other := testKey(t)
+	if revoked, err := s.IsRevoked(other); err != nil || revoked {
+		t.Fatalf("IsRevoked(other) = %v, %v", revoked, err)
+	}
+
+	// Recording the same key again is one entry, and the set survives a
+	// fresh store over the same directory.
+	if err := s.AddRevocation(key, []byte("recorded twice")); err != nil {
+		t.Fatal(err)
+	}
+	revs, err := NewDeviceStore(filepath.Dir(s.revocationsPath())).Revocations()
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(revs) != 1 || !bytes.Equal(revs[0].PublicKey, key) || string(revs[0].Cert) != "signed revocation" {
+		t.Fatalf("revocations = %+v, want the one original entry", revs)
+	}
+}
+
+func TestFindByID(t *testing.T) {
+	s := NewDeviceStore(t.TempDir())
+	d, err := s.Add("phone", testKey(t), nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	got, ok, err := s.FindByID(d.ID)
+	if err != nil || !ok || got.ID != d.ID {
+		t.Fatalf("FindByID = %+v, %v, %v", got, ok, err)
+	}
+	if _, ok, err := s.FindByID("000000000000"); err != nil || ok {
+		t.Fatalf("FindByID of an unknown id = %v, %v, want false and no error", ok, err)
+	}
+}
+
 func TestDeviceStoreRemove(t *testing.T) {
 	s := NewDeviceStore(t.TempDir())
-	d, err := s.Add("phone", testKey(t))
+	d, err := s.Add("phone", testKey(t), nil)
 	if err != nil {
 		t.Fatal(err)
 	}
diff --git a/internal/crypto/handshake.go b/internal/crypto/handshake.go
index f0ad5a7..a9957cf 100644
--- a/internal/crypto/handshake.go
+++ b/internal/crypto/handshake.go
@@ -11,14 +11,31 @@ import (
 // IK, message by message:
 //   <- s            (pre-message: the initiator knows the daemon's static key
 //                    from the pairing QR — that is the pinning)
-//   -> e, es, s, ss
+//   -> e, es, s, ss [payload]
 //   <- e, ee, se
 // Two messages, then both sides hold a pair of CipherStates.
+//
+// Message A's payload is encrypted — under keys mixed from es and ss, so
+// only the pinned responder can read it and only a sender holding the static
+// key it announces could have sealed it — and it is where the initiator
+// presents its fleet device certificate (spec/fleet-trust.md): empty means
+// none, anything else must be exactly one signed cert blob. The payload is
+// carried and returned here verbatim; judging it is the transport's job
+// (internal/transport/relay/channel.go), because "no cert" is a fine
+// handshake and only the acceptance rule knows whether it is a fine client.
+//
+// One honest caveat the acceptance rule lives with: message A, bytes and
+// payload, can be replayed by an observer. A replayer cannot finish the
+// session — it never learns the ephemeral behind e — so what a replay buys
+// is re-presenting a cert that was already presented, which re-admits a key
+// that was already admitted: idempotent, and revocation is checked on every
+// presentation.
 
-// InitiatorHandshake runs the browser side of the handshake. It exists in Go
-// for tests and the vector generator; production initiators are TypeScript.
-// rng == nil means crypto/rand.
-func InitiatorHandshake(static noise.DHKey, peerStatic []byte, rng io.Reader, recv func() ([]byte, error), send func([]byte) error) (*Channel, error) {
+// InitiatorHandshake runs the browser side of the handshake, sending payload
+// in message A (nil for none). It exists in Go for tests and the vector
+// generator; production initiators are TypeScript. rng == nil means
+// crypto/rand.
+func InitiatorHandshake(static noise.DHKey, peerStatic []byte, payload []byte, rng io.Reader, recv func() ([]byte, error), send func([]byte) error) (*Channel, error) {
 	if rng == nil {
 		rng = rand.Reader
 	}
@@ -33,7 +50,7 @@ func InitiatorHandshake(static noise.DHKey, peerStatic []byte, rng io.Reader, re
 	if err != nil {
 		return nil, err
 	}
-	msg1, _, _, err := hs.WriteMessage(nil, nil)
+	msg1, _, _, err := hs.WriteMessage(nil, payload)
 	if err != nil {
 		return nil, fmt.Errorf("crypto: handshake message 1: %w", err)
 	}
@@ -55,9 +72,10 @@ func InitiatorHandshake(static noise.DHKey, peerStatic []byte, rng io.Reader, re
 
 // ResponderHandshake runs the daemon side. The returned public key is the
 // initiator's static — the device identity the caller authorizes against the
-// device store. Callers must treat an error as fatal to the connection and
-// process no frames before the handshake completes.
-func ResponderHandshake(static noise.DHKey, rng io.Reader, recv func() ([]byte, error), send func([]byte) error) (*Channel, []byte, error) {
+// device store — and payload is message A's decrypted payload, empty when
+// the initiator sent none. Callers must treat an error as fatal to the
+// connection and process no frames before the handshake completes.
+func ResponderHandshake(static noise.DHKey, rng io.Reader, recv func() ([]byte, error), send func([]byte) error) (*Channel, []byte, []byte, error) {
 	if rng == nil {
 		rng = rand.Reader
 	}
@@ -69,21 +87,22 @@ func ResponderHandshake(static noise.DHKey, rng io.Reader, recv func() ([]byte,
 		Random:        rng,
 	})
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
 	msg1, err := recv()
 	if err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
-	if _, _, _, err := hs.ReadMessage(nil, msg1); err != nil {
-		return nil, nil, fmt.Errorf("crypto: handshake message 1: %w", err)
+	payload, _, _, err := hs.ReadMessage(nil, msg1)
+	if err != nil {
+		return nil, nil, nil, fmt.Errorf("crypto: handshake message 1: %w", err)
 	}
 	msg2, csI2R, csR2I, err := hs.WriteMessage(nil, nil)
 	if err != nil {
-		return nil, nil, fmt.Errorf("crypto: handshake message 2: %w", err)
+		return nil, nil, nil, fmt.Errorf("crypto: handshake message 2: %w", err)
 	}
 	if err := send(msg2); err != nil {
-		return nil, nil, err
+		return nil, nil, nil, err
 	}
-	return &Channel{send: csR2I, recv: csI2R}, hs.PeerStatic(), nil
+	return &Channel{send: csR2I, recv: csI2R}, hs.PeerStatic(), payload, nil
 }
diff --git a/internal/crypto/handshake_test.go b/internal/crypto/handshake_test.go
index 8d79997..9d3af0a 100644
--- a/internal/crypto/handshake_test.go
+++ b/internal/crypto/handshake_test.go
@@ -19,6 +19,14 @@ func (p *pipe) bSend(b []byte) error   { p.b2a <- b; return nil }
 func (p *pipe) bRecv() ([]byte, error) { return <-p.a2b, nil }
 
 func handshakePair(t *testing.T) (initiator, responder *Channel, deviceStatic []byte) {
+	i, r, static, payload := handshakePairWithPayload(t, nil)
+	if len(payload) != 0 {
+		t.Fatalf("an initiator that sent no payload delivered %d bytes of one", len(payload))
+	}
+	return i, r, static
+}
+
+func handshakePairWithPayload(t *testing.T, payload []byte) (initiator, responder *Channel, deviceStatic, gotPayload []byte) {
 	t.Helper()
 	daemonKey, err := Suite().GenerateKeypair(rand.Reader)
 	if err != nil {
@@ -30,16 +38,17 @@ func handshakePair(t *testing.T) (initiator, responder *Channel, deviceStatic []
 	}
 	p := newPipe()
 	type res struct {
-		ch   *Channel
-		peer []byte
-		err  error
+		ch      *Channel
+		peer    []byte
+		payload []byte
+		err     error
 	}
 	done := make(chan res, 1)
 	go func() {
-		ch, peer, err := ResponderHandshake(daemonKey, nil, p.bRecv, p.bSend)
-		done <- res{ch, peer, err}
+		ch, peer, pl, err := ResponderHandshake(daemonKey, nil, p.bRecv, p.bSend)
+		done <- res{ch, peer, pl, err}
 	}()
-	ich, err := InitiatorHandshake(deviceKey, daemonKey.Public, nil, p.aRecv, p.aSend)
+	ich, err := InitiatorHandshake(deviceKey, daemonKey.Public, payload, nil, p.aRecv, p.aSend)
 	if err != nil {
 		t.Fatalf("initiator: %v", err)
 	}
@@ -50,7 +59,25 @@ func handshakePair(t *testing.T) (initiator, responder *Channel, deviceStatic []
 	if !bytes.Equal(r.peer, deviceKey.Public) {
 		t.Fatal("responder saw the wrong initiator static key")
 	}
-	return ich, r.ch, deviceKey.Public
+	return ich, r.ch, deviceKey.Public, r.payload
+}
+
+// TestHandshakePayloadRoundTrips: message A's encrypted payload — where the
+// fleet device cert rides (spec/fleet-trust.md) — reaches the responder byte
+// for byte, and the channel that follows works exactly as one without it.
+func TestHandshakePayloadRoundTrips(t *testing.T) {
+	want := []byte("an opaque cert blob, as far as this layer knows")
+	i, r, _, payload := handshakePairWithPayload(t, want)
+	if !bytes.Equal(payload, want) {
+		t.Fatalf("responder read payload %q, want %q", payload, want)
+	}
+	ct, err := i.Seal([]byte("after the payload"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if pt, err := r.Open(ct); err != nil || string(pt) != "after the payload" {
+		t.Fatalf("transport after a payload handshake: %q, %v", pt, err)
+	}
 }
 
 func TestHandshakeAndBothDirections(t *testing.T) {
@@ -117,12 +144,12 @@ func TestWrongPinnedStaticKeyFailsTheHandshake(t *testing.T) {
 
 	errCh := make(chan error, 1)
 	go func() {
-		_, _, err := ResponderHandshake(daemonKey, nil, recvWithTimeout(p.bRecv), sendWithTimeout(p.bSend))
+		_, _, _, err := ResponderHandshake(daemonKey, nil, recvWithTimeout(p.bRecv), sendWithTimeout(p.bSend))
 		errCh <- err
 	}()
 	// The initiator pins the imposter's key; IK's first message encrypts to
 	// the pinned key, so the real daemon must fail to read it.
-	if _, err := InitiatorHandshake(deviceKey, imposter.Public, nil, recvWithTimeout(p.aRecv), sendWithTimeout(p.aSend)); err == nil {
+	if _, err := InitiatorHandshake(deviceKey, imposter.Public, nil, nil, recvWithTimeout(p.aRecv), sendWithTimeout(p.aSend)); err == nil {
 		// The initiator may or may not detect it first depending on where
 		// decryption fails; the responder must.
 		if err := <-errCh; err == nil {
diff --git a/internal/crypto/vectors_test.go b/internal/crypto/vectors_test.go
index 3bbe4e5..f1b40f4 100644
--- a/internal/crypto/vectors_test.go
+++ b/internal/crypto/vectors_test.go
@@ -60,16 +60,70 @@ type vectorMessage struct {
 
 const vectorPath = "../../testdata/noise/ik.json"
 
+// payloadVectorPath is ik.json's sibling with a certificate riding message
+// A's encrypted payload: the same protocol, the same deterministic statics
+// and ephemerals, and one new field — msg1Payload, the fleet device cert
+// blob out of testdata/fleet/certs.json, verbatim. ik.json itself is
+// deliberately untouched (its msg1 carries the empty payload every
+// pre-fleet initiator sends, and the TS suites replay it as committed);
+// this file is what pins the payload-bearing shape for the TS initiator
+// that will send one. Regenerate testdata/fleet/certs.json first — this
+// file embeds its bytes.
+const payloadVectorPath = "../../testdata/noise/ik-payload.json"
+
+// fleetCertsPath is where the payload bytes come from. Read as data, not
+// imported: the cert blob is opaque to this layer, which is the point.
+const fleetCertsPath = "../../testdata/fleet/certs.json"
+
+type payloadVectorFile struct {
+	vectorFile
+	// Msg1Payload is the plaintext the initiator sealed into message A —
+	// hex, like every other byte string here. It equals the "device" case's
+	// signedHex in testdata/fleet/certs.json, and the assertion run checks
+	// that too, so the two fixtures cannot drift apart.
+	Msg1Payload string `json:"msg1Payload"`
+}
+
+// fixtureDeviceCert reads the signed device-cert blob the payload vectors
+// carry.
+func fixtureDeviceCert(t *testing.T) []byte {
+	t.Helper()
+	raw, err := os.ReadFile(fleetCertsPath)
+	if err != nil {
+		t.Fatalf("reading %s (generate with `go test ./internal/fleet/ -update`): %v", fleetCertsPath, err)
+	}
+	var f struct {
+		Cases []struct {
+			Name      string `json:"name"`
+			SignedHex string `json:"signedHex"`
+		} `json:"cases"`
+	}
+	if err := json.Unmarshal(raw, &f); err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range f.Cases {
+		if c.Name == "device" {
+			b, err := hex.DecodeString(c.SignedHex)
+			if err != nil {
+				t.Fatal(err)
+			}
+			return b
+		}
+	}
+	t.Fatalf("%s carries no \"device\" case", fleetCertsPath)
+	return nil
+}
+
 // capture records every frame either side sends, while still delivering it.
 type capture struct {
 	pipe *pipe
 	msgs [][]byte
 }
 
-func TestGenerateVectors(t *testing.T) {
-	if !*update {
-		t.Skip("run with -update to regenerate")
-	}
+// generateVectors runs one deterministic handshake — msg-A payload included,
+// nil for none — and returns everything a replay needs.
+func generateVectors(t *testing.T, payload []byte) vectorFile {
+	t.Helper()
 	// Static keys from their own deterministic streams; ephemerals from the
 	// streams handed to the handshakes. GenerateKeypair reads exactly 32
 	// bytes, so the ephemeral private key is the first 32 bytes of that
@@ -99,12 +153,12 @@ func TestGenerateVectors(t *testing.T) {
 	}
 	done := make(chan rres, 1)
 	go func() {
-		ch, _, err := ResponderHandshake(rStatic, &detReader{label: []byte("responder-ephemeral")},
+		ch, _, _, err := ResponderHandshake(rStatic, &detReader{label: []byte("responder-ephemeral")},
 			func() ([]byte, error) { b := <-p.a2b; msg1 = b; return b, nil },
 			func(b []byte) error { msg2 = b; p.b2a <- b; return nil })
 		done <- rres{ch, err}
 	}()
-	iCh, err := InitiatorHandshake(iStatic, rStatic.Public, &detReader{label: []byte("initiator-ephemeral")}, p.aRecv, p.aSend)
+	iCh, err := InitiatorHandshake(iStatic, rStatic.Public, payload, &detReader{label: []byte("initiator-ephemeral")}, p.aRecv, p.aSend)
 	if err != nil {
 		t.Fatal(err)
 	}
@@ -128,7 +182,7 @@ func TestGenerateVectors(t *testing.T) {
 	seal("r2i", r.ch, iCh, []byte("hello browser"))
 	seal("i2r", iCh, r.ch, nil)
 
-	out, err := json.MarshalIndent(vectorFile{
+	return vectorFile{
 		Protocol:               "Noise_IK_25519_ChaChaPoly_SHA256",
 		InitiatorStaticPriv:    hex.EncodeToString(iStatic.Private),
 		InitiatorStaticPub:     hex.EncodeToString(iStatic.Public),
@@ -139,27 +193,39 @@ func TestGenerateVectors(t *testing.T) {
 		Msg1:                   hex.EncodeToString(msg1),
 		Msg2:                   hex.EncodeToString(msg2),
 		Transport:              transport,
-	}, "", "  ")
+	}
+}
+
+func writeVectorFile(t *testing.T, path string, v any) {
+	t.Helper()
+	out, err := json.MarshalIndent(v, "", "  ")
 	if err != nil {
 		t.Fatal(err)
 	}
-	if err := os.MkdirAll(filepath.Dir(vectorPath), 0o755); err != nil {
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
 		t.Fatal(err)
 	}
-	if err := os.WriteFile(vectorPath, append(out, '\n'), 0o644); err != nil {
+	if err := os.WriteFile(path, append(out, '\n'), 0o644); err != nil {
 		t.Fatal(err)
 	}
 }
 
-func TestVectorsAgainstDisk(t *testing.T) {
-	raw, err := os.ReadFile(vectorPath)
-	if err != nil {
-		t.Fatalf("read vectors (generate with -update): %v", err)
-	}
-	var v vectorFile
-	if err := json.Unmarshal(raw, &v); err != nil {
-		t.Fatal(err)
+func TestGenerateVectors(t *testing.T) {
+	if !*update {
+		t.Skip("run with -update to regenerate")
 	}
+	writeVectorFile(t, vectorPath, generateVectors(t, nil))
+
+	cert := fixtureDeviceCert(t)
+	pv := payloadVectorFile{vectorFile: generateVectors(t, cert), Msg1Payload: hex.EncodeToString(cert)}
+	writeVectorFile(t, payloadVectorPath, pv)
+}
+
+// replayVectorFile replays the responder side against the recorded msg1,
+// asserts every byte it produces matches the file, and returns the msg-A
+// payload the responder read.
+func replayVectorFile(t *testing.T, path string, v vectorFile) []byte {
+	t.Helper()
 	unhex := func(s string) []byte {
 		b, err := hex.DecodeString(s)
 		if err != nil {
@@ -168,36 +234,78 @@ func TestVectorsAgainstDisk(t *testing.T) {
 		return b
 	}
 
-	// Replay the responder side against the recorded msg1 and assert every
-	// byte it produces matches the file.
 	rStatic := noiseKey(unhex(v.ResponderStaticPriv), unhex(v.ResponderStaticPub))
 	var gotMsg2 []byte
-	ch, peer, err := ResponderHandshake(rStatic, &detReader{label: []byte("responder-ephemeral")},
+	ch, peer, payload, err := ResponderHandshake(rStatic, &detReader{label: []byte("responder-ephemeral")},
 		func() ([]byte, error) { return unhex(v.Msg1), nil },
 		func(b []byte) error { gotMsg2 = b; return nil })
 	if err != nil {
 		t.Fatal(err)
 	}
 	if !bytes.Equal(gotMsg2, unhex(v.Msg2)) {
-		t.Fatal("responder produced a different msg2 than the vector file")
+		t.Fatalf("%s: responder produced a different msg2 than the vector file", path)
 	}
 	if !bytes.Equal(peer, unhex(v.InitiatorStaticPub)) {
-		t.Fatal("responder resolved a different initiator identity")
+		t.Fatalf("%s: responder resolved a different initiator identity", path)
 	}
 	for _, m := range v.Transport {
 		switch m.Dir {
 		case "i2r":
 			pt, err := ch.Open(unhex(m.Ciphertext))
 			if err != nil || !bytes.Equal(pt, unhex(m.Plaintext)) {
-				t.Fatalf("i2r transport message: %v", err)
+				t.Fatalf("%s: i2r transport message: %v", path, err)
 			}
 		case "r2i":
 			ct, err := ch.Seal(unhex(m.Plaintext))
 			if err != nil || !bytes.Equal(ct, unhex(m.Ciphertext)) {
-				t.Fatalf("r2i transport message: %v", err)
+				t.Fatalf("%s: r2i transport message: %v", path, err)
 			}
 		}
 	}
+	return payload
+}
+
+func TestVectorsAgainstDisk(t *testing.T) {
+	raw, err := os.ReadFile(vectorPath)
+	if err != nil {
+		t.Fatalf("read vectors (generate with -update): %v", err)
+	}
+	var v vectorFile
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatal(err)
+	}
+	// ik.json's msg1 is the payload-less handshake every pre-fleet initiator
+	// sends, and it must stay that: the TS suites replay these bytes as the
+	// ordinary client.
+	if payload := replayVectorFile(t, vectorPath, v); len(payload) != 0 {
+		t.Fatalf("ik.json's msg1 carries a %d-byte payload, want none", len(payload))
+	}
+}
+
+// TestPayloadVectorsAgainstDisk replays ik-payload.json — message A carrying
+// the fleet device cert — and holds it to testdata/fleet/certs.json: the
+// payload the responder reads must be the "device" case's signed blob,
+// byte for byte, so the two fixtures cannot drift apart.
+func TestPayloadVectorsAgainstDisk(t *testing.T) {
+	raw, err := os.ReadFile(payloadVectorPath)
+	if err != nil {
+		t.Fatalf("read vectors (generate with -update): %v", err)
+	}
+	var v payloadVectorFile
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatal(err)
+	}
+	payload := replayVectorFile(t, payloadVectorPath, v.vectorFile)
+	want, err := hex.DecodeString(v.Msg1Payload)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if !bytes.Equal(payload, want) {
+		t.Fatal("the responder read a different msg1 payload than the file records")
+	}
+	if cert := fixtureDeviceCert(t); !bytes.Equal(payload, cert) {
+		t.Fatal("ik-payload.json's payload is not testdata/fleet/certs.json's device blob; regenerate certs.json first, then these vectors")
+	}
 }
 
 func noiseKey(priv, pub []byte) noise.DHKey { return noise.DHKey{Private: priv, Public: pub} }
diff --git a/internal/daemon/pairing.go b/internal/daemon/pairing.go
index aad67ad..b6a0c7c 100644
--- a/internal/daemon/pairing.go
+++ b/internal/daemon/pairing.go
@@ -12,6 +12,8 @@ import (
 	"strings"
 	"sync"
 	"time"
+
+	"github.com/karnstack/flue/internal/fleet"
 )
 
 // PairPath is the second of the two routes that may be reached by a method
@@ -343,7 +345,37 @@ func (s *Server) PairDevice(body []byte, peer string) PairOutcome {
 		return s.refusePair(peer, res.String())
 	}
 
-	dev, err := s.identity.Devices.Add(deviceLabel(req.Label), key)
+	label := deviceLabel(req.Label)
+
+	// The ceremony that just completed is the moment the spec mints the fleet
+	// device cert (spec/fleet-trust.md, Certificates): this machine signs
+	// {device key, name, this machine's id, now} under the fleet key, and the
+	// registry entry carries the blob. Today the cert is what lets this
+	// device into every daemon that holds the fleet public key — it presents
+	// the blob in its handshake — and the stored copy is what the fleet
+	// directory will publish once that stage lands.
+	//
+	// A daemon without a fleet key mints nothing and pairs exactly as it
+	// always did. A signing failure is treated the same way, minus a log
+	// line: it is unreachable short of a corrupt key (the fields here are
+	// already validated), and refusing the user's ceremony over the cert
+	// would take working local pairing away to protect a convenience.
+	var cert []byte
+	if s.identity.Fleet.Valid() {
+		blob, err := s.identity.Fleet.Sign(fleet.DeviceCert{
+			Device:   key,
+			Name:     label,
+			PairedOn: s.relayMachine().id,
+			IAT:      time.Now().Unix(),
+		})
+		if err != nil {
+			s.logger().Error("could not mint a fleet device cert; the device is paired to this machine only", "err", err)
+		} else {
+			cert = blob
+		}
+	}
+
+	dev, err := s.identity.Devices.Add(label, key, cert)
 	if err != nil {
 		// The window is already spent, so this is not a retry loop the caller
 		// can drive; it is a device that was already paired, or a registry
diff --git a/internal/daemon/server.go b/internal/daemon/server.go
index 01da1d4..e92ccb6 100644
--- a/internal/daemon/server.go
+++ b/internal/daemon/server.go
@@ -72,6 +72,7 @@ import (
 	"context"
 	"encoding/json"
 	"errors"
+	"fmt"
 	"log/slog"
 	"net"
 	"net/http"
@@ -86,6 +87,7 @@ import (
 	"github.com/coder/websocket"
 	"github.com/flynn/noise"
 	"github.com/karnstack/flue/internal/crypto"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
 	"github.com/karnstack/flue/internal/wire"
@@ -119,6 +121,14 @@ var (
 type Identity struct {
 	Key     noise.DHKey
 	Devices *crypto.DeviceStore
+
+	// Fleet is the fleet key from relay.json (spec/fleet-trust.md), and the
+	// zero value means this daemon has none — a daemon that never joined a
+	// relay, or joined one from before the key existed. With it, a pairing
+	// ceremony also mints a fleet device cert and a revocation also mints
+	// the signed record that keeps the key dead fleet-wide; without it,
+	// both paths run exactly as they always did, minus the signing.
+	Fleet fleet.Key
 }
 
 // Server serves the flue API and the embedded UI on loopback.
@@ -910,6 +920,17 @@ func (s *Server) SetRelayMachine(id, name string) {
 	s.relayMachineID, s.relayMachineName = id, name
 }
 
+// relayMachine reads the identity SetRelayMachine recorded. The id can be
+// empty — a daemon with no relay, or a pairing that raced startup — and the
+// one consumer that persists it (the device cert's pairedOn) records the
+// empty string honestly rather than inventing a name.
+func (s *Server) relayMachine() (m struct{ id, name string }) {
+	s.relayMu.RLock()
+	defer s.relayMu.RUnlock()
+	m.id, m.name = s.relayMachineID, s.relayMachineName
+	return m
+}
+
 // relayInfo is what a welcome carries, or nil when this daemon has no relay.
 //
 // Nil rather than an object saying "off": the field is optional on both sides,
@@ -1145,10 +1166,39 @@ func validDeviceID(id string) bool {
 }
 
 // removeDevice unpairs a device, reporting whether there was one to unpair.
+//
+// On a daemon holding the fleet key, unpairing is two writes and their order
+// is load-bearing: the signed revocation is recorded first, the registry
+// entry removed second. An entry removed without its revocation on file is
+// not revoked at all — the device's fleet cert would walk it straight back
+// into the registry on its next handshake (AddFromFleetCert) — so a
+// revocation that cannot be recorded fails the whole revoke, loudly, rather
+// than performing the half that does not stick. The converse partial (a
+// revocation recorded, the removal failed) is safe: the key is already dead
+// to the acceptance rule, the entry still shows on the Devices screen, and
+// the retry completes it.
+//
+// The signed blob is kept by the store (crypto.StoredRevocation) because it
+// is the same artifact the fleet directory will publish so every other
+// machine drops the key too; until that stage lands, the record is local
+// and this machine is the only one it binds.
 func (s *Server) removeDevice(id string) (crypto.Device, bool, error) {
 	if s.identity.Devices == nil {
 		return crypto.Device{}, false, errNoDeviceRegistry
 	}
+	if s.identity.Fleet.Valid() {
+		dev, ok, err := s.identity.Devices.FindByID(id)
+		if err != nil || !ok {
+			return crypto.Device{}, ok, err
+		}
+		blob, err := s.identity.Fleet.Sign(fleet.Revocation{Device: dev.PublicKey, IAT: time.Now().Unix()})
+		if err == nil {
+			err = s.identity.Devices.AddRevocation(dev.PublicKey, blob)
+		}
+		if err != nil {
+			return crypto.Device{}, false, fmt.Errorf("daemon: recording the revocation: %w", err)
+		}
+	}
 	return s.identity.Devices.Remove(id)
 }
 
diff --git a/internal/daemon/server_test.go b/internal/daemon/server_test.go
index 0983682..cb71ecb 100644
--- a/internal/daemon/server_test.go
+++ b/internal/daemon/server_test.go
@@ -2596,7 +2596,7 @@ func TestAuditDoesNotLogAnAcceptedRequest(t *testing.T) {
 // the state it leaves behind.
 func addDevice(t *testing.T, srv *Server, label string, fill byte) crypto.Device {
 	t.Helper()
-	d, err := srv.identity.Devices.Add(label, deviceKey(fill))
+	d, err := srv.identity.Devices.Add(label, deviceKey(fill), nil)
 	if err != nil {
 		t.Fatalf("Add(%q): %v", label, err)
 	}
diff --git a/internal/daemon/transport_test.go b/internal/daemon/transport_test.go
index 547bfb5..d25f9fe 100644
--- a/internal/daemon/transport_test.go
+++ b/internal/daemon/transport_test.go
@@ -150,7 +150,7 @@ func TestServeConnClosesTheTransportOnTheWayOutOfAPanic(t *testing.T) {
 // true once the relay arrives.
 func TestServeConnStampsTheDeviceLastSeen(t *testing.T) {
 	store := crypto.NewDeviceStore(t.TempDir())
-	dev, err := store.Add("phone", bytes.Repeat([]byte{0x2a}, 32))
+	dev, err := store.Add("phone", bytes.Repeat([]byte{0x2a}, 32), nil)
 	if err != nil {
 		t.Fatalf("Add: %v", err)
 	}
@@ -195,7 +195,7 @@ func TestServeConnStampsTheDeviceLastSeen(t *testing.T) {
 // being served a shell indefinitely.
 func TestServeConnRefusesADeviceTheRegistryNoLongerHolds(t *testing.T) {
 	store := crypto.NewDeviceStore(t.TempDir())
-	dev, err := store.Add("phone", bytes.Repeat([]byte{0x2a}, 32))
+	dev, err := store.Add("phone", bytes.Repeat([]byte{0x2a}, 32), nil)
 	if err != nil {
 		t.Fatalf("Add: %v", err)
 	}
diff --git a/internal/fleet/fixture_test.go b/internal/fleet/fixture_test.go
new file mode 100644
index 0000000..50a0f7a
--- /dev/null
+++ b/internal/fleet/fixture_test.go
@@ -0,0 +1,213 @@
+package fleet
+
+import (
+	"bytes"
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"flag"
+	"os"
+	"testing"
+)
+
+var update = flag.Bool("update", false, "regenerate testdata/fleet/certs.json")
+
+// certsFixturePath is the cross-language contract for the certificate
+// encoding: this package generates it and asserts every committed case on
+// every run, and the TypeScript sides (browser and, one stage on, whatever
+// reads the fleet directory) walk the same file — the role
+// testdata/relay/machine-ids.json plays for the machine-id MAC and
+// testdata/noise/ik.json for the handshake.
+//
+// Regeneration order matters once: testdata/noise/ik-payload.json embeds
+// this file's device-cert blob as its handshake payload, so regenerate this
+// file first (`go test ./internal/fleet/ -update`), then the noise vectors
+// (`go test ./internal/crypto/ -update`).
+const certsFixturePath = "../../testdata/fleet/certs.json"
+
+// noiseVectorPath is where the fixture borrows its keys from. The device
+// case's key is the noise vectors' initiator static and the machine case's
+// noise key is their responder static, deliberately: the device cert in
+// this file is then a valid handshake payload for the ik-payload vectors,
+// and one replay exercises both fixtures against each other.
+const noiseVectorPath = "../../testdata/noise/ik.json"
+
+type certsFixtureFile struct {
+	// Seed is the fixture fleet key, spelled the way the join line spells
+	// it. Not a credential — it exists to pin arithmetic, like the secrets
+	// in machine-ids.json.
+	Seed string `json:"seed"`
+	// PublicKeyHex is the Ed25519 public key Seed derives — what a consumer
+	// verifies every signedHex under.
+	PublicKeyHex string `json:"publicKeyHex"`
+	Cases        []certsFixtureCase `json:"cases"`
+}
+
+type certsFixtureCase struct {
+	Name string          `json:"name"`
+	Cert certsFixtureDoc `json:"cert"`
+	// CanonicalHex is the canonical encoding — the exact bytes the
+	// signature covers. SignedHex is canonical || signature: the one wire
+	// form, and byte for byte what the IK message-A payload carries.
+	CanonicalHex string `json:"canonicalHex"`
+	SignedHex    string `json:"signedHex"`
+}
+
+// certsFixtureDoc is the cert's fields as JSON, so a consumer builds the
+// cert from named values rather than parsing canonicalHex to learn them.
+type certsFixtureDoc struct {
+	V         int    `json:"v"`
+	Kind      string `json:"kind"`
+	ID        string `json:"id,omitempty"`
+	Name      string `json:"name,omitempty"`
+	NoiseHex  string `json:"noiseHex,omitempty"`
+	DeviceHex string `json:"deviceHex,omitempty"`
+	PairedOn  string `json:"pairedOn,omitempty"`
+	IAT       int64  `json:"iat"`
+}
+
+// fixtureKey is the deterministic fleet key the fixture is signed under.
+func fixtureKey(t *testing.T) Key {
+	t.Helper()
+	seed := sha256.Sum256([]byte("flue-fleet-fixture-key"))
+	k, err := Mint(bytes.NewReader(seed[:]))
+	if err != nil {
+		t.Fatalf("Mint: %v", err)
+	}
+	return k
+}
+
+// noiseFixtureKeys reads the two static public keys out of the committed
+// noise vectors.
+func noiseFixtureKeys(t *testing.T) (initiatorPub, responderPub []byte) {
+	t.Helper()
+	raw, err := os.ReadFile(noiseVectorPath)
+	if err != nil {
+		t.Fatalf("reading %s: %v", noiseVectorPath, err)
+	}
+	var v struct {
+		InitiatorStaticPub string `json:"initiatorStaticPub"`
+		ResponderStaticPub string `json:"responderStaticPub"`
+	}
+	if err := json.Unmarshal(raw, &v); err != nil {
+		t.Fatalf("decoding %s: %v", noiseVectorPath, err)
+	}
+	return unhex(t, v.InitiatorStaticPub), unhex(t, v.ResponderStaticPub)
+}
+
+func unhex(t *testing.T, s string) []byte {
+	t.Helper()
+	b, err := hex.DecodeString(s)
+	if err != nil {
+		t.Fatalf("bad hex %q: %v", s, err)
+	}
+	return b
+}
+
+// certsFixtureCases derives every case from the fixture key and the noise
+// vectors' statics. The machine id is machine-ids.json's ordinary case, so
+// the three fixture families name one coherent little fleet. The
+// unicode-name case is the one a byte-length/rune-length confusion gets
+// wrong.
+func certsFixtureCases(t *testing.T, k Key) []certsFixtureCase {
+	t.Helper()
+	devicePub, noisePub := noiseFixtureKeys(t)
+	const machineID = "karns-macbook-pro-a1b2-8ac6565b"
+
+	certs := []struct {
+		name string
+		cert Cert
+	}{
+		{"machine", MachineCert{ID: machineID, Name: "Karn's MacBook Pro", Noise: noisePub, IAT: 1754700000}},
+		{"device", DeviceCert{Device: devicePub, Name: "relayed phone", PairedOn: machineID, IAT: 1754700001}},
+		{"device-unicode-name", DeviceCert{Device: bytes.Repeat([]byte{0x2a}, 32), Name: "Karn’s téléphone 📱", PairedOn: machineID, IAT: 1754700002}},
+		{"revoke", Revocation{Device: devicePub, IAT: 1754700003}},
+	}
+
+	cases := make([]certsFixtureCase, 0, len(certs))
+	for _, c := range certs {
+		canonical, err := Encode(c.cert)
+		if err != nil {
+			t.Fatalf("Encode(%s): %v", c.name, err)
+		}
+		signed, err := k.Sign(c.cert)
+		if err != nil {
+			t.Fatalf("Sign(%s): %v", c.name, err)
+		}
+		doc := certsFixtureDoc{V: certVersion, Kind: c.cert.Kind()}
+		switch cert := c.cert.(type) {
+		case MachineCert:
+			doc.ID, doc.Name, doc.NoiseHex, doc.IAT = cert.ID, cert.Name, hex.EncodeToString(cert.Noise), cert.IAT
+		case DeviceCert:
+			doc.DeviceHex, doc.Name, doc.PairedOn, doc.IAT = hex.EncodeToString(cert.Device), cert.Name, cert.PairedOn, cert.IAT
+		case Revocation:
+			doc.DeviceHex, doc.IAT = hex.EncodeToString(cert.Device), cert.IAT
+		}
+		cases = append(cases, certsFixtureCase{
+			Name:         c.name,
+			Cert:         doc,
+			CanonicalHex: hex.EncodeToString(canonical),
+			SignedHex:    hex.EncodeToString(signed),
+		})
+	}
+	return cases
+}
+
+// TestCertsFixture re-derives every committed case on every run — which is
+// what catches a drifted prefix, field order or signature input — and, with
+// -update, rewrites the file. The committed file is the artifact; the
+// TypeScript suites assert against it without regenerating.
+func TestCertsFixture(t *testing.T) {
+	k := fixtureKey(t)
+	derived := certsFixtureFile{
+		Seed:         k.Seed(),
+		PublicKeyHex: hex.EncodeToString(k.Public()),
+		Cases:        certsFixtureCases(t, k),
+	}
+
+	if *update {
+		if err := os.MkdirAll("../../testdata/fleet", 0o755); err != nil {
+			t.Fatal(err)
+		}
+		b, err := json.MarshalIndent(derived, "", "  ")
+		if err != nil {
+			t.Fatalf("marshalling the fixture: %v", err)
+		}
+		b = append(b, '\n')
+		if err := os.WriteFile(certsFixturePath, b, 0o644); err != nil {
+			t.Fatalf("writing %s: %v", certsFixturePath, err)
+		}
+	}
+
+	raw, err := os.ReadFile(certsFixturePath)
+	if err != nil {
+		t.Fatalf("reading %s (regenerate with -update): %v", certsFixturePath, err)
+	}
+	var committed certsFixtureFile
+	if err := json.Unmarshal(raw, &committed); err != nil {
+		t.Fatalf("decoding %s: %v", certsFixturePath, err)
+	}
+
+	if committed.Seed != derived.Seed || committed.PublicKeyHex != derived.PublicKeyHex {
+		t.Errorf("fixture keys drifted: committed (%s, %s), derived (%s, %s); regenerate with -update if intended",
+			committed.Seed, committed.PublicKeyHex, derived.Seed, derived.PublicKeyHex)
+	}
+	if len(committed.Cases) != len(derived.Cases) {
+		t.Fatalf("%s carries %d cases, this package derives %d; regenerate with -update", certsFixturePath, len(committed.Cases), len(derived.Cases))
+	}
+	for i, want := range committed.Cases {
+		if got := derived.Cases[i]; got != want {
+			t.Errorf("case %q: this package derives %+v, the committed fixture says %+v; regenerate with -update if the change is intended", want.Name, got, want)
+		}
+		// And every committed blob must verify under the committed public
+		// key — the assertion a consumer in another language starts from.
+		cert, err := Verify(unhex(t, committed.PublicKeyHex), unhex(t, want.SignedHex))
+		if err != nil {
+			t.Errorf("case %q: the committed signed blob does not verify: %v", want.Name, err)
+			continue
+		}
+		if cert.Kind() != want.Cert.Kind {
+			t.Errorf("case %q: the committed blob decodes as a %s cert, the doc says %s", want.Name, cert.Kind(), want.Cert.Kind)
+		}
+	}
+}
diff --git a/internal/fleet/fleet.go b/internal/fleet/fleet.go
new file mode 100644
index 0000000..d28ba64
--- /dev/null
+++ b/internal/fleet/fleet.go
@@ -0,0 +1,456 @@
+// Package fleet is the fleet key and the certificates it signs
+// (spec/fleet-trust.md): one Ed25519 keypair per relay, held by every machine
+// and never by the Worker, whose signatures are what let a device paired on
+// one machine be trusted by every other.
+//
+// Three certificate kinds exist and no more: a machine cert (a machine
+// naming itself and its Noise static key), a device cert (a pairing ceremony
+// naming the device key it admitted), and a revocation (the operator naming
+// a device key that is dead). All three are detached Ed25519 signatures over
+// a canonical encoding of the named fields; the signed blob — canonical
+// bytes then the 64-byte signature — is the one wire form, carried in the
+// IK handshake's first message today and by the relay's fleet directory in
+// the stage that follows. testdata/fleet/certs.json pins the bytes for every
+// implementation.
+package fleet
+
+import (
+	"crypto/ed25519"
+	"encoding/base64"
+	"encoding/binary"
+	"errors"
+	"fmt"
+	"io"
+	"unicode/utf8"
+)
+
+// Canonical encoding.
+//
+// The spec allows canonical CBOR or a length-prefixed encoding, pinned by
+// test vectors either way. This package is length-prefixed, deliberately:
+// canonical CBOR buys nothing for three record shapes with fixed field sets,
+// and costs either a dependency (Go's standard library has no CBOR) or a
+// hand-rolled subset whose canonicity rules — definite lengths, sorted map
+// keys, shortest-form integers — are exactly the ambiguity a canonical
+// encoding exists to rule out. A fixed field order with explicit lengths has
+// no map to order and no integer forms to choose between: two
+// implementations either produce the same bytes or fail the fixture.
+//
+// The layout, byte for byte:
+//
+//	"flue-fleet-cert/"          16 ASCII bytes — domain separation, the same
+//	                            style as the machine-id MAC's prefix, so a
+//	                            fleet signature can never be confused with
+//	                            anything else the fleet key might one day sign
+//	u8  v                       1
+//	u8  kind                    1 machine, 2 device, 3 revoke
+//	then the spec's fields for that kind, in the spec's order:
+//	  machine:  str(id)  str(name)  key32(noise)   u64(iat)
+//	  device:   key32(device)  str(name)  str(pairedOn)  u64(iat)
+//	  revoke:   key32(device)  u64(iat)
+//
+//	str    = u16 big-endian byte length, then that many bytes of UTF-8
+//	key32  = exactly 32 raw bytes, no length prefix
+//	u64    = 8 bytes big-endian (iat is unix seconds and never negative)
+//
+// The signature is Ed25519 over exactly the canonical bytes, and the signed
+// blob is canonical || signature. The canonical part is self-delimiting —
+// fixed layout per kind, explicit string lengths — so the blob parses
+// unambiguously: whatever remains after the fields must be exactly the 64
+// signature bytes, and a blob with anything more or less is refused.
+const (
+	// certPrefix is the domain separator every canonical encoding opens with.
+	certPrefix = "flue-fleet-cert/"
+
+	// certVersion is the one version this package writes and accepts.
+	certVersion = 1
+
+	// kind bytes, in the order the spec lists the kinds.
+	kindMachine = 1
+	kindDevice  = 2
+	kindRevoke  = 3
+
+	// maxStringBytes bounds every string field, on encode and on decode. The
+	// fields are bounded upstream anyway — machine ids are at most 63
+	// characters, display names at most 64 runes — but a decoder that reads a
+	// length from an unauthenticated blob must impose its own ceiling rather
+	// than inherit one.
+	maxStringBytes = 512
+
+	// keyBytes is an X25519 public key, the only kind of key a cert names.
+	keyBytes = 32
+
+	// SeedEncodedLen is how long an encoded fleet seed is: 32 bytes of
+	// Ed25519 seed in unpadded base64url, as the join line carries it.
+	SeedEncodedLen = 43
+)
+
+// Kind names, as the spec writes them and as fixtures carry them.
+const (
+	KindMachine = "machine"
+	KindDevice  = "device"
+	KindRevoke  = "revoke"
+)
+
+var (
+	// ErrBadCert is any blob that does not parse as a signed certificate:
+	// wrong prefix, wrong version, truncated fields, trailing bytes.
+	ErrBadCert = errors.New("fleet: not a certificate")
+
+	// ErrBadSignature is a well-formed blob whose signature does not verify
+	// under the given fleet public key.
+	ErrBadSignature = errors.New("fleet: the signature does not verify")
+
+	// ErrNoKey is a signing or seed operation asked of a zero Key.
+	ErrNoKey = errors.New("fleet: no fleet key")
+)
+
+// Key is the fleet key: the Ed25519 keypair `flue relay setup` mints, whose
+// seed rides the join line and lands in relay.json on every machine. The
+// zero value is "no fleet key" — Valid reports it, Sign refuses it — so a
+// daemon on a relay from before the key existed carries exactly that.
+type Key struct {
+	priv ed25519.PrivateKey
+}
+
+// Mint makes a fresh fleet key from r, which is crypto/rand.Reader
+// everywhere but tests.
+func Mint(r io.Reader) (Key, error) {
+	seed := make([]byte, ed25519.SeedSize)
+	if _, err := io.ReadFull(r, seed); err != nil {
+		return Key{}, fmt.Errorf("fleet: reading randomness for a fleet key: %w", err)
+	}
+	return Key{priv: ed25519.NewKeyFromSeed(seed)}, nil
+}
+
+// Parse reads a seed as the join line spells it: 32 bytes in unpadded
+// base64url. It is strict — padded, standard-alphabet or wrong-length input
+// is refused rather than guessed at, because the value arrives pasted across
+// machines and a mangled seed that half-parsed would join a machine to a
+// fleet whose signatures it can never verify.
+func Parse(seed string) (Key, error) {
+	raw, err := base64.RawURLEncoding.DecodeString(seed)
+	if err != nil {
+		return Key{}, fmt.Errorf("fleet: the fleet key is not unpadded base64url: %w", err)
+	}
+	if len(raw) != ed25519.SeedSize {
+		return Key{}, fmt.Errorf("fleet: the fleet key must be %d bytes, got %d", ed25519.SeedSize, len(raw))
+	}
+	return Key{priv: ed25519.NewKeyFromSeed(raw)}, nil
+}
+
+// Valid reports whether this is a real key rather than the zero value.
+func (k Key) Valid() bool { return len(k.priv) == ed25519.PrivateKeySize }
+
+// Seed is the key as the join line and relay.json carry it: the 32-byte
+// Ed25519 seed, unpadded base64url. Empty for the zero Key.
+func (k Key) Seed() string {
+	if !k.Valid() {
+		return ""
+	}
+	return base64.RawURLEncoding.EncodeToString(k.priv.Seed())
+}
+
+// Public is the fleet public key — what every machine and every paired
+// device verifies certs under. Nil for the zero Key.
+func (k Key) Public() ed25519.PublicKey {
+	if !k.Valid() {
+		return nil
+	}
+	return k.priv.Public().(ed25519.PublicKey)
+}
+
+// Sign encodes c canonically and returns the signed blob: the canonical
+// bytes followed by the 64-byte Ed25519 signature over them.
+func (k Key) Sign(c Cert) ([]byte, error) {
+	if !k.Valid() {
+		return nil, ErrNoKey
+	}
+	canonical, err := Encode(c)
+	if err != nil {
+		return nil, err
+	}
+	return append(canonical, ed25519.Sign(k.priv, canonical)...), nil
+}
+
+// Cert is one of the three certificate kinds. It is a sealed interface —
+// the encoding has exactly three layouts, and a fourth implementer would be
+// bytes no verifier recognises.
+type Cert interface {
+	// Kind is the spec's name for this certificate's kind.
+	Kind() string
+
+	kindByte() byte
+	encodeBody(b []byte) ([]byte, error)
+}
+
+// MachineCert is a machine naming itself: minted by the machine, for
+// itself, at join or setup time. Browsers verify it to learn which Noise
+// static key to pin for the machine; nothing daemon-side consumes it yet
+// (the fleet directory that distributes it is the stage after this one).
+type MachineCert struct {
+	ID    string // the machine id, as minted by config.MintMachineID
+	Name  string // the machine's display name
+	Noise []byte // the daemon's static X25519 public key, 32 bytes
+	IAT   int64  // unix seconds, for display; certs deliberately never expire
+}
+
+func (MachineCert) Kind() string   { return KindMachine }
+func (MachineCert) kindByte() byte { return kindMachine }
+
+func (c MachineCert) encodeBody(b []byte) ([]byte, error) {
+	b, err := appendString(b, "id", c.ID)
+	if err != nil {
+		return nil, err
+	}
+	if b, err = appendString(b, "name", c.Name); err != nil {
+		return nil, err
+	}
+	if b, err = appendKey(b, "noise", c.Noise); err != nil {
+		return nil, err
+	}
+	return appendIAT(b, c.IAT)
+}
+
+// DeviceCert is a pairing ceremony's outcome: minted by whichever machine
+// ran the ceremony, at the moment it completed, naming the device key it
+// admitted. A daemon that has never seen the key admits it on this cert
+// alone — which is the whole point of the fleet key.
+type DeviceCert struct {
+	Device   []byte // the device's static X25519 public key, 32 bytes
+	Name     string // the device's display name, as the ceremony recorded it
+	PairedOn string // the machine id the ceremony ran on
+	IAT      int64
+}
+
+func (DeviceCert) Kind() string   { return KindDevice }
+func (DeviceCert) kindByte() byte { return kindDevice }
+
+func (c DeviceCert) encodeBody(b []byte) ([]byte, error) {
+	b, err := appendKey(b, "device", c.Device)
+	if err != nil {
+		return nil, err
+	}
+	if b, err = appendString(b, "name", c.Name); err != nil {
+		return nil, err
+	}
+	if b, err = appendString(b, "pairedOn", c.PairedOn); err != nil {
+		return nil, err
+	}
+	return appendIAT(b, c.IAT)
+}
+
+// Revocation is the operator killing a device key, minted by whichever
+// machine the revoke ran on. It permanently outranks any device cert for
+// the same key, whatever either one's timestamp says: iat is display, not
+// precedence, and un-revoking is pairing again under a fresh key. Verifiers
+// must implement it that way — check the revocation set before honouring a
+// device cert, and never compare the two by time.
+type Revocation struct {
+	Device []byte // the revoked device key, 32 bytes
+	IAT    int64
+}
+
+func (Revocation) Kind() string   { return KindRevoke }
+func (Revocation) kindByte() byte { return kindRevoke }
+
+func (c Revocation) encodeBody(b []byte) ([]byte, error) {
+	b, err := appendKey(b, "device", c.Device)
+	if err != nil {
+		return nil, err
+	}
+	return appendIAT(b, c.IAT)
+}
+
+// Encode is the canonical encoding of c — the exact bytes a signature
+// covers. Exported for the fixture generator; everything else wants Sign
+// and Verify, which carry the signature with the bytes.
+func Encode(c Cert) ([]byte, error) {
+	b := make([]byte, 0, 128)
+	b = append(b, certPrefix...)
+	b = append(b, certVersion, c.kindByte())
+	return c.encodeBody(b)
+}
+
+// Verify parses a signed blob, checks its signature under the fleet public
+// key, and returns the typed certificate. Every fault is an error: a blob
+// that is not a cert, trailing bytes, a signature that does not verify.
+// Callers must treat the returned cert as meaningful only for the checks
+// they then perform themselves — above all that a revocation for the same
+// key outranks a device cert regardless of either iat.
+func Verify(pub ed25519.PublicKey, blob []byte) (Cert, error) {
+	if len(pub) != ed25519.PublicKeySize {
+		return nil, fmt.Errorf("%w: the fleet public key must be %d bytes, got %d", ErrBadSignature, ed25519.PublicKeySize, len(pub))
+	}
+	cert, canonicalLen, err := decode(blob)
+	if err != nil {
+		return nil, err
+	}
+	if len(blob)-canonicalLen != ed25519.SignatureSize {
+		return nil, fmt.Errorf("%w: %d bytes after the fields, want a %d-byte signature",
+			ErrBadCert, len(blob)-canonicalLen, ed25519.SignatureSize)
+	}
+	if !ed25519.Verify(pub, blob[:canonicalLen], blob[canonicalLen:]) {
+		return nil, ErrBadSignature
+	}
+	return cert, nil
+}
+
+// VerifyDevice is Verify for the one place that only a device cert will do:
+// the daemon's handshake payload. A machine cert or a revocation in that
+// position is well-signed and still refused.
+func VerifyDevice(pub ed25519.PublicKey, blob []byte) (DeviceCert, error) {
+	c, err := Verify(pub, blob)
+	if err != nil {
+		return DeviceCert{}, err
+	}
+	dc, ok := c.(DeviceCert)
+	if !ok {
+		return DeviceCert{}, fmt.Errorf("%w: a %s certificate where a device certificate belongs", ErrBadCert, c.Kind())
+	}
+	return dc, nil
+}
+
+// --- encoding primitives ---
+
+func appendString(b []byte, field, s string) ([]byte, error) {
+	if len(s) > maxStringBytes {
+		return nil, fmt.Errorf("fleet: %s is %d bytes, the ceiling is %d", field, len(s), maxStringBytes)
+	}
+	if !utf8.ValidString(s) {
+		// The encoding says UTF-8 and means it: a Go string can carry any
+		// bytes, and two implementations that disagreed about what a string
+		// field may hold would disagree about which blobs verify.
+		return nil, fmt.Errorf("fleet: %s is not valid UTF-8", field)
+	}
+	b = binary.BigEndian.AppendUint16(b, uint16(len(s)))
+	return append(b, s...), nil
+}
+
+func appendKey(b []byte, field string, key []byte) ([]byte, error) {
+	if len(key) != keyBytes {
+		return nil, fmt.Errorf("fleet: %s must be %d bytes, got %d", field, keyBytes, len(key))
+	}
+	return append(b, key...), nil
+}
+
+func appendIAT(b []byte, iat int64) ([]byte, error) {
+	if iat < 0 {
+		return nil, fmt.Errorf("fleet: iat %d is negative", iat)
+	}
+	return binary.BigEndian.AppendUint64(b, uint64(iat)), nil
+}
+
+// decode parses the canonical part of a signed blob, returning the typed
+// cert and how many bytes of blob the canonical encoding covered. It never
+// looks at the signature; Verify owns that.
+func decode(blob []byte) (Cert, int, error) {
+	r := &reader{b: blob}
+	prefix, err := r.take(len(certPrefix))
+	if err != nil || string(prefix) != certPrefix {
+		return nil, 0, fmt.Errorf("%w: it does not open with %q", ErrBadCert, certPrefix)
+	}
+	header, err := r.take(2)
+	if err != nil {
+		return nil, 0, fmt.Errorf("%w: truncated before the version", ErrBadCert)
+	}
+	if header[0] != certVersion {
+		return nil, 0, fmt.Errorf("%w: version %d, this implementation speaks %d", ErrBadCert, header[0], certVersion)
+	}
+
+	var cert Cert
+	switch header[1] {
+	case kindMachine:
+		var c MachineCert
+		if c.ID, err = r.str(); err == nil {
+			if c.Name, err = r.str(); err == nil {
+				if c.Noise, err = r.key(); err == nil {
+					c.IAT, err = r.iat()
+				}
+			}
+		}
+		cert = c
+	case kindDevice:
+		var c DeviceCert
+		if c.Device, err = r.key(); err == nil {
+			if c.Name, err = r.str(); err == nil {
+				if c.PairedOn, err = r.str(); err == nil {
+					c.IAT, err = r.iat()
+				}
+			}
+		}
+		cert = c
+	case kindRevoke:
+		var c Revocation
+		if c.Device, err = r.key(); err == nil {
+			c.IAT, err = r.iat()
+		}
+		cert = c
+	default:
+		return nil, 0, fmt.Errorf("%w: kind byte %d", ErrBadCert, header[1])
+	}
+	if err != nil {
+		return nil, 0, err
+	}
+	return cert, r.off, nil
+}
+
+// reader walks a blob field by field. Its errors all wrap ErrBadCert.
+type reader struct {
+	b   []byte
+	off int
+}
+
+func (r *reader) take(n int) ([]byte, error) {
+	if len(r.b)-r.off < n {
+		return nil, fmt.Errorf("%w: truncated at byte %d", ErrBadCert, r.off)
+	}
+	out := r.b[r.off : r.off+n]
+	r.off += n
+	return out, nil
+}
+
+func (r *reader) str() (string, error) {
+	lb, err := r.take(2)
+	if err != nil {
+		return "", err
+	}
+	n := int(binary.BigEndian.Uint16(lb))
+	if n > maxStringBytes {
+		return "", fmt.Errorf("%w: a %d-byte string field, the ceiling is %d", ErrBadCert, n, maxStringBytes)
+	}
+	raw, err := r.take(n)
+	if err != nil {
+		return "", err
+	}
+	if !utf8.Valid(raw) {
+		return "", fmt.Errorf("%w: a string field that is not UTF-8", ErrBadCert)
+	}
+	return string(raw), nil
+}
+
+func (r *reader) key() ([]byte, error) {
+	raw, err := r.take(keyBytes)
+	if err != nil {
+		return nil, err
+	}
+	// Cloned: the caller's cert outlives the blob it was parsed from.
+	out := make([]byte, keyBytes)
+	copy(out, raw)
+	return out, nil
+}
+
+func (r *reader) iat() (int64, error) {
+	raw, err := r.take(8)
+	if err != nil {
+		return 0, err
+	}
+	v := binary.BigEndian.Uint64(raw)
+	if v > 1<<62 {
+		// The encoder refuses negative iats, so a value this size is not a
+		// time; refusing it keeps every decoded iat safe to hand to
+		// time.Unix.
+		return 0, fmt.Errorf("%w: iat %d is not a unix time", ErrBadCert, v)
+	}
+	return int64(v), nil
+}
diff --git a/internal/fleet/fleet_test.go b/internal/fleet/fleet_test.go
new file mode 100644
index 0000000..c097411
--- /dev/null
+++ b/internal/fleet/fleet_test.go
@@ -0,0 +1,207 @@
+package fleet
+
+import (
+	"bytes"
+	"crypto/ed25519"
+	"crypto/sha256"
+	"errors"
+	"strings"
+	"testing"
+)
+
+// testKey is a deterministic fleet key so failures print stable bytes.
+func testKey(t *testing.T) Key {
+	t.Helper()
+	seed := sha256.Sum256([]byte("fleet-test-key"))
+	k, err := Mint(bytes.NewReader(seed[:]))
+	if err != nil {
+		t.Fatalf("Mint: %v", err)
+	}
+	return k
+}
+
+func key32(fill byte) []byte { return bytes.Repeat([]byte{fill}, 32) }
+
+func testCerts() []Cert {
+	return []Cert{
+		MachineCert{ID: "karns-mbp-a1b2-8ac6565b", Name: "Karn's MacBook Pro", Noise: key32(0x11), IAT: 1754700000},
+		DeviceCert{Device: key32(0x22), Name: "relayed phone", PairedOn: "karns-mbp-a1b2-8ac6565b", IAT: 1754700001},
+		Revocation{Device: key32(0x22), IAT: 1754700002},
+	}
+}
+
+// TestSignVerifyRoundTrip: every kind signs, verifies under the right key,
+// and comes back field for field.
+func TestSignVerifyRoundTrip(t *testing.T) {
+	k := testKey(t)
+	for _, c := range testCerts() {
+		blob, err := k.Sign(c)
+		if err != nil {
+			t.Fatalf("Sign(%s): %v", c.Kind(), err)
+		}
+		got, err := Verify(k.Public(), blob)
+		if err != nil {
+			t.Fatalf("Verify(%s): %v", c.Kind(), err)
+		}
+		switch want := c.(type) {
+		case MachineCert:
+			g, ok := got.(MachineCert)
+			if !ok || g.ID != want.ID || g.Name != want.Name || !bytes.Equal(g.Noise, want.Noise) || g.IAT != want.IAT {
+				t.Errorf("machine cert round-tripped to %#v, want %#v", got, want)
+			}
+		case DeviceCert:
+			g, ok := got.(DeviceCert)
+			if !ok || !bytes.Equal(g.Device, want.Device) || g.Name != want.Name || g.PairedOn != want.PairedOn || g.IAT != want.IAT {
+				t.Errorf("device cert round-tripped to %#v, want %#v", got, want)
+			}
+		case Revocation:
+			g, ok := got.(Revocation)
+			if !ok || !bytes.Equal(g.Device, want.Device) || g.IAT != want.IAT {
+				t.Errorf("revocation round-tripped to %#v, want %#v", got, want)
+			}
+		}
+	}
+}
+
+// TestVerifyRefusesTheWrongKey: a cert signed by one fleet must not verify
+// under another's public key.
+func TestVerifyRefusesTheWrongKey(t *testing.T) {
+	k := testKey(t)
+	otherSeed := sha256.Sum256([]byte("some-other-fleet"))
+	other, err := Mint(bytes.NewReader(otherSeed[:]))
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, c := range testCerts() {
+		blob, err := k.Sign(c)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := Verify(other.Public(), blob); !errors.Is(err, ErrBadSignature) {
+			t.Errorf("Verify(%s) under a foreign key = %v, want ErrBadSignature", c.Kind(), err)
+		}
+	}
+}
+
+// TestVerifyRefusesTampering: every flipped bit — in the fields or in the
+// signature — is a refusal, and so is anything appended or truncated.
+func TestVerifyRefusesTampering(t *testing.T) {
+	k := testKey(t)
+	blob, err := k.Sign(testCerts()[1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	for i := range blob {
+		bad := bytes.Clone(blob)
+		bad[i] ^= 0x01
+		if _, err := Verify(k.Public(), bad); err == nil {
+			t.Fatalf("a blob with byte %d flipped verified", i)
+		}
+	}
+	if _, err := Verify(k.Public(), append(bytes.Clone(blob), 0x00)); !errors.Is(err, ErrBadCert) {
+		t.Errorf("a blob with a trailing byte = %v, want ErrBadCert", err)
+	}
+	if _, err := Verify(k.Public(), blob[:len(blob)-1]); !errors.Is(err, ErrBadCert) {
+		t.Errorf("a truncated blob = %v, want ErrBadCert", err)
+	}
+	if _, err := Verify(k.Public(), nil); !errors.Is(err, ErrBadCert) {
+		t.Errorf("an empty blob = %v, want ErrBadCert", err)
+	}
+}
+
+// TestVerifyDeviceRefusesOtherKinds: a well-signed machine cert or
+// revocation in the handshake-payload position is still refused — kind
+// confusion is exactly what the kind byte under the signature prevents.
+func TestVerifyDeviceRefusesOtherKinds(t *testing.T) {
+	k := testKey(t)
+	for _, c := range []Cert{testCerts()[0], testCerts()[2]} {
+		blob, err := k.Sign(c)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if _, err := VerifyDevice(k.Public(), blob); !errors.Is(err, ErrBadCert) {
+			t.Errorf("VerifyDevice(%s) = %v, want ErrBadCert", c.Kind(), err)
+		}
+	}
+	blob, err := k.Sign(testCerts()[1])
+	if err != nil {
+		t.Fatal(err)
+	}
+	dc, err := VerifyDevice(k.Public(), blob)
+	if err != nil || !bytes.Equal(dc.Device, key32(0x22)) {
+		t.Errorf("VerifyDevice on a device cert = %#v, %v", dc, err)
+	}
+}
+
+// TestEncodeRefusesBadFields: the encoder is the last line before a
+// signature makes bad bytes permanent.
+func TestEncodeRefusesBadFields(t *testing.T) {
+	cases := []struct {
+		name string
+		cert Cert
+	}{
+		{"short device key", DeviceCert{Device: key32(0x22)[:31], Name: "p", PairedOn: "m", IAT: 1}},
+		{"long device key", DeviceCert{Device: bytes.Repeat([]byte{0x22}, 33), Name: "p", PairedOn: "m", IAT: 1}},
+		{"nil noise key", MachineCert{ID: "m", Name: "m", Noise: nil, IAT: 1}},
+		{"negative iat", Revocation{Device: key32(0x01), IAT: -1}},
+		{"oversized name", DeviceCert{Device: key32(0x22), Name: strings.Repeat("a", maxStringBytes+1), PairedOn: "m", IAT: 1}},
+		{"non-UTF-8 name", DeviceCert{Device: key32(0x22), Name: string([]byte{0xff, 0xfe}), PairedOn: "m", IAT: 1}},
+	}
+	for _, tc := range cases {
+		if _, err := Encode(tc.cert); err == nil {
+			t.Errorf("%s: Encode accepted it", tc.name)
+		}
+	}
+}
+
+// TestSeedRoundTrip: the join line's spelling of the key comes back as the
+// same key, and the strict parses refuse what they should.
+func TestSeedRoundTrip(t *testing.T) {
+	k := testKey(t)
+	seed := k.Seed()
+	if len(seed) != SeedEncodedLen {
+		t.Fatalf("Seed() is %d characters, want %d", len(seed), SeedEncodedLen)
+	}
+	back, err := Parse(seed)
+	if err != nil {
+		t.Fatalf("Parse(Seed()): %v", err)
+	}
+	if !bytes.Equal(back.Public(), k.Public()) {
+		t.Fatal("the re-parsed key derives a different public key")
+	}
+
+	for _, bad := range []string{"", "not base64url!!", seed + "=", seed[:10], seed + seed} {
+		if _, err := Parse(bad); err == nil {
+			t.Errorf("Parse(%q) accepted it", bad)
+		}
+	}
+}
+
+// TestZeroKey: the zero value means "no fleet key" and behaves like it.
+func TestZeroKey(t *testing.T) {
+	var k Key
+	if k.Valid() {
+		t.Error("the zero Key claims to be valid")
+	}
+	if k.Seed() != "" || k.Public() != nil {
+		t.Error("the zero Key has a seed or a public key")
+	}
+	if _, err := k.Sign(testCerts()[2]); !errors.Is(err, ErrNoKey) {
+		t.Errorf("Sign on the zero Key = %v, want ErrNoKey", err)
+	}
+}
+
+// TestVerifyRefusesABogusPublicKey: a verifier misconfigured with an empty
+// or short key must refuse everything rather than panic or accept.
+func TestVerifyRefusesABogusPublicKey(t *testing.T) {
+	k := testKey(t)
+	blob, err := k.Sign(testCerts()[2])
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, pub := range []ed25519.PublicKey{nil, k.Public()[:31]} {
+		if _, err := Verify(pub, blob); err == nil {
+			t.Errorf("Verify under a %d-byte public key accepted the blob", len(pub))
+		}
+	}
+}
diff --git a/internal/transport/relay/channel.go b/internal/transport/relay/channel.go
index 152f310..bc5f4fa 100644
--- a/internal/transport/relay/channel.go
+++ b/internal/transport/relay/channel.go
@@ -5,10 +5,13 @@ package relay
 //
 // Everything here answers one question — is this browser a device the user
 // paired? The relay cannot answer it and is not asked to: it forwards opaque
-// bytes, and the proof arrives as the initiator's static key coming out of a
-// Noise IK handshake this process runs itself, checked against the device
-// registry on this machine. A key the registry does not hold is closed, not
-// served, however well-formed its handshake was.
+// bytes, and the proof arrives out of a Noise IK handshake this process runs
+// itself. Two proofs are accepted, in order (spec/fleet-trust.md): the
+// initiator's static key is in this machine's own device registry, or the
+// handshake's first message carried a device certificate for exactly that
+// key, signed by the fleet key and not revoked — a device paired on a
+// sibling machine, which this one then records as its own. A key with
+// neither is closed, not served, however well-formed its handshake was.
 
 import (
 	"bytes"
@@ -23,6 +26,7 @@ import (
 
 	"github.com/karnstack/flue/internal/crypto"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaywire"
 )
 
@@ -337,7 +341,7 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 		}
 	}()
 
-	nch, peerStatic, err := t.handshake(s, ch)
+	nch, peerStatic, payload, err := t.handshake(s, ch)
 	if err != nil {
 		if errors.Is(err, errChannelGone) || errors.Is(err, errSocketClosed) {
 			// The browser left, or the socket did, mid-handshake. Ordinary, and
@@ -360,6 +364,14 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 		t.tell(s, relaywire.Close{Channel: ch.id})
 		return
 	}
+	if !paired {
+		// Rule 2 of the acceptance order: a key this machine never paired,
+		// carrying a fleet device cert in its handshake payload. Rule 1 above
+		// deliberately never looked at the payload — a device in the registry
+		// is served cert or no cert, so pairing on this machine keeps working
+		// if the fleet key ever rotates away.
+		dev, paired = t.admitByFleetCert(ch, peerStatic, payload)
+	}
 	if !paired {
 		// Not an error, a state: an unpaired browser cannot attach, and pairing
 		// is what makes it known. The id logged is the digest of the key it
@@ -385,9 +397,83 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 	t.log.Debug("relay channel ended", "channel", ch.id, "device", dev.ID)
 }
 
+// admitByFleetCert decides whether an unregistered key gets in on its
+// handshake payload: a fleet device certificate that verifies under the
+// fleet public key, names exactly the handshake's static key, and is not
+// revoked. A yes also writes the device into this machine's registry under
+// the cert's name — so the Devices screen shows it, LastSeen works, and the
+// daemon keeps serving it even if the fleet key later rotates away.
+//
+// The refusals are all the same silent false — the caller's "unpaired
+// device" close is the one answer a stranger gets, exactly as before — but
+// each is its own log line first, because "a cert that does not verify" and
+// "a revoked device presenting the cert it was paired with" are different
+// events to whoever reads stderr.
+//
+// The cert names the device's key, not its holder: what proves the browser
+// holds the key is the IK handshake itself, whose first message cannot be
+// built without the static's private half. The cert is public by design (a
+// later stage publishes it in the relay's directory), so this check must
+// never treat possession of the blob as the credential — the key equality
+// against the handshake's own static is the line that keeps a stolen blob
+// worthless.
+func (t *Transport) admitByFleetCert(ch *channel, peerStatic, payload []byte) (crypto.Device, bool) {
+	if len(payload) == 0 {
+		// A pre-fleet browser, or one pinned to this machine directly. Not
+		// even a log line of its own: this is the ordinary unpaired refusal.
+		return crypto.Device{}, false
+	}
+	cert, err := fleet.VerifyDevice(t.cfg.FleetPub, payload)
+	if err != nil {
+		t.log.Warn("relay channel presented a handshake payload that is not a verifying fleet device cert",
+			"channel", ch.id, "device", crypto.DeviceID(peerStatic), "err", err)
+		return crypto.Device{}, false
+	}
+	if !bytes.Equal(cert.Device, peerStatic) {
+		// A verifying cert for some other key. The handshake proved the
+		// browser holds peerStatic; the fleet vouched for a different device
+		// entirely, and honouring the pair would let any holder of any
+		// published cert attach as themselves.
+		t.log.Warn("relay channel presented a fleet cert for a different key",
+			"channel", ch.id, "device", crypto.DeviceID(peerStatic), "certDevice", crypto.DeviceID(cert.Device))
+		return crypto.Device{}, false
+	}
+
+	name := cert.Name
+	if name == "" {
+		// The minting machine's ceremony never records an empty label
+		// (daemon.deviceLabel), but the encoding allows one and the Devices
+		// screen must not show a row nobody can safely act on.
+		name = "unnamed device"
+	}
+	dev, err := t.devices.AddFromFleetCert(name, peerStatic, payload, time.Unix(cert.IAT, 0))
+	switch {
+	case errors.Is(err, crypto.ErrDeviceRevoked):
+		// The one rule with its own sentence in the spec: a revocation
+		// permanently outranks a device cert for the same key, whatever
+		// either one's iat says. The check lives inside the registry write —
+		// one critical section with the add — so a concurrent revoke cannot
+		// land between a check here and the write.
+		t.log.Warn("relay channel presented a fleet cert for a revoked key",
+			"channel", ch.id, "device", crypto.DeviceID(peerStatic))
+		return crypto.Device{}, false
+	case err != nil:
+		// The registry could not be read or written — the same refusal
+		// direction FindByKey's error takes, for the same reason.
+		t.log.Error("could not register a fleet-certified device",
+			"channel", ch.id, "device", crypto.DeviceID(peerStatic), "err", err)
+		return crypto.Device{}, false
+	}
+	t.log.Info("relay channel admitted a fleet-certified device",
+		"channel", ch.id, "device", dev.ID, "pairedOn", cert.PairedOn)
+	return dev, true
+}
+
 // handshake runs the Noise IK responder over this channel and returns the
-// initiator's static key with it — the device identity the caller authorises.
-func (t *Transport) handshake(s *socket, ch *channel) (*crypto.Channel, []byte, error) {
+// initiator's static key with it — the device identity the caller authorises
+// — and message A's decrypted payload, where a fleet device cert rides when
+// the initiator has one.
+func (t *Transport) handshake(s *socket, ch *channel) (*crypto.Channel, []byte, []byte, error) {
 	deadline := time.NewTimer(handshakeDeadline)
 	defer deadline.Stop()
 
diff --git a/internal/transport/relay/channel_test.go b/internal/transport/relay/channel_test.go
index e96fcf6..2a6671b 100644
--- a/internal/transport/relay/channel_test.go
+++ b/internal/transport/relay/channel_test.go
@@ -2,6 +2,7 @@ package relay
 
 import (
 	"context"
+	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -17,6 +18,7 @@ import (
 	"github.com/flynn/noise"
 	"github.com/karnstack/flue/internal/crypto"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaywire"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
@@ -34,13 +36,15 @@ const localToken = "0123456789abcdef"
 
 // --- fixtures ---
 
-// identity is a daemon's static key, its paired-device registry, and one
-// device already in it: the state a browser can actually attach against.
+// identity is a daemon's static key, its paired-device registry, one device
+// already in it, and a fleet key: the state a browser can actually attach
+// against.
 type identity struct {
 	key       noise.DHKey
 	devices   *crypto.DeviceStore
 	device    crypto.Device
 	deviceKey noise.DHKey
+	fleet     fleet.Key
 }
 
 func newIdentity(t *testing.T) *identity {
@@ -55,7 +59,7 @@ func newIdentity(t *testing.T) *identity {
 		t.Fatalf("GenerateKeypair: %v", err)
 	}
 	store := crypto.NewDeviceStore(dir)
-	dev, err := store.Add("phone", devKey.Public)
+	dev, err := store.Add("phone", devKey.Public, nil)
 	if err != nil {
 		t.Fatalf("Add: %v", err)
 	}
@@ -65,7 +69,22 @@ func newIdentity(t *testing.T) *identity {
 	if ok, err := store.UpdateLastSeen(dev.ID, time.Now().Add(-time.Hour)); err != nil || !ok {
 		t.Fatalf("backdating the device: %v, %v", ok, err)
 	}
-	return &identity{key: key, devices: store, device: dev, deviceKey: devKey}
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatalf("fleet.Mint: %v", err)
+	}
+	return &identity{key: key, devices: store, device: dev, deviceKey: devKey, fleet: fk}
+}
+
+// deviceCert signs a fleet device cert for key under id's fleet key, the way
+// a sibling machine's pairing ceremony would have.
+func (id *identity) deviceCert(t *testing.T, key []byte, name string) []byte {
+	t.Helper()
+	blob, err := id.fleet.Sign(fleet.DeviceCert{Device: key, Name: name, PairedOn: "sibling-mac-a1b2-0f9a12cd", IAT: time.Now().Unix()})
+	if err != nil {
+		t.Fatalf("signing a device cert: %v", err)
+	}
+	return blob
 }
 
 // unpairedKey is a browser key this daemon has never seen.
@@ -84,7 +103,7 @@ func newChannelTransport(t *testing.T, r *fakeRelay, srv Server, id *identity, l
 	if log == nil {
 		log = slog.New(slog.DiscardHandler)
 	}
-	tr, err := New(Config{URL: r.URL(), Secret: "s", Origin: testOrigin, MachineID: testMachineID}, srv, id.key, id.devices, log)
+	tr, err := New(Config{URL: r.URL(), Secret: "s", Origin: testOrigin, MachineID: testMachineID, FleetPub: id.fleet.Public()}, srv, id.key, id.devices, log)
 	if err != nil {
 		t.Fatalf("New: %v", err)
 	}
@@ -98,7 +117,7 @@ func newChannelTransport(t *testing.T, r *fakeRelay, srv Server, id *identity, l
 func newDaemonServer(t *testing.T, id *identity) (*daemon.Server, *httptest.Server) {
 	t.Helper()
 	srv := daemon.New(session.NewRegistry(time.Now), nil, nil, "test",
-		daemon.Identity{Key: id.key, Devices: id.devices})
+		daemon.Identity{Key: id.key, Devices: id.devices, Fleet: id.fleet})
 	t.Cleanup(srv.Shutdown)
 	ts := httptest.NewServer(srv.Handler())
 	t.Cleanup(ts.Close)
@@ -225,18 +244,25 @@ type browser struct {
 }
 
 // attach announces a channel the way the Worker does and completes the
-// handshake the browser drives.
+// handshake the browser drives, presenting no cert — the pre-fleet browser,
+// and the shape every existing test exercises.
 func attach(t *testing.T, c *relayConn, chanID uint32, key noise.DHKey, daemonPub []byte) *browser {
+	return attachWithPayload(t, c, chanID, key, daemonPub, nil)
+}
+
+// attachWithPayload is attach with message A's encrypted payload — the
+// fleet device cert, or whatever bytes a test wants judged in its place.
+func attachWithPayload(t *testing.T, c *relayConn, chanID uint32, key noise.DHKey, daemonPub, payload []byte) *browser {
 	t.Helper()
 	c.sendControl(t, relaywire.Open{Channel: chanID, Origin: testOrigin})
-	return handshake(t, c, chanID, key, daemonPub)
+	return handshake(t, c, chanID, key, daemonPub, payload)
 }
 
 // handshake drives the IK handshake on an already-announced channel.
-func handshake(t *testing.T, c *relayConn, chanID uint32, key noise.DHKey, daemonPub []byte) *browser {
+func handshake(t *testing.T, c *relayConn, chanID uint32, key noise.DHKey, daemonPub, payload []byte) *browser {
 	t.Helper()
 	b := &browser{t: t, c: c, id: chanID}
-	ch, err := crypto.InitiatorHandshake(key, daemonPub, nil, b.recvRaw, b.sendRaw)
+	ch, err := crypto.InitiatorHandshake(key, daemonPub, payload, nil, b.recvRaw, b.sendRaw)
 	if err != nil {
 		t.Fatalf("the browser could not complete the handshake on channel %d: %v", chanID, err)
 	}
@@ -447,6 +473,198 @@ func TestRelayChannelRefusesAnUnknownDeviceKey(t *testing.T) {
 	}
 }
 
+// TestRelayChannelAdmitsAFleetCertifiedDevice is the fleet key doing its
+// job (spec/fleet-trust.md): a device this machine never paired presents,
+// in its handshake payload, the device cert a sibling machine's ceremony
+// minted — and is served, and written into this machine's own registry
+// under the cert's name, cert attached, so the Devices screen shows it,
+// LastSeen works, and a later stage can publish the blob onward.
+func TestRelayChannelAdmitsAFleetCertifiedDevice(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv, _ := newDaemonServer(t, id)
+	tr := newChannelTransport(t, r, srv, id, nil)
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	stranger := unpairedKey(t)
+	cert := id.deviceCert(t, stranger.Public, "attic phone")
+	b := attachWithPayload(t, c, 1, stranger, id.key.Public, cert)
+
+	if w, ok := b.recvControl().(wire.Welcome); !ok {
+		t.Fatalf("the fleet-certified device's first frame was %#v, want a welcome", w)
+	}
+	b.sendControl(wire.List{})
+	if s, ok := b.recvControl().(wire.Sessions); !ok {
+		t.Fatalf("list was answered with %#v, want sessions", s)
+	}
+
+	list, err := id.devices.List()
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 2 {
+		t.Fatalf("registry holds %d devices, want the paired one and the admitted one", len(list))
+	}
+	got, ok, err := id.devices.FindByKey(stranger.Public)
+	if err != nil || !ok {
+		t.Fatalf("the admitted device is not in the registry: %v, %v", ok, err)
+	}
+	if got.Label != "attic phone" {
+		t.Errorf("registry label = %q, want the cert's name", got.Label)
+	}
+	if !bytes.Equal(got.Cert, cert) {
+		t.Error("the registry entry does not carry the cert it was admitted on")
+	}
+}
+
+// TestRelayChannelRefusesAFleetCertForADifferentKey: the cert is a public
+// artifact, so holding one proves nothing — the handshake's own static key
+// is what the initiator proved possession of, and the cert must name
+// exactly it.
+func TestRelayChannelRefusesAFleetCertForADifferentKey(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv := &readingServer{}
+	sink := &syncBuffer{}
+	tr := newChannelTransport(t, r, srv, id, slog.New(slog.NewTextHandler(sink, nil)))
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	victim := unpairedKey(t)
+	thief := unpairedKey(t)
+	// A perfectly valid cert — for the victim's key, presented by a
+	// handshake run under the thief's.
+	stolen := id.deviceCert(t, victim.Public, "victim phone")
+	attachWithPayload(t, c, 1, thief, id.key.Public, stolen)
+
+	expectClose(t, c, 1)
+	waitForLog(t, sink, "different key")
+	if n := len(srv.served()); n != 0 {
+		t.Fatalf("the daemon served %d connections on a stolen cert, want 0", n)
+	}
+	if _, ok, _ := id.devices.FindByKey(thief.Public); ok {
+		t.Fatal("the thief's key reached the registry")
+	}
+}
+
+// TestRelayChannelRefusesAForeignFleetsCert: a cert signed by some other
+// fleet's key — a hostile relay minting its own — verifies under nothing
+// this daemon trusts.
+func TestRelayChannelRefusesAForeignFleetsCert(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv := &readingServer{}
+	sink := &syncBuffer{}
+	tr := newChannelTransport(t, r, srv, id, slog.New(slog.NewTextHandler(sink, nil)))
+	runTransport(t, tr)
+
+	otherFleet, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	stranger := unpairedKey(t)
+	foreign, err := otherFleet.Sign(fleet.DeviceCert{Device: stranger.Public, Name: "impostor", PairedOn: "x-a1b2-0f9a12cd", IAT: time.Now().Unix()})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	c := r.accept(t)
+	attachWithPayload(t, c, 1, stranger, id.key.Public, foreign)
+
+	expectClose(t, c, 1)
+	waitForLog(t, sink, "not a verifying fleet device cert")
+	if n := len(srv.served()); n != 0 {
+		t.Fatalf("the daemon served %d connections for a foreign fleet's cert, want 0", n)
+	}
+}
+
+// TestRelayChannelRefusesGarbageInThePayload: bytes that are not a cert at
+// all get the same close an unpaired key gets — the payload can never make
+// an outcome worse than sending nothing.
+func TestRelayChannelRefusesGarbageInThePayload(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv := &readingServer{}
+	tr := newChannelTransport(t, r, srv, id, nil)
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	stranger := unpairedKey(t)
+	attachWithPayload(t, c, 1, stranger, id.key.Public, []byte("not a certificate"))
+
+	expectClose(t, c, 1)
+	if n := len(srv.served()); n != 0 {
+		t.Fatalf("the daemon served %d connections for a garbage payload, want 0", n)
+	}
+	if !c.stillOpen() {
+		t.Fatal("refusing one channel took the whole socket down")
+	}
+}
+
+// TestRelayRevocationOutranksTheFleetCert is the spec's precedence rule end
+// to end: revoke a device on this machine's Devices flow, and its fleet
+// cert — minted after the revocation, even — no longer admits it. Time is
+// deliberately no part of the rule; un-revoking is pairing afresh under a
+// new key.
+func TestRelayRevocationOutranksTheFleetCert(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv, ts := newDaemonServer(t, id)
+	tr := newChannelTransport(t, r, srv, id, nil)
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	// Admit the device on its cert first, so the revoke below runs against
+	// a real fleet-admitted entry.
+	stranger := unpairedKey(t)
+	cert := id.deviceCert(t, stranger.Public, "attic phone")
+	b := attachWithPayload(t, c, 1, stranger, id.key.Public, cert)
+	if _, ok := b.recvControl().(wire.Welcome); !ok {
+		t.Fatal("the fleet-certified device was not welcomed")
+	}
+
+	// The operator revokes it, from a local client, the way the Devices
+	// screen does.
+	laptop := dialLocal(t, ts)
+	writeLocalControl(t, laptop, wire.Hello{Ver: "test"})
+	writeLocalControl(t, laptop, wire.Revoke{DeviceID: crypto.DeviceID(stranger.Public)})
+	for {
+		if _, ok := b.recvControl().(wire.Revoked); ok {
+			expectClose(t, c, 1)
+			break
+		}
+	}
+
+	// The same cert — and a fresher one — must both be dead now.
+	fresher := id.deviceCert(t, stranger.Public, "attic phone, again")
+	for i, blob := range [][]byte{cert, fresher} {
+		ch := uint32(10 + i)
+		attachWithPayload(t, c, ch, stranger, id.key.Public, blob)
+		expectClose(t, c, ch)
+	}
+	if _, ok, _ := id.devices.FindByKey(stranger.Public); ok {
+		t.Fatal("the revoked device is back in the registry")
+	}
+	// And the revocation is on file, signed, for the directory stage to
+	// publish.
+	revs, err := id.devices.Revocations()
+	if err != nil || len(revs) != 1 {
+		t.Fatalf("Revocations = %d entries, %v; want the one record", len(revs), err)
+	}
+	if !bytes.Equal(revs[0].PublicKey, stranger.Public) {
+		t.Error("the revocation names a different key")
+	}
+	if _, err := fleet.Verify(id.fleet.Public(), revs[0].Cert); err != nil {
+		t.Errorf("the stored revocation does not verify under the fleet key: %v", err)
+	}
+}
+
 // TestRelayChannelRefusesAForeignOrigin: the origin on an open is announced
 // rather than assumed precisely so it can be checked. A relay announcing an
 // origin this daemon did not dial is misconfigured or lying, and either way the
diff --git a/internal/transport/relay/relay.go b/internal/transport/relay/relay.go
index 4f3d507..80bb730 100644
--- a/internal/transport/relay/relay.go
+++ b/internal/transport/relay/relay.go
@@ -19,6 +19,7 @@ package relay
 
 import (
 	"context"
+	"crypto/ed25519"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -146,15 +147,26 @@ const (
 
 // Config is everything the adapter needs to reach a deployed relay.
 //
-// All four fields are required: where to dial, which machine's slot to dial
-// it as, what the dial presents, and the origin the relay serves browsers on.
-// The daemon and the Worker share one long-lived DAEMON_SECRET, set at deploy
-// time by `flue relay setup`.
+// All five fields are required: where to dial, which machine's slot to dial
+// it as, what the dial presents, the origin the relay serves browsers on,
+// and the fleet public key the acceptance rule verifies device certs under.
+// The daemon and the Worker share one long-lived DAEMON_SECRET, set at
+// deploy time by `flue relay setup`; the fleet key was minted beside it and
+// the Worker never sees either half of it.
 type Config struct {
 	URL       string // the bare relay address: wss://flue-relay.<sub>.workers.dev
 	Secret    string // the DAEMON_SECRET set at deploy time
 	Origin    string // https origin the relay serves the UI on
 	MachineID string // the machine's slot on the relay: the <id> of /daemon/<id>
+
+	// FleetPub is the fleet public key (spec/fleet-trust.md), derived from
+	// the seed relay.json carries. Required like the rest, deliberately: a
+	// relay.json without a fleet seed is from a flue that predates the key,
+	// and the honest answer is the re-join the operator is one printed line
+	// away from — not a transport that quietly serves rule 1 of the
+	// acceptance order and silently drops rule 2 (channel.go). Only the
+	// public half ever reaches this package.
+	FleetPub ed25519.PublicKey
 }
 
 // ErrIncompleteConfig is what New answers a Config it cannot dial with: a
@@ -290,6 +302,12 @@ func New(cfg Config, srv Server, identity noise.DHKey, devices *crypto.DeviceSto
 		// staring at a hand-edited relay.json needs to see which value the
 		// grammar refused.
 		return nil, fmt.Errorf("%w: machine id %q is not a valid slug", ErrIncompleteConfig, cfg.MachineID)
+	case len(cfg.FleetPub) != ed25519.PublicKeySize:
+		// The message names the way out because there is exactly one: the
+		// fleet key rides the join line, and a relay.json without one is
+		// from before it existed (spec/fleet-trust.md keeps no
+		// compatibility with those, deliberately).
+		return nil, fmt.Errorf("%w: no fleet key; re-run the join line printed by `flue relay setup` on this machine", ErrIncompleteConfig)
 	}
 	if log == nil {
 		log = slog.New(slog.DiscardHandler)
diff --git a/internal/transport/relay/relay_test.go b/internal/transport/relay/relay_test.go
index d4db5ae..e5b34cd 100644
--- a/internal/transport/relay/relay_test.go
+++ b/internal/transport/relay/relay_test.go
@@ -3,6 +3,7 @@ package relay
 import (
 	"bytes"
 	"context"
+	"crypto/rand"
 	"encoding/json"
 	"errors"
 	"log/slog"
@@ -17,6 +18,7 @@ import (
 	"github.com/coder/websocket"
 	"github.com/flynn/noise"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaywire"
 )
 
@@ -125,11 +127,16 @@ func newTestTransport(t *testing.T, r *fakeRelay, secret string, log *slog.Logge
 	if log == nil {
 		log = slog.New(slog.DiscardHandler)
 	}
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 	tr, err := New(Config{
 		URL:       r.URL(),
 		Secret:    secret,
 		Origin:    "https://relay.example",
 		MachineID: testMachineID,
+		FleetPub:  fleetKey.Public(),
 	}, srv, noise.DHKey{}, nil, log)
 	if err != nil {
 		t.Fatalf("New: %v", err)
@@ -168,7 +175,11 @@ func runTransport(t *testing.T, tr *Transport) func() {
 
 func TestNewRefusesAnIncompleteConfig(t *testing.T) {
 	t.Parallel()
-	full := Config{URL: "wss://relay.example", Secret: "s3cr3t", Origin: "https://relay.example", MachineID: "karns-mbp-a1b2-0f9a12cd"}
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
+	full := Config{URL: "wss://relay.example", Secret: "s3cr3t", Origin: "https://relay.example", MachineID: "karns-mbp-a1b2-0f9a12cd", FleetPub: fleetKey.Public()}
 
 	// Origin is the one worth stating a reason for. It is what every announced
 	// open and every forwarded pair is checked against, so an empty one does
@@ -186,15 +197,21 @@ func TestNewRefusesAnIncompleteConfig(t *testing.T) {
 		name string
 		cfg  Config
 	}{
-		{"no URL", Config{Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID}},
-		{"no secret", Config{URL: full.URL, Origin: full.Origin, MachineID: full.MachineID}},
-		{"no origin", Config{URL: full.URL, Secret: full.Secret, MachineID: full.MachineID}},
-		{"no machine id", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin}},
+		{"no URL", Config{Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID, FleetPub: full.FleetPub}},
+		{"no secret", Config{URL: full.URL, Origin: full.Origin, MachineID: full.MachineID, FleetPub: full.FleetPub}},
+		{"no origin", Config{URL: full.URL, Secret: full.Secret, MachineID: full.MachineID, FleetPub: full.FleetPub}},
+		{"no machine id", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, FleetPub: full.FleetPub}},
+		// The pre-fleet relay.json: everything else present, no fleet key.
+		// Refused by design — spec/fleet-trust.md keeps no compatibility
+		// with files from before the key — and the error names the re-join
+		// as the way out (asserted below).
+		{"no fleet key", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID}},
+		{"a truncated fleet key", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID, FleetPub: full.FleetPub[:31]}},
 		{"nothing at all", Config{}},
-		{"a machine id with a capital", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "My-Mac"}},
-		{"a machine id led by a dash", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "-a1b2-0f9a12cd"}},
-		{"a machine id without a MAC tag — the pre-tag mint", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "karns-mbp-a1b2"}},
-		{"a machine id past 63 characters", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: strings.Repeat("a", 55) + "-0f9a12cd"}},
+		{"a machine id with a capital", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "My-Mac", FleetPub: full.FleetPub}},
+		{"a machine id led by a dash", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "-a1b2-0f9a12cd", FleetPub: full.FleetPub}},
+		{"a machine id without a MAC tag — the pre-tag mint", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "karns-mbp-a1b2", FleetPub: full.FleetPub}},
+		{"a machine id past 63 characters", Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: strings.Repeat("a", 55) + "-0f9a12cd", FleetPub: full.FleetPub}},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
@@ -233,12 +250,21 @@ func TestNewRefusesAnIncompleteConfig(t *testing.T) {
 
 	t.Run("the machine id grammar error names the fault and the value", func(t *testing.T) {
 		t.Parallel()
-		_, err := New(Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "My-Mac"},
+		_, err := New(Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: "My-Mac", FleetPub: full.FleetPub},
 			&stubServer{}, noise.DHKey{}, nil, nil)
 		if err == nil || !strings.Contains(err.Error(), "not a valid slug") || !strings.Contains(err.Error(), "My-Mac") {
 			t.Fatalf("New with machine id \"My-Mac\" = %v, want an error quoting it as not a valid slug", err)
 		}
 	})
+
+	t.Run("the fleet key error names the way out", func(t *testing.T) {
+		t.Parallel()
+		_, err := New(Config{URL: full.URL, Secret: full.Secret, Origin: full.Origin, MachineID: full.MachineID},
+			&stubServer{}, noise.DHKey{}, nil, nil)
+		if err == nil || !strings.Contains(err.Error(), "no fleet key") || !strings.Contains(err.Error(), "join line") {
+			t.Fatalf("New without a fleet key = %v, want an error naming the missing key and the re-join", err)
+		}
+	})
 }
 
 func TestTransportDialsTheRelayWithBearerAuth(t *testing.T) {
@@ -296,12 +322,17 @@ func TestTransportRefusesARedirectRatherThanFollowIt(t *testing.T) {
 	ts := httptest.NewServer(mux)
 	t.Cleanup(ts.Close)
 
+	fleetKey, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatal(err)
+	}
 	srv := &stubServer{}
 	tr, err := New(Config{
 		URL:       "ws" + strings.TrimPrefix(ts.URL, "http"),
 		Secret:    "s3cr3t",
 		Origin:    "https://relay.example",
 		MachineID: testMachineID,
+		FleetPub:  fleetKey.Public(),
 	}, srv, noise.DHKey{}, nil, slog.New(slog.DiscardHandler))
 	if err != nil {
 		t.Fatalf("New: %v", err)
diff --git a/testdata/fleet/certs.json b/testdata/fleet/certs.json
new file mode 100644
index 0000000..188b7a1
--- /dev/null
+++ b/testdata/fleet/certs.json
@@ -0,0 +1,56 @@
+{
+  "seed": "R-mXeHSvx0lLijEv8xtUjiabsPfOxXZsPAqtFxzBgUQ",
+  "publicKeyHex": "d1d8f6e143d3e573c724c0307e80164dd5afdba8024b31842bb2fcc91c24b4a5",
+  "cases": [
+    {
+      "name": "machine",
+      "cert": {
+        "v": 1,
+        "kind": "machine",
+        "id": "karns-macbook-pro-a1b2-8ac6565b",
+        "name": "Karn's MacBook Pro",
+        "noiseHex": "3d49879bbff7c36b094d55dea6e1dc4095ffa8b80ecf578fdeab82905cbe5264",
+        "iat": 1754700000
+      },
+      "canonicalHex": "666c75652d666c6565742d636572742f0101001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200124b61726e2773204d6163426f6f6b2050726f3d49879bbff7c36b094d55dea6e1dc4095ffa8b80ecf578fdeab82905cbe526400000000689698e0",
+      "signedHex": "666c75652d666c6565742d636572742f0101001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200124b61726e2773204d6163426f6f6b2050726f3d49879bbff7c36b094d55dea6e1dc4095ffa8b80ecf578fdeab82905cbe526400000000689698e071454830b705f1ffedf4d1866d0033014eef9a6314c28e70c96079bf36b4578191541963da8db11afdbbdfff67786955108a9f3dd1b1e76d67d85b458f1f3204"
+    },
+    {
+      "name": "device",
+      "cert": {
+        "v": 1,
+        "kind": "device",
+        "name": "relayed phone",
+        "deviceHex": "07c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411",
+        "pairedOn": "karns-macbook-pro-a1b2-8ac6565b",
+        "iat": 1754700001
+      },
+      "canonicalHex": "666c75652d666c6565742d636572742f010207c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411000d72656c617965642070686f6e65001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e1",
+      "signedHex": "666c75652d666c6565742d636572742f010207c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411000d72656c617965642070686f6e65001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e14df03dcd88034926d34caf1b19f349297f0b698a9b1edecb7f7921f64c9c80eab8dbed5a8f51414b8326cb556516adcae9d79d0b5fe7c11f5ceb32b892c1c306"
+    },
+    {
+      "name": "device-unicode-name",
+      "cert": {
+        "v": 1,
+        "kind": "device",
+        "name": "Karn’s téléphone 📱",
+        "deviceHex": "2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a",
+        "pairedOn": "karns-macbook-pro-a1b2-8ac6565b",
+        "iat": 1754700002
+      },
+      "canonicalHex": "666c75652d666c6565742d636572742f01022a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a00194b61726ee28099732074c3a96cc3a970686f6e6520f09f93b1001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e2",
+      "signedHex": "666c75652d666c6565742d636572742f01022a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a2a00194b61726ee28099732074c3a96cc3a970686f6e6520f09f93b1001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e2f37226ced92ca988be709c611b0eb3c9f1e4d729c4f7393aeaa3c47b507b0158acfa909f5eac71e5e9739c68be95120f50e17b0fe953f6f94794f8de86c0ef01"
+    },
+    {
+      "name": "revoke",
+      "cert": {
+        "v": 1,
+        "kind": "revoke",
+        "deviceHex": "07c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411",
+        "iat": 1754700003
+      },
+      "canonicalHex": "666c75652d666c6565742d636572742f010307c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e8941100000000689698e3",
+      "signedHex": "666c75652d666c6565742d636572742f010307c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e8941100000000689698e3dfff2c8c5dbd1b74e1352576c5c81b063d0729dfdcffc2f28fbb57c9edb10f640292471ece6ec7968c032326cb56c37f07b483dfc98ae423072950689c4e2204"
+    }
+  ]
+}
diff --git a/testdata/noise/ik-payload.json b/testdata/noise/ik-payload.json
new file mode 100644
index 0000000..865768b
--- /dev/null
+++ b/testdata/noise/ik-payload.json
@@ -0,0 +1,29 @@
+{
+  "protocol": "Noise_IK_25519_ChaChaPoly_SHA256",
+  "initiatorStaticPriv": "eeb8018a418c7baa11d09080d32dbf5585ed4cd6ac7173f191d56faa549d27aa",
+  "initiatorStaticPub": "07c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411",
+  "responderStaticPriv": "f8cf66818e3ca7684be962dae330e59496ea79172703dcc7c28403be3bb93d38",
+  "responderStaticPub": "3d49879bbff7c36b094d55dea6e1dc4095ffa8b80ecf578fdeab82905cbe5264",
+  "initiatorEphemeralPriv": "5b2b914d878bebf3a3ec6963845493b5cbfb7bf5301913dc2a9b1f1231f75d9e",
+  "responderEphemeralPriv": "26ed0d6b19cb381c8539fec74451409482967797e732b9c1a83d319ece1d3ab1",
+  "msg1": "7aa6099ce801ab46076749db6a77e2f90b3f2c35209c8154a7bff1af5179ae224874140da11f5e15535c9c8089837e81ee177e3ec6e517b300974e967963579d6c57c00bfec57a32d4eec862f94e20d213f4645cb7e2f3aebf9824df283f1dfebb37939272d2f352901c79524569897ce90ea4eab09aa39ec147cfb30ac4a7ad73b7ca58b76e53a18bf373d5237b87d1090920119e5c0aaf21691c53a9d8d62cb02e365156721ddea09fcc295dc831b5fb1d28bc4c6429671368fa38dc20eb60b3958e59ed004a20038ab8347a50e23e4515bf0d01d8e26fd82cf454421052229234fbde80756b1784c963e2d4e6fa1a57f19135d87ea41a634107f016eaba862b32c6d01a24ddde4967",
+  "msg2": "4801aff0ca8541e9e8164469cbb2df576575cde958f048d5e4ff431e4c2de116d6179eb365e654d8c0da4de0285cc258",
+  "transport": [
+    {
+      "dir": "i2r",
+      "plaintext": "68656c6c6f206461656d6f6e",
+      "ciphertext": "2adcd61521379c1e5c1d5ba4b4e0d47d33bed85a6291ea1c91954d64"
+    },
+    {
+      "dir": "r2i",
+      "plaintext": "68656c6c6f2062726f77736572",
+      "ciphertext": "8b8933ece3142387fcaa13d8640348f595e85e77ab3a1988a2796cae21"
+    },
+    {
+      "dir": "i2r",
+      "plaintext": "",
+      "ciphertext": "44d055608856577705078fa7225e5cf7"
+    }
+  ],
+  "msg1Payload": "666c75652d666c6565742d636572742f010207c49831ace851c4c861ad4fa8bc850e18c6128731bdf5631076920bc1e89411000d72656c617965642070686f6e65001f6b61726e732d6d6163626f6f6b2d70726f2d613162322d386163363536356200000000689698e14df03dcd88034926d34caf1b19f349297f0b698a9b1edecb7f7921f64c9c80eab8dbed5a8f51414b8326cb556516adcae9d79d0b5fe7c11f5ceb32b892c1c306"
+}

From 799fa6dbe98a3ca6be920da89be468bce8b8948a Mon Sep 17 00:00:00 2001
From: Karn <mail@karngyan.com>
Date: Mon, 10 Aug 2026 03:42:18 +0530
Subject: [PATCH 2/3] test: carry the fleet key through the tests the join
 line's new flag broke
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The stale tests are the ones that predate --fleet: six join/config call
sites that now need a seed, plus the relay-dial test, which built a zero
daemon.Identity and so never had a fleet key for the relay leg to start
with. flue status gains the assertion the second credential earns — it
must no more print the fleet key than the daemon secret.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 cmd/flue/main_test.go                    | 22 +++++++++++++++++++--
 cmd/flue/relay_test.go                   | 19 ++++++++++++------
 cmd/flue/relayui_test.go                 | 25 +++++++++++++++++++++++-
 internal/transport/relay/channel_test.go |  1 +
 4 files changed, 58 insertions(+), 9 deletions(-)

diff --git a/cmd/flue/main_test.go b/cmd/flue/main_test.go
index 0aeef48..103336c 100644
--- a/cmd/flue/main_test.go
+++ b/cmd/flue/main_test.go
@@ -21,6 +21,7 @@ import (
 
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
 )
@@ -1261,6 +1262,7 @@ func TestStatusReportsAConfiguredRelayWithoutItsSecret(t *testing.T) {
 		Origin:      "https://flue-relay.example",
 		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
 		MachineName: "Karn's MacBook Pro",
+		FleetSeed:   testFleetSeed,
 	}); err != nil {
 		t.Fatalf("SaveRelay: %v", err)
 	}
@@ -1276,6 +1278,12 @@ func TestStatusReportsAConfiguredRelayWithoutItsSecret(t *testing.T) {
 	if strings.Contains(out, secret) {
 		t.Fatalf("status printed the daemon secret:\n%s", out)
 	}
+	// The fleet key is the other credential relay.json holds, and the newer
+	// one: it signs every cert the fleet trusts, so a status output pasted
+	// into a bug report must not carry it either.
+	if strings.Contains(out, testFleetSeed) {
+		t.Fatalf("status printed the fleet key:\n%s", out)
+	}
 }
 
 // --- the relay leg of serve ---
@@ -1306,17 +1314,27 @@ func TestStartRelayDialsAConfiguredRelay(t *testing.T) {
 		Origin:      "https://r.example",
 		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
 		MachineName: "Karn's MacBook Pro",
+		FleetSeed:   testFleetSeed,
 	}); err != nil {
 		t.Fatalf("SaveRelay: %v", err)
 	}
 
+	// The identity serve would have built: the same file's seed, parsed. The
+	// relay leg refuses to start without a fleet key, so a zero Identity here
+	// would test nothing but that refusal.
+	fk, err := fleet.Parse(testFleetSeed)
+	if err != nil {
+		t.Fatalf("fleet.Parse: %v", err)
+	}
+	id := daemon.Identity{Fleet: fk}
+
 	srv := daemon.New(session.NewRegistry(time.Now), local.NewAuth("0123456789abcdef", 0),
-		uiHandler(), version, daemon.Identity{})
+		uiHandler(), version, id)
 	t.Cleanup(srv.Shutdown)
 
 	ctx, cancel := context.WithCancel(context.Background())
 	defer cancel()
-	startRelay(ctx, srv, daemon.Identity{})
+	startRelay(ctx, srv, id)
 
 	deadline := time.Now().Add(3 * time.Second)
 	for attempts.Load() == 0 {
diff --git a/cmd/flue/relay_test.go b/cmd/flue/relay_test.go
index 353b569..55b1a78 100644
--- a/cmd/flue/relay_test.go
+++ b/cmd/flue/relay_test.go
@@ -32,6 +32,11 @@ import (
 // coincidence.
 const setupToken = "cf-token-must-never-be-printed-or-stored"
 
+// testFleetSeed is a fleet key spelled the way the join line spells one: 32
+// bytes, unpadded base64url. Fixed rather than minted, so a test that asserts
+// on a rebuilt join line can name the string it expects.
+const testFleetSeed = "AAECAwQFBgcICQoLDA0ODxAREhMUFRYXGBkaGxwdHh8"
+
 // --- the fake Cloudflare API -------------------------------------------------
 
 // manifestLine is one entry of the asset upload session's manifest.
@@ -898,7 +903,7 @@ func TestRunRelayJoinWritesTheRelayConfig(t *testing.T) {
 	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 
 	var out bytes.Buffer
-	if err := runRelayJoin(&out, []string{"wss://flue-relay.karn.workers.dev", "--secret", "s3cr3t-from-setup"}); err != nil {
+	if err := runRelayJoin(&out, []string{"wss://flue-relay.karn.workers.dev", "--secret", "s3cr3t-from-setup", "--fleet", testFleetSeed}); err != nil {
 		t.Fatalf("runRelayJoin: %v", err)
 	}
 
@@ -957,7 +962,7 @@ func TestRunRelayJoinNormalizesTheAddress(t *testing.T) {
 			t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 
 			var out bytes.Buffer
-			if err := runRelayJoin(&out, []string{tc.arg, "--secret", "s"}); err != nil {
+			if err := runRelayJoin(&out, []string{tc.arg, "--secret", "s", "--fleet", testFleetSeed}); err != nil {
 				t.Fatalf("runRelayJoin(%q): %v", tc.arg, err)
 			}
 			saved := loadSavedRelay(t)
@@ -978,7 +983,7 @@ func TestRunRelayJoinTakesADisplayName(t *testing.T) {
 	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 
 	var out bytes.Buffer
-	if err := runRelayJoin(&out, []string{"wss://r.example", "--secret", "s", "--name", "Study Mac Mini"}); err != nil {
+	if err := runRelayJoin(&out, []string{"wss://r.example", "--secret", "s", "--fleet", testFleetSeed, "--name", "Study Mac Mini"}); err != nil {
 		t.Fatalf("runRelayJoin: %v", err)
 	}
 	if saved := loadSavedRelay(t); saved.MachineName != "Study Mac Mini" {
@@ -1000,10 +1005,12 @@ func TestRunRelayJoinRefusesBadArguments(t *testing.T) {
 		{"no url", []string{"--secret", "s"}, "url"},
 		{"no secret", []string{"wss://r.example"}, "--secret"},
 		{"empty secret", []string{"wss://r.example", "--secret", ""}, "--secret"},
-		{"a scheme that is neither", []string{"http://r.example", "--secret", "s"}, "wss://"},
+		{"a scheme that is neither", []string{"http://r.example", "--secret", "s", "--fleet", testFleetSeed}, "wss://"},
 		{"no host", []string{"wss://", "--secret", "s"}, "url"},
-		{"a path on the url", []string{"wss://r.example/daemon", "--secret", "s"}, "path"},
-		{"a name past 64 runes", []string{"wss://r.example", "--secret", "s", "--name", strings.Repeat("é", 65)}, "--name"},
+		{"a path on the url", []string{"wss://r.example/daemon", "--secret", "s", "--fleet", testFleetSeed}, "path"},
+		{"a name past 64 runes", []string{"wss://r.example", "--secret", "s", "--fleet", testFleetSeed, "--name", strings.Repeat("é", 65)}, "--name"},
+		{"no fleet key", []string{"wss://r.example", "--secret", "s"}, "--fleet"},
+		{"a mangled fleet key", []string{"wss://r.example", "--secret", "s", "--fleet", "not-base64url!!"}, "fleet"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Setenv("XDG_CONFIG_HOME", t.TempDir())
diff --git a/cmd/flue/relayui_test.go b/cmd/flue/relayui_test.go
index 4b60f4f..afe503c 100644
--- a/cmd/flue/relayui_test.go
+++ b/cmd/flue/relayui_test.go
@@ -375,6 +375,7 @@ func TestRelayUIJoinCommandRebuildsTheHandOffLine(t *testing.T) {
 		Origin:    "https://flue-relay-dev.karn.workers.dev",
 		MachineID: "m-1",
 		Worker:    "flue-relay-dev",
+		FleetSeed: testFleetSeed,
 	}); err != nil {
 		t.Fatalf("SaveRelay: %v", err)
 	}
@@ -382,11 +383,33 @@ func TestRelayUIJoinCommandRebuildsTheHandOffLine(t *testing.T) {
 	if err != nil || !ok {
 		t.Fatalf("JoinCommand: ok %v err %v", ok, err)
 	}
-	if cmd != "flue relay join wss://flue-relay-dev.karn.workers.dev --secret fleet-s3cret" {
+	if cmd != "flue relay join wss://flue-relay-dev.karn.workers.dev --secret fleet-s3cret --fleet "+testFleetSeed {
 		t.Fatalf("join command = %q", cmd)
 	}
 }
 
+// TestRelayUIJoinCommandStaysQuietWithoutAFleetKey: a relay.json from before
+// the fleet key exists cannot produce a faithful line — join refuses one
+// without --fleet — so the card offers nothing rather than a command that
+// would be refused on the machine it was pasted into.
+func TestRelayUIJoinCommandStaysQuietWithoutAFleetKey(t *testing.T) {
+	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
+	svc := &relayUIService{runtime: &relayRuntime{}}
+
+	if err := config.SaveRelay(config.Relay{
+		URL:       "wss://flue-relay-dev.karn.workers.dev",
+		Secret:    "fleet-s3cret",
+		Origin:    "https://flue-relay-dev.karn.workers.dev",
+		MachineID: "m-1",
+		Worker:    "flue-relay-dev",
+	}); err != nil {
+		t.Fatalf("SaveRelay: %v", err)
+	}
+	if cmd, ok, err := svc.JoinCommand(context.Background()); ok || err != nil {
+		t.Fatalf("JoinCommand without a fleet key = %q ok %v err %v; want quiet false", cmd, ok, err)
+	}
+}
+
 func TestRelayAddressRepointsWithoutReminting(t *testing.T) {
 	t.Setenv("XDG_CONFIG_HOME", t.TempDir())
 	f := newFakeCloudflare(t, oneAccount(), "karn")
diff --git a/internal/transport/relay/channel_test.go b/internal/transport/relay/channel_test.go
index 2a6671b..00cc2da 100644
--- a/internal/transport/relay/channel_test.go
+++ b/internal/transport/relay/channel_test.go
@@ -1,6 +1,7 @@
 package relay
 
 import (
+	"bytes"
 	"context"
 	"crypto/rand"
 	"encoding/base64"

From 892e957923dd1c506497a2f50888c53f62a339d4 Mon Sep 17 00:00:00 2001
From: Karn <mail@karngyan.com>
Date: Mon, 10 Aug 2026 04:23:58 +0530
Subject: [PATCH 3/3] =?UTF-8?q?fix(fleet):=20make=20the=20comments=20true?=
 =?UTF-8?q?=20=E2=80=94=20revocation,=20docs,=20and=20a=20relay=20that=20s?=
 =?UTF-8?q?ays=20it=20will=20not=20dial?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Security review fixes for stage 2 of spec/fleet-trust.md. Four of them are
comments that claimed something the code did not do.

**A relay.json the daemon refuses is no longer reported as fine (H1).**
relay.New grew a fault relayProblems never learned — a missing fleet key —
so an upgrade with an older relay.json lost remote access while `flue
status`, `flue relay status` and /api/relay/info all called it configured.
relayProblems names the fault, /api/relay/info carries the same list, and the
Remote screen has a state for it: "Not usable", the daemon's own words for
why, and the two ways out.

**Rule 1 consults revocations (M1).** serveChannel did FindByKey → paired →
accept without ever reading the revocation list, so removeDevice's claim that
a landed revocation makes the key "already dead to the acceptance rule" was
false: a revoke whose second write failed left an entry that walked the
device straight back in. The check is folded into FindByKey, inside the same
critical section as the registry read, matching the fleet-cert path — which
also means stage 3's gossip handler has one question to ask, not two.

**docs/RELAY.md says what the join line now costs.** The printed example
showed a line this binary refuses; the join paragraph still said the secret
was the whole credential. It now teaches both credentials, states the weight
the spec requires ("a leaked join line used to buy disruption; with the fleet
key aboard it buys the fleet"), extends the shell-history warning to the
fleet key, and adds the layering table with its honest cost — a compromised
machine can sign for the fleet. Stale join lines fixed in README.md, usage
text, site/, and DEVELOPMENT.md, whose tunnel tier now documents minting a
dev fleet key by hand (nothing at the relay has to agree with it).

**Also**

- A first deploy from the Remote screen dialled nothing: startRelay took the
  fleet public key from the boot-time identity, which for a daemon that had
  no relay.json is empty. It reads the file it just read. The signing half
  still waits for a restart, and the deploy's steps say so.
- A fleet-signed cert name (512 bytes, newlines allowed) now goes through
  daemon.DeviceLabel like every other device name (L2).
- One iat ceiling for encode and decode, so Sign cannot produce bytes Verify
  refuses (L1).
- Pairing mints no device cert when this machine has no id on the relay: the
  spec types pairedOn as a machine-id and an unattributable cert is worse
  than none (L6).
- Comments corrected on RelayJoinPath, RelayUIDeployResult.JoinCommand and
  the join reveal card: the endpoint hands the browser both credentials.

**Tests**

Pins for all of it: a revoked-but-still-listed key refused at the store and
over a relay channel, cert-name normalisation, the fleet seed surviving both
SaveRelay calls and both spellings of the join line, pairing's cert fields
and its refusal without a machine id, and the fleet decoder's unknown
version, unknown kind and over-ceiling string length — signed under the real
key, so each proves the parse and not the signature.

Left open, deliberately: DeviceStore.Add still does not consult revocations,
so re-pairing a revoked key writes an entry FindByKey then refuses. The old
comment excused this with "a fresh ceremony mints a fresh key anyway"; the
browser reuses its IndexedDB key, so it does not. Noted where it bites.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 README.md                                     |   4 +-
 cmd/flue/main.go                              |  59 ++++++++--
 cmd/flue/main_test.go                         |  15 ++-
 cmd/flue/relay_test.go                        |  40 ++++++-
 cmd/flue/relayui.go                           |  22 +++-
 cmd/flue/relayui_test.go                      |  18 ++-
 docs/DEVELOPMENT.md                           |  12 +-
 docs/RELAY.md                                 | 109 ++++++++++++++----
 internal/config/relay.go                      |   6 +
 internal/crypto/devices.go                    |  35 ++++++
 internal/crypto/devices_test.go               |  54 ++++++++-
 internal/daemon/pairing.go                    |  41 +++++--
 internal/daemon/pairing_test.go               |  89 ++++++++++++++
 internal/daemon/relayui.go                    |  33 ++++--
 internal/daemon/server.go                     |   9 +-
 internal/daemon/server_test.go                |   4 +-
 internal/fleet/fleet.go                       |  23 +++-
 internal/fleet/fleet_test.go                  |  87 ++++++++++++++
 internal/transport/relay/channel.go           |  45 +++++---
 internal/transport/relay/channel_test.go      |  92 +++++++++++++++
 site/src/routes/index.tsx                     |   5 +-
 .../components/cloudflare-connect.test.tsx    |   4 +-
 web/src/components/cloudflare-connect.tsx     |  25 ++--
 web/src/routes/remote.test.tsx                |  40 ++++++-
 web/src/routes/remote.tsx                     |  79 ++++++++++++-
 25 files changed, 845 insertions(+), 105 deletions(-)

diff --git a/README.md b/README.md
index e2774d5..8f072e1 100644
--- a/README.md
+++ b/README.md
@@ -76,8 +76,8 @@ The daemon binds loopback and nothing else, so reaching it from elsewhere is
 opt-in and takes one command:
 
 ```sh
-flue relay setup                                   # machine 1: paste a Cloudflare token
-flue relay join wss://<your-relay> --secret <...>  # every other machine
+flue relay setup                                                 # machine 1: paste a Cloudflare token
+flue relay join wss://<your-relay> --secret <...> --fleet <...>  # every other machine
 ```
 
 That deploys a Worker **and** this web app into your own Cloudflare account,
diff --git a/cmd/flue/main.go b/cmd/flue/main.go
index 8d713ab..a07d806 100644
--- a/cmd/flue/main.go
+++ b/cmd/flue/main.go
@@ -107,7 +107,7 @@ const usageText = `flue — your terminal, as a browser tab
   flue disable            remove the login service
   flue status             daemon, login service, and session diagnostics
   flue relay setup        deploy a relay to your own Cloudflare account
-  flue relay join URL --secret S   point this machine at an existing relay
+  flue relay join URL --secret S --fleet K   point this machine at an existing relay
   flue relay status       show the configured relay
   flue relay update       redeploy this release's relay; secret and pairings kept
   flue relay address URL  repoint this machine at a custom domain on the same relay
@@ -382,13 +382,36 @@ func startRelay(ctx context.Context, srv *daemon.Server, identity daemon.Identit
 
 	// The public half only: signing stays with the daemon (pairing,
 	// revocation), while the transport verifies the certs strangers present.
-	// identity.Fleet is the parsed form of this same file's seed — loaded by
-	// loadIdentity, which is fatal on a seed that does not parse — so a nil
-	// Public() here means relay.json carries no fleet key at all, and
-	// relay.New refuses that by name: the file predates the fleet key, and
-	// the re-join line is the way forward (spec/fleet-trust.md keeps no
+	//
+	// Parsed from the file this function just read rather than taken from
+	// identity.Fleet, which is the same value only at boot. The path where
+	// they differ is the one that matters: a relay deployed from the Remote
+	// screen writes a brand-new relay.json — fresh secret, fresh fleet key —
+	// and then calls this in a process whose boot-time identity has no fleet
+	// key at all, or an older one. Reading it from the identity there would
+	// hand relay.New a nil public key, have it refuse the relay the user had
+	// just deployed, and leave one log line behind.
+	//
+	// What still waits for a restart is the *signing* half: Identity is fixed
+	// at construction, so a daemon that deployed a relay from the screen
+	// verifies its fleet's certs from this moment and mints none of its own
+	// until it comes back. relayUIService.Provision says so in its steps; a
+	// nil Public() here, meanwhile, means relay.json carries no fleet key at
+	// all, which relay.New refuses by name (spec/fleet-trust.md keeps no
 	// compatibility with pre-fleet files, deliberately).
-	cfg := relay.Config{URL: rc.URL, Secret: rc.Secret, Origin: rc.Origin, MachineID: rc.MachineID, FleetPub: identity.Fleet.Public()}
+	//
+	// A seed that does not parse costs remote access and nothing else, like
+	// every other fault here. loadIdentity is the one that refuses a bad seed
+	// outright, and it has already run by the time this does.
+	var fleetKey fleet.Key
+	if rc.FleetSeed != "" {
+		fleetKey, err = fleet.Parse(rc.FleetSeed)
+		if err != nil {
+			logger.Warn("relay not started", "err", err)
+			return false
+		}
+	}
+	cfg := relay.Config{URL: rc.URL, Secret: rc.Secret, Origin: rc.Origin, MachineID: rc.MachineID, FleetPub: fleetKey.Public()}
 	t, err := relay.New(cfg, srv, identity.Key, identity.Devices, logger)
 	if err != nil {
 		logger.Warn("relay not started", "err", err)
@@ -1325,10 +1348,12 @@ func relayLine() string {
 	}
 
 	// A file the daemon will not dial must not be reported as "configured".
-	// This is the report somebody reads to find out why remote access does not
-	// work, and the faults are the ones relay.New refuses: a missing field, or
-	// — only possible by hand — both kinds of credential at once, which cannot
-	// be resolved into one dial. The problems are named; no value ever is.
+	// This is the report somebody reads to find out why remote access does
+	// not work, and the faults listed are exactly the ones relay.New refuses
+	// — a field it requires and this file does not carry. Keeping the two
+	// lists in step is a standing obligation: a fault relay.New grows and
+	// this one does not is a daemon that silently stops dialling while every
+	// report says it is fine. The problems are named; no value ever is.
 	if problems := relayProblems(rc); len(problems) > 0 {
 		return fmt.Sprintf("relay:    configured, but not usable (%s): the daemon will not dial it",
 			strings.Join(problems, ", "))
@@ -1357,6 +1382,18 @@ func relayProblems(rc config.Relay) []string {
 		// the fix, and mints one.
 		problems = append(problems, "no machine id")
 	}
+	if rc.FleetSeed == "" {
+		// A relay.json from before the fleet key existed. relay.New refuses
+		// it by name (spec/fleet-trust.md keeps no compatibility with
+		// pre-fleet files, deliberately), so this daemon dials nothing at all
+		// — which is the whole reason it is listed here: the upgrade that
+		// produces this state is silent otherwise, one stderr warning at
+		// startup and a status line that used to say everything was fine.
+		// The fix is a join line carrying `--fleet`: re-run the one printed
+		// by `flue relay setup` on a machine that has it, or re-run setup
+		// itself, which mints a fresh fleet key with the fresh secret.
+		problems = append(problems, "no fleet key")
+	}
 	return problems
 }
 
diff --git a/cmd/flue/main_test.go b/cmd/flue/main_test.go
index 103336c..4d76f6f 100644
--- a/cmd/flue/main_test.go
+++ b/cmd/flue/main_test.go
@@ -1414,13 +1414,20 @@ func TestStatusReportsAnIncompleteRelayConfig(t *testing.T) {
 		relay config.Relay
 		want  string
 	}{
-		{"no url", config.Relay{Secret: secret, Origin: "https://r.example", MachineID: "m-0001"}, "no url"},
-		{"no secret", config.Relay{URL: "wss://r.example", Origin: "https://r.example", MachineID: "m-0001"}, "no secret"},
-		{"no origin", config.Relay{URL: "wss://r.example", Secret: secret, MachineID: "m-0001"}, "no origin"},
+		{"no url", config.Relay{Secret: secret, FleetSeed: testFleetSeed, Origin: "https://r.example", MachineID: "m-0001"}, "no url"},
+		{"no secret", config.Relay{URL: "wss://r.example", FleetSeed: testFleetSeed, Origin: "https://r.example", MachineID: "m-0001"}, "no secret"},
+		{"no origin", config.Relay{URL: "wss://r.example", Secret: secret, FleetSeed: testFleetSeed, MachineID: "m-0001"}, "no origin"},
 		// A relay.json from before machines had ids, or one hand-edited into
 		// that shape: the daemon will not dial it (relay.New refuses), so the
 		// status line has to say why rather than call it configured.
-		{"no machine id", config.Relay{URL: "wss://r.example", Secret: secret, Origin: "https://r.example"}, "no machine id"},
+		{"no machine id", config.Relay{URL: "wss://r.example", Secret: secret, FleetSeed: testFleetSeed, Origin: "https://r.example"}, "no machine id"},
+		// The one an upgrade produces on its own: a relay.json written before
+		// the fleet key existed is complete by every older rule and refused by
+		// relay.New (spec/fleet-trust.md keeps no compatibility with those).
+		// Until this case existed, that machine lost remote access while
+		// `flue status`, `flue relay status` and /api/relay/info all called it
+		// configured and fine.
+		{"no fleet key", config.Relay{URL: "wss://r.example", Secret: secret, Origin: "https://r.example", MachineID: "m-0001"}, "no fleet key"},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Setenv("XDG_CONFIG_HOME", t.TempDir())
diff --git a/cmd/flue/relay_test.go b/cmd/flue/relay_test.go
index 55b1a78..0e13da4 100644
--- a/cmd/flue/relay_test.go
+++ b/cmd/flue/relay_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 	relaybundle "github.com/karnstack/flue/relay"
 	"github.com/karnstack/flue/web"
 )
@@ -584,6 +585,26 @@ func TestRunRelaySetupDeploysTheWorkerAndTheWebApp(t *testing.T) {
 		t.Fatalf("the saved secret decodes to %d bytes, want %d", len(raw), 32)
 	}
 
+	// The second credential, which is the whole of stage 2: setup mints a
+	// fleet key, persists it here, and hands it on in the join line. A
+	// regression that dropped `FleetSeed:` from this SaveRelay would leave
+	// every machine that joined afterwards unable to start its relay leg at
+	// all (relay.New refuses a config without one) — and, before this
+	// assertion existed, would leave the suite green.
+	if _, err := fleet.Parse(saved.FleetSeed); err != nil {
+		t.Fatalf("relay.json fleet_seed = %q, want a key fleet.Parse accepts: %v", saved.FleetSeed, err)
+	}
+	// And it went to Cloudflare in no shape at all — not as the secret, not
+	// as a binding, not in the uploaded module. That is the property the
+	// whole design rests on (spec/fleet-trust.md): the Worker gates routing
+	// and holds nothing that signs.
+	if f.secretText == saved.FleetSeed {
+		t.Fatal("the fleet key was uploaded as the worker's secret")
+	}
+	if hits := configFilesContaining(t, saved.FleetSeed); len(hits) != 1 || filepath.Base(hits[0]) != "relay.json" {
+		t.Fatalf("the fleet key should be in relay.json and nowhere else, got %v", hits)
+	}
+
 	// The URL is the bare host — the /daemon/<machine id> leg is the
 	// transport's to append, so a relay.json is one machine's whole
 	// registration: address, credential, and which machine it is.
@@ -616,7 +637,10 @@ func TestRunRelaySetupDeploysTheWorkerAndTheWebApp(t *testing.T) {
 		fmt.Sprintf("✓ web app uploaded (%d files)", len(files)),
 		"✓ secret set",
 		"✓ reachable at https://" + host,
-		"flue relay join wss://" + host + " --secret " + saved.Secret,
+		"✓ fleet key minted",
+		// Both credentials, exactly as saved: the line is the hand-off, and
+		// a line missing --fleet is one `flue relay join` refuses outright.
+		"flue relay join wss://" + host + " --secret " + saved.Secret + " --fleet " + saved.FleetSeed,
 		"token stored for one-click updates",
 	} {
 		if !strings.Contains(transcript, want) {
@@ -918,6 +942,13 @@ func TestRunRelayJoinWritesTheRelayConfig(t *testing.T) {
 	if saved.Secret != "s3cr3t-from-setup" {
 		t.Fatalf("relay.json secret = %q, want the one given", saved.Secret)
 	}
+	// The other half of the line, and the half nothing else can replace: a
+	// join that persisted the secret and dropped the fleet key would write a
+	// relay.json this daemon refuses to dial (relay.New), which is a machine
+	// that joined and then silently has no relay leg.
+	if saved.FleetSeed != testFleetSeed {
+		t.Fatalf("relay.json fleet_seed = %q, want the one given (%q)", saved.FleetSeed, testFleetSeed)
+	}
 	assertMachineIDMinted(t, saved.MachineID, saved.Secret)
 	hostname, err := os.Hostname()
 	if err != nil {
@@ -1043,6 +1074,7 @@ func TestRunRelayStatusReportsTheConfiguredRelay(t *testing.T) {
 	if err := config.SaveRelay(config.Relay{
 		URL:         "wss://flue-relay.karn.workers.dev",
 		Secret:      "s3cret-value",
+		FleetSeed:   testFleetSeed,
 		Origin:      "https://flue-relay.karn.workers.dev",
 		MachineID:   "karns-macbook-pro-a1b2-0f9a12cd",
 		MachineName: "Karn's MacBook Pro",
@@ -1060,6 +1092,12 @@ func TestRunRelayStatusReportsTheConfiguredRelay(t *testing.T) {
 	if strings.Contains(got, "s3cret-value") {
 		t.Fatalf("status printed the relay secret: %q", got)
 	}
+	// Neither credential, and the fleet key least of all: this line ends up
+	// in terminals, screenshots and bug reports, and the fleet key is the one
+	// that admits devices everywhere.
+	if strings.Contains(got, testFleetSeed) {
+		t.Fatalf("status printed the fleet key: %q", got)
+	}
 }
 
 func TestCmdRelayRejectsAnUnknownSubcommand(t *testing.T) {
diff --git a/cmd/flue/relayui.go b/cmd/flue/relayui.go
index 2e8ff6b..2a08348 100644
--- a/cmd/flue/relayui.go
+++ b/cmd/flue/relayui.go
@@ -152,6 +152,12 @@ func (s *relayUIService) Status(ctx context.Context) daemon.RelayUIStatus {
 		return st
 	}
 	st.Configured = true
+	// The same faults `flue status` names, from the same function, so the
+	// terminal and the screen can never disagree about whether this file is
+	// one the daemon will dial. A relay.json from before the fleet key is the
+	// case that made this necessary: it parses, so Configured is true, and
+	// relay.New refuses it, so the transport never comes up.
+	st.Problems = relayProblems(cfg)
 	st.Origin = cfg.Origin
 	if w, err := updateWorkerName("", cfg); err == nil {
 		st.Worker = w
@@ -362,6 +368,16 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 	}
 	steps = append(steps, "fleet key minted (stays on your machines; Cloudflare never sees it)")
 	steps = append(steps, fmt.Sprintf("this machine joined as %s (%s)", machineName, machineID))
+	// Said out loud because the transport this deploy is about to start does
+	// not cover it. daemon.Identity is fixed at construction, so the fleet key
+	// this process signs with is whatever relay.json held when it booted —
+	// nothing, usually, and never the key minted three lines up. The dialling
+	// half picks the new key up immediately (startRelay reads the file), so
+	// this machine verifies its fleet's certs from now; the signing half —
+	// minting a device cert at pairing, a revocation at revoke — waits for a
+	// restart. A user who pairs a phone in between gets a phone that works
+	// here and cannot roam to the machines they add next.
+	steps = append(steps, "restart the daemon to sign with the new fleet key (until then it verifies fleet certs but mints none)")
 
 	if fromRequest {
 		// Stored by product decision — one 0600 file beside relay.json — so
@@ -398,8 +414,10 @@ func (s *relayUIService) Provision(ctx context.Context, req daemon.RelayUIDeploy
 // joinCommand is the one spelling of the hand-off line, shared by the CLI's
 // setup print, the deploy result and the join endpoint so the three can
 // never drift. It carries the secret and the fleet key seed, which is the
-// line's whole point and its whole weight: docs/RELAY.md and
-// spec/fleet-trust.md both say what leaking it now costs.
+// line's whole point and its whole weight: docs/RELAY.md says what leaking
+// it now costs where it teaches the line ("Standing one up"), and
+// spec/fleet-trust.md fixes the words — a leaked join line used to buy
+// disruption, and with the fleet key aboard it buys the fleet.
 func joinCommand(host, secret, fleetSeed string) string {
 	return fmt.Sprintf("flue relay join wss://%s --secret %s --fleet %s", host, secret, fleetSeed)
 }
diff --git a/cmd/flue/relayui_test.go b/cmd/flue/relayui_test.go
index afe503c..c179738 100644
--- a/cmd/flue/relayui_test.go
+++ b/cmd/flue/relayui_test.go
@@ -13,6 +13,7 @@ import (
 	"github.com/karnstack/flue/internal/cloudflare"
 	"github.com/karnstack/flue/internal/config"
 	"github.com/karnstack/flue/internal/daemon"
+	"github.com/karnstack/flue/internal/fleet"
 )
 
 // The service behind the Remote screen is the same deploy the CLI performs,
@@ -59,8 +60,21 @@ func TestRelayUIProvisionDeploysAndStartsTheTransport(t *testing.T) {
 	if cfg.Worker != relayScriptName || cfg.Secret == "" {
 		t.Fatalf("relay.json = %+v; want the default worker and a secret", cfg)
 	}
-	if !strings.Contains(res.JoinCommand, "flue relay join wss://") || !strings.Contains(res.JoinCommand, cfg.Secret) {
-		t.Fatalf("join command %q does not carry the address and the secret", res.JoinCommand)
+	// The fleet key is persisted here or the machines that join off this
+	// deploy have no relay leg at all: relay.New refuses a config without
+	// one, and JoinCommand refuses to spell a line without one. Checked
+	// against fleet.Parse rather than for emptiness so a garbled value is
+	// caught here rather than on the machine it was pasted into.
+	if _, err := fleet.Parse(cfg.FleetSeed); err != nil {
+		t.Fatalf("relay.json fleet_seed = %q, want a key fleet.Parse accepts: %v", cfg.FleetSeed, err)
+	}
+	// Both credentials in the line, because both are what the other machine
+	// needs — the address and the secret alone is the line `flue relay join`
+	// now refuses.
+	if !strings.Contains(res.JoinCommand, "flue relay join wss://") ||
+		!strings.Contains(res.JoinCommand, "--secret "+cfg.Secret) ||
+		!strings.Contains(res.JoinCommand, "--fleet "+cfg.FleetSeed) {
+		t.Fatalf("join command %q does not carry the address, the secret and the fleet key", res.JoinCommand)
 	}
 	// Stored in exactly one place — cloudflare.json — never in relay.json and
 	// never echoed into steps.
diff --git a/docs/DEVELOPMENT.md b/docs/DEVELOPMENT.md
index e75039d..bf28727 100644
--- a/docs/DEVELOPMENT.md
+++ b/docs/DEVELOPMENT.md
@@ -114,9 +114,19 @@ The daemon joins a tunnel like any relay:
 
 ```sh
 XDG_CONFIG_HOME=~/.config/flue-dev go run -tags dev ./cmd/flue relay join \
-  wss://<tunnel-host> --secret <the .dev.vars value>
+  wss://<tunnel-host> --secret <the .dev.vars value> \
+  --fleet "$(head -c 32 /dev/urandom | base64 | tr '+/' '-_' | tr -d '=')"
 ```
 
+`--fleet` is required and this tier never runs `flue relay setup`, so there
+is no printed line to copy one from — mint it yourself, as above. That works
+because the fleet key is just 32 random bytes in unpadded base64url and the
+Worker never holds it ([`spec/fleet-trust.md`](../spec/fleet-trust.md)):
+nothing at the relay has to agree with the value, only the other machines in
+the same dev fleet do. So keep it if you join a second dev machine — two
+machines holding different fleet keys will not honour each other's device
+certificates — and do not paste in the one a real relay printed.
+
 ### 3. A deployed dev relay (using the relay path day to day)
 
 The recommended way to exercise the real thing: deploy a relay into your
diff --git a/docs/RELAY.md b/docs/RELAY.md
index d3e16c2..962dc24 100644
--- a/docs/RELAY.md
+++ b/docs/RELAY.md
@@ -78,8 +78,9 @@ Worker with its Durable Object migration and the whole web bundle as the
 Worker's static assets, served under the same `Referrer-Policy` and
 `Content-Security-Policy` the daemon serves its own UI with, minus the loopback
 sockets a relay origin has no use for, enables the `workers.dev` subdomain, sets a fresh
-32-byte `DAEMON_SECRET` on the script, mints this machine an id and a display
-name, and writes `relay.json` (mode 0600) into flue's config directory,
+32-byte `DAEMON_SECRET` on the script, mints a fresh **fleet key** it uploads
+nowhere, mints this machine an id and a display name, and writes `relay.json`
+(mode 0600) into flue's config directory,
 `$XDG_CONFIG_HOME/flue` or `~/.config/flue`. The API token is never stored:
 its whole life is that one command, and you can delete it afterwards. Restart
 the daemon to pick the relay up.
@@ -87,25 +88,23 @@ the daemon to pick the relay up.
 Setup ends by printing the line every other machine joins with:
 
 ```
-flue relay join wss://flue-relay.<sub>.workers.dev --secret <...>
+flue relay join wss://flue-relay.<sub>.workers.dev --secret <...> --fleet <...>
 ```
 
 Run it there and restart that daemon. That is the whole of adding a machine.
-Join never touches the Cloudflare API: the Worker exists and the secret is the
-whole credential, so everything it does is local, check the address, mint
-this machine a fresh id (`<hostname>-<4 hex>-<8 hex tag>`, its slot on the
-relay and the `<id>` in both wss paths — the tag is a MAC under the secret
-from the join line, which is why an id minted with a mistyped secret dials
-into `404 no such machine`), and write the same `relay.json` shape setup
-writes.
+Join never touches the Cloudflare API — the Worker already exists — so
+everything it does is local: check the address, take the two credentials off
+the line, mint this machine a fresh id (`<hostname>-<4 hex>-<8 hex tag>`, its
+slot on the relay and the `<id>` in both wss paths — the tag is a MAC under
+the secret from the join line, which is why an id minted with a mistyped
+secret dials into `404 no such machine`), and write the same `relay.json`
+shape setup writes. Both flags are required and `--fleet` is refused when
+missing rather than defaulted: a machine that joined without the fleet key
+would dial the relay fine and trust nothing its fleet signed, which is a
+worse failure than not joining.
 `--name` sets the label the machine picker shows; it defaults to the hostname
 and rides the pairing link's query (`n=`) so the pairing browser can write it
-down, never a path, and never anything the Worker routes on. The printed line carries the secret (that is the
-point, it is the deliberate hand-off) so paste it into the other machine's
-terminal, not into a chat that keeps history. Shell history keeps it just as
-well as chat history does (the join line lands in the other machine's history
-file, secret and all) so clear that entry on a machine whose history anyone
-else can read.
+down, never a path, and never anything the Worker routes on.
 
 Run it from a **release binary** (`make build`, or an installed flue). The
 Worker and the web app are both compiled into that binary, and a dev build
@@ -114,13 +113,16 @@ there.
 
 Re-running setup against the same account is safe for the Worker (the deploy
 and the secret are upserts) but it is a reset, not a repair: every run mints
-a fresh secret *and* a fresh machine id. The fresh secret is deliberate:
-setup is the recovery path for a leaked one, and a run that reused the old
-could never rotate it, and it means every machine that joined is now
-presenting a stale secret and has to run the newly printed join line — and,
-because ids carry a MAC tag minted under the secret, every old id stops
+a fresh secret, a fresh fleet key *and* a fresh machine id. The fresh secret
+is deliberate: setup is the recovery path for a leaked one, and a run that
+reused the old could never rotate it, and it means every machine that joined
+is now presenting a stale secret and has to run the newly printed join line —
+and, because ids carry a MAC tag minted under the secret, every old id stops
 routing at the same moment (the re-join each machine runs anyway mints its
-fresh one). The
+fresh one). The fresh fleet key is deliberate for the same reason and cuts
+deeper: it retires every device certificate the old key signed, so no device
+walks into any machine on a cert from before the reset, and every device
+pairs again. The
 fresh id means the old hub slot is simply abandoned: a browser that paired
 against it is dialling a slot no daemon dials, answered `503 daemon offline`
 until it pairs this machine again and forgets the old row in the picker. To
@@ -129,6 +131,40 @@ to run on machine two. Re-running setup against a *different* account leaves
 the old Worker live and reachable; there is no `flue relay teardown`, so
 delete it in the dashboard yourself (`docs/FOLLOW-UPS.md` item 12).
 
+### What the join line is worth
+
+It carries two credentials, and they are not the same kind of thing.
+`--secret` is the `DAEMON_SECRET`, which Cloudflare holds too: it gates the
+daemon leg, so it is exactly as safe as your Cloudflare account. `--fleet` is
+the **fleet key** ([`spec/fleet-trust.md`](../spec/fleet-trust.md)) — the
+private half of one Ed25519 keypair, held by every machine on this relay and
+by nothing else, which signs the certificates that say "this device is one of
+ours". It reaches the Worker in no binding, no secret and no log, and that is
+the entire point: the Worker gates *routing*, the fleet key gates *trust*, and
+the two fail independently. Someone who gets into your Cloudflare account can
+take remote access away; they cannot admit a device.
+
+Which is why the line's weight changed when the fleet key came aboard: **a
+leaked join line used to buy disruption; with the fleet key aboard it buys the
+fleet.** With the secret alone, whoever holds it can squat a machine's slot,
+knock its daemon off, and accept new pairings while pretending to be it
+("One secret for the fleet", below) — bad, and bounded by the ceremony a
+human still has to perform. With the fleet key too, they can sign a device
+certificate for a key they already hold, and every daemon on the relay will
+admit that device as one you paired: no ceremony, no prompt, on machines they
+have never touched.
+
+So treat the printed line as the root credential it is. Paste it into the
+other machine's terminal, not into a chat that keeps history — and shell
+history keeps it just as well as chat history does. The line lands in the
+other machine's history file with the secret *and* the fleet key in it, so
+clear that entry on any machine whose history someone else can read. If it
+does get out, recovery is re-setup: `flue relay setup` mints a fresh secret
+*and* a fresh fleet key, every machine re-joins with the new line, and every
+device pairs again. There is no way to retire one machine's copy of a fleet
+key while keeping the fleet — every machine holds the same key, deliberately
+(that trade is the one that buys pair-once-per-fleet).
+
 ### The Remote screen runs the same deploys
 
 Setup and update are also cards on the UI's Remote screen: a token field, a
@@ -233,6 +269,35 @@ learned by each hub on its first daemon connect) changes no wire format and
 is deliberately deferred; until it lands, this section is the honest statement
 of what the shared secret does and does not separate.
 
+### And one key the Worker never holds
+
+The secret stopped being the only fleet-wide credential when the fleet key
+arrived. The layering, in full:
+
+| credential | held by | what it decides |
+|---|---|---|
+| `DAEMON_SECRET` | every machine, **and Cloudflare** | the daemon leg; which machine ids route |
+| fleet key (private) | every machine, nobody else | signs machine certs, device certs, revocations |
+| fleet key (public) | every machine, every paired device | verifies all three |
+
+That split is what makes "someone got into my Cloudflare account" an
+availability problem rather than a shell on every machine: the Worker can
+refuse to route, and it cannot admit a device, because it holds nothing that
+signs.
+
+The honest cost sits on the other side of the same line. Every machine holds
+the same private key — trust inside the fleet is symmetric, any machine can
+sign for the fleet, and there is no ceremony between machines — so a
+compromised machine can mint a device certificate every other machine will
+honour, and the shared-secret analysis above understates what it can do by
+exactly that much. That is the trade that buys pairing once for a fleet
+instead of once per machine, for the one-operator model this is built for,
+and it is why re-setup (fresh secret, fresh fleet key, everyone re-joins and
+re-pairs) is the whole of compromise recovery. Revoking a *device* is
+per-machine today; making a revocation reach the fleet needs the directory
+that distributes it, which is the next stage of
+[`spec/fleet-trust.md`](../spec/fleet-trust.md).
+
 ## Cost model
 
 The whole free-tier promise rests on this, and it should rest on measured
diff --git a/internal/config/relay.go b/internal/config/relay.go
index 0b13edf..6c6d135 100644
--- a/internal/config/relay.go
+++ b/internal/config/relay.go
@@ -52,6 +52,12 @@ type Relay struct {
 	// it between them. Never logged, never sent anywhere, and the second
 	// reason this file is 0600 — a leaked seed signs device certs every
 	// machine in the fleet honours.
+	//
+	// It rides argv exactly once, beside the secret and for the same
+	// reason: `flue relay join --fleet` is the deliberate hand-off. The
+	// cost is the same shell history, and the consequence is larger, which
+	// is why docs/RELAY.md states it where it teaches the line rather than
+	// leaving it to be inferred from the secret's warning.
 	FleetSeed string `json:"fleet_seed,omitempty"`
 
 	// MachineID is the slot this machine holds on the relay: the <id> in the
diff --git a/internal/crypto/devices.go b/internal/crypto/devices.go
index b5efada..030eba6 100644
--- a/internal/crypto/devices.go
+++ b/internal/crypto/devices.go
@@ -267,9 +267,44 @@ func (s *DeviceStore) FindByID(id string) (Device, bool, error) {
 	return Device{}, false, nil
 }
 
+// FindByKey answers the acceptance rule's first question (spec/fleet-trust.md):
+// is this static key one this machine paired, and still paired?
+//
+// A key on the revocation list is never a yes, whatever devices.json still
+// says — and the two questions are one call, under one lock, for the reason
+// AddFromFleetCert checks revocation inside the same critical section as its
+// write. Revoking is two writes in a fixed order (daemon.removeDevice): the
+// signed revocation first, the registry entry second. A revoke that landed
+// the first and failed the second leaves an entry here that must not be
+// honoured, and a caller that asked the two questions separately would have a
+// window between them in which it was.
+//
+// It also simplifies the gossip handler the next stage brings: a revocation
+// arriving from the fleet directory for a device this machine never paired
+// has only to be recorded (AddRevocation), and every acceptance path — this
+// one and AddFromFleetCert both — is already refusing that key. Nothing has
+// to remember to ask a second question.
+//
+// An unreadable revocation list is an error rather than a false, the same
+// direction every other refusal here takes: a caller deciding whether to
+// admit a key must refuse when it cannot know.
+//
+// One edge this leaves standing, deliberately and not comfortably: Add does
+// not consult the revocation list, so re-pairing a revoked *key* — which the
+// browser does whenever its IndexedDB survives the revoke, since it reuses
+// its device key — writes an entry this function will then refuse. The
+// ceremony reports success and the relay channel closes anyway. Making Add
+// refuse, or making a deliberate re-pairing clear the revocation, is a
+// design call about what "un-revoking" means (the spec says: a new key, and
+// the old one stays dead) and is deliberately not decided here.
 func (s *DeviceStore) FindByKey(publicKey []byte) (Device, bool, error) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	if revoked, err := s.isRevokedLocked(publicKey); err != nil {
+		return Device{}, false, err
+	} else if revoked {
+		return Device{}, false, nil
+	}
 	devices, err := s.load()
 	if err != nil {
 		return Device{}, false, err
diff --git a/internal/crypto/devices_test.go b/internal/crypto/devices_test.go
index 0a8e970..9e14d5e 100644
--- a/internal/crypto/devices_test.go
+++ b/internal/crypto/devices_test.go
@@ -273,9 +273,15 @@ func TestRevocationOutranksTheCert(t *testing.T) {
 	}
 
 	// A different key is unaffected, and Add — this machine's own ceremony —
-	// deliberately is too: rule 1 of the acceptance order is "pairing on
-	// this machine works as before", and a fresh ceremony mints a fresh key
-	// anyway.
+	// deliberately is too: rule 1 of the acceptance order is "pairing on this
+	// machine works as before". What that leaves is not free, and the old
+	// note here claimed otherwise ("a fresh ceremony mints a fresh key
+	// anyway" — it does not; web/src/crypto/keys.ts reuses the key in
+	// IndexedDB across pairings). So an operator who revokes a device and
+	// then re-pairs the same browser gets an entry FindByKey refuses: paired
+	// on the screen, closed on the wire. Deciding that — Add refusing, or a
+	// deliberate re-pairing clearing the revocation — is a design call about
+	// what un-revoking means, and it is open.
 	other := testKey(t)
 	if revoked, err := s.IsRevoked(other); err != nil || revoked {
 		t.Fatalf("IsRevoked(other) = %v, %v", revoked, err)
@@ -295,6 +301,48 @@ func TestRevocationOutranksTheCert(t *testing.T) {
 	}
 }
 
+// TestFindByKeyRefusesARevokedKey: the store's answer to "is this key one we
+// paired" has to account for the revocation list, because the two files are
+// written in a fixed order and the window between them is real. Revoking
+// records the signed revocation first and removes the registry entry second
+// (daemon.removeDevice), on the grounds that the first write is what kills
+// the key — and that only holds if every acceptance path reads it.
+//
+// The error direction matters as much as the answer: an unreadable
+// revocation list is a refusal, not a shrug, because a caller that cannot
+// know must not admit.
+func TestFindByKeyRefusesARevokedKey(t *testing.T) {
+	s := NewDeviceStore(t.TempDir())
+	key := testKey(t)
+	d, err := s.Add("phone", key, nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if _, ok, err := s.FindByKey(key); err != nil || !ok {
+		t.Fatalf("FindByKey before the revoke = %v, %v", ok, err)
+	}
+
+	// Exactly the state a revoke leaves when its second write fails: the
+	// revocation is on file and the entry is still listed.
+	if err := s.AddRevocation(key, []byte("signed revocation")); err != nil {
+		t.Fatal(err)
+	}
+	if list, _ := s.List(); len(list) != 1 || list[0].ID != d.ID {
+		t.Fatalf("registry = %+v; this test needs the entry still there", list)
+	}
+	if got, ok, err := s.FindByKey(key); err != nil || ok {
+		t.Fatalf("FindByKey on a revoked but still-listed key = %+v, %v, %v; want no match", got, ok, err)
+	}
+
+	// An unreadable list refuses rather than falls back to the registry.
+	if err := os.WriteFile(s.revocationsPath(), []byte("{not a list"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	if _, ok, err := s.FindByKey(key); err == nil || ok {
+		t.Fatalf("FindByKey with an unreadable revocation list = %v, %v; want an error and no match", ok, err)
+	}
+}
+
 func TestFindByID(t *testing.T) {
 	s := NewDeviceStore(t.TempDir())
 	d, err := s.Add("phone", testKey(t), nil)
diff --git a/internal/daemon/pairing.go b/internal/daemon/pairing.go
index b6a0c7c..5b4bbd8 100644
--- a/internal/daemon/pairing.go
+++ b/internal/daemon/pairing.go
@@ -345,7 +345,7 @@ func (s *Server) PairDevice(body []byte, peer string) PairOutcome {
 		return s.refusePair(peer, res.String())
 	}
 
-	label := deviceLabel(req.Label)
+	label := DeviceLabel(req.Label)
 
 	// The ceremony that just completed is the moment the spec mints the fleet
 	// device cert (spec/fleet-trust.md, Certificates): this machine signs
@@ -360,15 +360,33 @@ func (s *Server) PairDevice(body []byte, peer string) PairOutcome {
 	// line: it is unreachable short of a corrupt key (the fields here are
 	// already validated), and refusing the user's ceremony over the cert
 	// would take working local pairing away to protect a convenience.
+	//
+	// So is a daemon that cannot name itself. `pairedOn` is a machine id in
+	// the spec, and the directory the next stage brings keys certs by it: a
+	// cert claiming the empty machine is one nothing can attribute and no
+	// reader can line up against the machine certs beside it. Rather than
+	// sign that, this mints nothing — the honest half of a half-configured
+	// relay.
+	//
+	// The state is reachable, narrowly: relayMachine's id is set by whoever
+	// starts the transport, and only once relay.New has accepted the config,
+	// so a relay.json carrying a fleet seed but missing (say) a machine id
+	// leaves this daemon holding a fleet key and no place on the relay. Such
+	// a machine is not on the relay at all, so a device paired here could not
+	// have reached a sibling on this cert's strength anyway: what the refusal
+	// costs is nothing the device had. `flue status` names the missing field;
+	// fixing it, restarting, and pairing again mints the cert.
 	var cert []byte
 	if s.identity.Fleet.Valid() {
-		blob, err := s.identity.Fleet.Sign(fleet.DeviceCert{
+		if pairedOn := s.relayMachine().id; pairedOn == "" {
+			s.logger().Warn("not minting a fleet device cert: this daemon holds a fleet key but has no machine id on the relay; the device is paired to this machine only",
+				"peer", peer)
+		} else if blob, err := s.identity.Fleet.Sign(fleet.DeviceCert{
 			Device:   key,
 			Name:     label,
-			PairedOn: s.relayMachine().id,
+			PairedOn: pairedOn,
 			IAT:      time.Now().Unix(),
-		})
-		if err != nil {
+		}); err != nil {
 			s.logger().Error("could not mint a fleet device cert; the device is paired to this machine only", "err", err)
 		} else {
 			cert = blob
@@ -500,10 +518,19 @@ func (s *Server) handlePair(w http.ResponseWriter, r *http.Request) {
 	s.writePairOutcome(w, s.PairDevice(body, r.RemoteAddr))
 }
 
-// deviceLabel normalises the device's self-chosen name: trimmed, bounded, and
+// DeviceLabel normalises a device's self-chosen name: trimmed, bounded, and
 // never empty, since it is what the devices screen shows next to a revoke
 // button — an unlabelled row is one the user cannot safely act on.
-func deviceLabel(raw string) string {
+//
+// Exported for the other place a device name enters this machine's registry:
+// the Name on a fleet device certificate, which the relay transport writes
+// into devices.json for a device some sibling machine paired
+// (internal/transport/relay/channel.go). Signed is not the same as tame —
+// the cert encoding bounds that field at 512 bytes and permits newlines and
+// control characters — so it goes through this normaliser rather than a
+// second, laxer one. One rule for what a device may be called, wherever the
+// name came from.
+func DeviceLabel(raw string) string {
 	l := strings.TrimSpace(raw)
 	if r := []rune(l); len(r) > maxLabelRunes {
 		l = string(r[:maxLabelRunes])
diff --git a/internal/daemon/pairing_test.go b/internal/daemon/pairing_test.go
index 3f816d2..a566544 100644
--- a/internal/daemon/pairing_test.go
+++ b/internal/daemon/pairing_test.go
@@ -2,6 +2,7 @@ package daemon
 
 import (
 	"bytes"
+	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"io"
@@ -15,6 +16,7 @@ import (
 	"time"
 
 	"github.com/karnstack/flue/internal/crypto"
+	"github.com/karnstack/flue/internal/fleet"
 	"github.com/karnstack/flue/internal/relaywire"
 	"github.com/karnstack/flue/internal/session"
 	"github.com/karnstack/flue/internal/transport/local"
@@ -570,6 +572,93 @@ func TestPairDeviceRegistersTheDevice(t *testing.T) {
 	}
 }
 
+// newFleetPairServer is newPairServer with a fleet key, and with or without
+// a place on the relay: machineID is what SetRelayMachine records, and "" is
+// the daemon that never got one.
+func newFleetPairServer(t *testing.T, machineID string) (*Server, fleet.Key) {
+	t.Helper()
+	dir := t.TempDir()
+	key, err := crypto.LoadOrCreateStaticKey(dir)
+	if err != nil {
+		t.Fatalf("LoadOrCreateStaticKey: %v", err)
+	}
+	fk, err := fleet.Mint(rand.Reader)
+	if err != nil {
+		t.Fatalf("fleet.Mint: %v", err)
+	}
+	srv := New(session.NewRegistry(time.Now), nil, http.NotFoundHandler(), "test",
+		Identity{Key: key, Devices: crypto.NewDeviceStore(dir), Fleet: fk})
+	t.Cleanup(srv.Shutdown)
+	if machineID != "" {
+		srv.SetRelayMachine(machineID, "Karn's MacBook Pro")
+	}
+	return srv, fk
+}
+
+// TestPairMintsAFleetDeviceCert is the ceremony's half of the fleet key
+// (spec/fleet-trust.md): the machine that ran the pairing signs {device key,
+// name, its own machine id, now} at the moment the ceremony completes, and
+// the registry entry carries the blob. That cert is what admits this device
+// to every sibling machine without a second ceremony, and what the directory
+// stage will publish — so the fields are asserted, not just its presence.
+func TestPairMintsAFleetDeviceCert(t *testing.T) {
+	const machineID = "karns-mbp-a1b2-0f9a12cd"
+	srv, fk := newFleetPairServer(t, machineID)
+
+	token, _ := srv.pairing.start(time.Now())
+	key := deviceKey(0x2a)
+	// Deliberately untidy, to pin which spelling of the name is signed: the
+	// normalised label the registry holds, never the device's raw string.
+	out := srv.PairDevice(pairBody(t, token, base64.StdEncoding.EncodeToString(key), "  phone \n"), "relay")
+	if out.Status != http.StatusOK {
+		t.Fatalf("PairDevice = %d (%s), want 200", out.Status, out.Body)
+	}
+
+	list := devices(t, srv)
+	if len(list) != 1 {
+		t.Fatalf("registry = %+v, want the one device just paired", list)
+	}
+	cert, err := fleet.VerifyDevice(fk.Public(), list[0].Cert)
+	if err != nil {
+		t.Fatalf("the stored cert does not verify under this daemon's fleet key: %v", err)
+	}
+	if !bytes.Equal(cert.Device, key) {
+		t.Error("the cert names a different device key than the one paired")
+	}
+	if cert.Name != "phone" || cert.Name != list[0].Label {
+		t.Errorf("cert name = %q, want the registry's normalised label %q", cert.Name, list[0].Label)
+	}
+	if cert.PairedOn != machineID {
+		t.Errorf("cert pairedOn = %q, want this machine's relay id %q", cert.PairedOn, machineID)
+	}
+}
+
+// TestPairMintsNoCertWithoutAMachineID: `pairedOn` is a machine id in the
+// spec and the directory the next stage brings keys certs by it, so a cert
+// claiming the empty machine is one nothing can attribute — signing it would
+// put an unusable artifact into the fleet's permanent record. A daemon in
+// that state (holding a fleet key from relay.json, with no place on the relay
+// because relay.New refused the rest of the file, so SetRelayMachine never
+// ran) mints nothing and pairs exactly as a fleet-less daemon does.
+func TestPairMintsNoCertWithoutAMachineID(t *testing.T) {
+	srv, _ := newFleetPairServer(t, "")
+
+	token, _ := srv.pairing.start(time.Now())
+	key := deviceKey(0x2a)
+	out := srv.PairDevice(pairBody(t, token, base64.StdEncoding.EncodeToString(key), "phone"), "relay")
+	if out.Status != http.StatusOK {
+		t.Fatalf("PairDevice = %d (%s), want 200 — the ceremony is not refused over the cert", out.Status, out.Body)
+	}
+
+	list := devices(t, srv)
+	if len(list) != 1 || list[0].Label != "phone" {
+		t.Fatalf("registry = %+v, want the one device paired as usual", list)
+	}
+	if len(list[0].Cert) != 0 {
+		t.Fatalf("a cert was minted with no machine id to name: %x", list[0].Cert)
+	}
+}
+
 // TestPairDeviceAnswersJSONOnEveryPath is the contract that makes the relay leg
 // possible at all: relaywire.PairResult carries body as a JSON value and
 // EncodeControl refuses anything else, so a refusal that answered the bare
diff --git a/internal/daemon/relayui.go b/internal/daemon/relayui.go
index b4a97e1..e8c2945 100644
--- a/internal/daemon/relayui.go
+++ b/internal/daemon/relayui.go
@@ -27,12 +27,14 @@ const (
 	RelayUpdatePath = "/api/relay/update"
 	// RelayJoinPath answers the join line for adding another machine — the
 	// same string the deploy result shows, rebuilt from relay.json on demand.
-	// It carries the fleet secret, which is why it is its own endpoint behind
-	// a click rather than a field on Info that every page load would fetch:
-	// the secret should cross into a page exactly when a human asked to see
-	// it. Loopback + auth is the boundary that makes even that acceptable —
-	// the cookie behind withAuth already spawns shells, so a page that can
-	// call this could do worse.
+	// It carries both of the relay's credentials — the `DAEMON_SECRET` the
+	// Worker also holds, and the fleet key's seed, which nothing but this
+	// fleet's own machines ever holds (spec/fleet-trust.md) — which is why it
+	// is its own endpoint behind a click rather than a field on Info that
+	// every page load would fetch: they should cross into a page exactly when
+	// a human asked to see them. Loopback + auth is the boundary that makes
+	// even that acceptable — the cookie behind withAuth already spawns
+	// shells, so a page that can call this could do worse.
 	RelayJoinPath = "/api/relay/join"
 	// RelayAddressPath takes {"address": "wss://..."} and repoints relay.json
 	// at a custom domain the user routed to the Worker themselves. No
@@ -53,6 +55,18 @@ type RelayUIStatus struct {
 	Configured bool   `json:"configured"`
 	Origin     string `json:"origin,omitempty"`
 	Worker     string `json:"worker,omitempty"`
+	// Problems are the faults that stop this daemon dialling the relay.json
+	// it has — the same list, in the same words, `flue status` and `flue
+	// relay status` print. Empty for a healthy file and for a machine with
+	// no relay at all.
+	//
+	// It exists because Configured answers a narrower question than the
+	// screen is asking. A file that parses is configured; a file the
+	// transport refuses is not *usable*; and reporting the first as though
+	// it were the second is exactly how an upgrade that silently ended
+	// remote access looked from every surface flue has — one stderr warning
+	// at startup, and three status reports all saying it was fine.
+	Problems []string `json:"problems,omitempty"`
 	// CanDeploy is false in a dev build, which embeds no Worker; Reason is
 	// the sentence the UI shows instead of a button.
 	CanDeploy       bool   `json:"can_deploy"`
@@ -110,8 +124,11 @@ type RelayUIDeployResult struct {
 	// Steps are the ✓ lines, in order — the same sentences the CLI prints.
 	Steps  []string `json:"steps,omitempty"`
 	Origin string   `json:"origin,omitempty"`
-	// JoinCommand is the hand-off line for other machines, secret included.
-	// Shown once, like the CLI's; it is not retrievable from Status.
+	// JoinCommand is the hand-off line for other machines, carrying both of
+	// the credentials a machine needs to join: the daemon secret and the
+	// fleet key's seed. Shown once, like the CLI's; it is not retrievable
+	// from Status — RelayJoinPath rebuilds it, behind a click, for the same
+	// reason.
 	JoinCommand string `json:"join_command,omitempty"`
 	// RestartNeeded is true when a relay transport was already running in
 	// this daemon: the new relay.json takes effect on the next restart, and
diff --git a/internal/daemon/server.go b/internal/daemon/server.go
index e92ccb6..4a19190 100644
--- a/internal/daemon/server.go
+++ b/internal/daemon/server.go
@@ -1174,9 +1174,12 @@ func validDeviceID(id string) bool {
 // into the registry on its next handshake (AddFromFleetCert) — so a
 // revocation that cannot be recorded fails the whole revoke, loudly, rather
 // than performing the half that does not stick. The converse partial (a
-// revocation recorded, the removal failed) is safe: the key is already dead
-// to the acceptance rule, the entry still shows on the Devices screen, and
-// the retry completes it.
+// revocation recorded, the removal failed) is safe, and safe by mechanism
+// rather than by luck: both acceptance paths read the revocation list inside
+// the same critical section as their registry read — crypto.FindByKey for
+// rule 1, AddFromFleetCert for rule 2 — so the key is already dead to the
+// acceptance rule while the entry still shows on the Devices screen, and the
+// retry completes it.
 //
 // The signed blob is kept by the store (crypto.StoredRevocation) because it
 // is the same artifact the fleet directory will publish so every other
diff --git a/internal/daemon/server_test.go b/internal/daemon/server_test.go
index cb71ecb..73ea265 100644
--- a/internal/daemon/server_test.go
+++ b/internal/daemon/server_test.go
@@ -3254,7 +3254,7 @@ func (s *stubRelayUI) SetAddress(context.Context, string) (RelayUIDeployResult,
 // daemon whose service has none answers 404 — the same shape as unconfigured.
 func TestRelayUIJoinEndpoint(t *testing.T) {
 	ts, _, srv := newTestServerUI(t, http.NotFoundHandler())
-	srv.SetRelayUI(&stubRelayUI{join: "flue relay join wss://r --secret s"})
+	srv.SetRelayUI(&stubRelayUI{join: "flue relay join wss://r --secret s --fleet f"})
 
 	req, err := http.NewRequest(http.MethodGet, ts.URL+RelayJoinPath, nil)
 	if err != nil {
@@ -3276,7 +3276,7 @@ func TestRelayUIJoinEndpoint(t *testing.T) {
 	if err := json.NewDecoder(resp.Body).Decode(&body); err != nil {
 		t.Fatalf("decoding: %v", err)
 	}
-	if body.JoinCommand != "flue relay join wss://r --secret s" {
+	if body.JoinCommand != "flue relay join wss://r --secret s --fleet f" {
 		t.Fatalf("join_command = %q", body.JoinCommand)
 	}
 
diff --git a/internal/fleet/fleet.go b/internal/fleet/fleet.go
index d28ba64..f73766c 100644
--- a/internal/fleet/fleet.go
+++ b/internal/fleet/fleet.go
@@ -77,6 +77,14 @@ const (
 	// than inherit one.
 	maxStringBytes = 512
 
+	// maxIAT is the ceiling on iat, on encode and on decode both — one
+	// constant, because a value the encoder accepts and the decoder refuses
+	// is a cert this package would sign and then fail to verify. Unix
+	// seconds do not reach 2^62 (that is some 146 billion years out), so
+	// anything at or above it is not a time; refusing it here is what keeps
+	// every decoded iat safe to hand to time.Unix.
+	maxIAT = 1 << 62
+
 	// keyBytes is an X25519 public key, the only kind of key a cert names.
 	keyBytes = 32
 
@@ -338,6 +346,14 @@ func appendIAT(b []byte, iat int64) ([]byte, error) {
 	if iat < 0 {
 		return nil, fmt.Errorf("fleet: iat %d is negative", iat)
 	}
+	if iat > maxIAT {
+		// The same ceiling reader.iat holds the wire to. Without it this
+		// encoder would happily sign a math.MaxInt64 iat that its own Verify
+		// then refuses — a cert minted and dead in the same breath, and the
+		// kind of asymmetry a fixture cannot catch because no honest caller
+		// produces one.
+		return nil, fmt.Errorf("fleet: iat %d is not a unix time", iat)
+	}
 	return binary.BigEndian.AppendUint64(b, uint64(iat)), nil
 }
 
@@ -446,10 +462,9 @@ func (r *reader) iat() (int64, error) {
 		return 0, err
 	}
 	v := binary.BigEndian.Uint64(raw)
-	if v > 1<<62 {
-		// The encoder refuses negative iats, so a value this size is not a
-		// time; refusing it keeps every decoded iat safe to hand to
-		// time.Unix.
+	if v > maxIAT {
+		// The same ceiling appendIAT encodes under, so this package never
+		// signs bytes it would then refuse.
 		return 0, fmt.Errorf("%w: iat %d is not a unix time", ErrBadCert, v)
 	}
 	return int64(v), nil
diff --git a/internal/fleet/fleet_test.go b/internal/fleet/fleet_test.go
index c097411..3af001a 100644
--- a/internal/fleet/fleet_test.go
+++ b/internal/fleet/fleet_test.go
@@ -4,7 +4,9 @@ import (
 	"bytes"
 	"crypto/ed25519"
 	"crypto/sha256"
+	"encoding/binary"
 	"errors"
+	"math"
 	"strings"
 	"testing"
 )
@@ -154,6 +156,91 @@ func TestEncodeRefusesBadFields(t *testing.T) {
 	}
 }
 
+// signRaw signs canonical bytes no Cert value could produce, so the tests
+// below can present a blob whose *only* fault is the one under test. Without
+// it every one of them would pass for the wrong reason — an unsigned blob
+// fails the signature check whatever its fields say, which proves nothing
+// about the parse.
+func signRaw(t *testing.T, k Key, canonical []byte) []byte {
+	t.Helper()
+	return append(bytes.Clone(canonical), ed25519.Sign(k.priv, canonical)...)
+}
+
+// TestVerifyRefusesAnUnknownVersion: a version byte this implementation does
+// not speak is refused even under a perfect fleet signature. The version is
+// inside the signed bytes precisely so it cannot be edited by anyone but the
+// fleet — and a future v2 must not be read as a v1 with different meanings.
+func TestVerifyRefusesAnUnknownVersion(t *testing.T) {
+	k := testKey(t)
+	canonical, err := Encode(testCerts()[2])
+	if err != nil {
+		t.Fatal(err)
+	}
+	canonical[len(certPrefix)] = certVersion + 1
+	_, err = Verify(k.Public(), signRaw(t, k, canonical))
+	if !errors.Is(err, ErrBadCert) || !strings.Contains(err.Error(), "version") {
+		t.Fatalf("a signed v%d blob = %v, want ErrBadCert naming the version", certVersion+1, err)
+	}
+}
+
+// TestVerifyRefusesAnUnknownKind: the kind byte is the tag the three layouts
+// are told apart by, so a fourth value has no layout to parse and must not be
+// guessed at. Signed, for the reason above.
+func TestVerifyRefusesAnUnknownKind(t *testing.T) {
+	k := testKey(t)
+	canonical, err := Encode(testCerts()[2])
+	if err != nil {
+		t.Fatal(err)
+	}
+	canonical[len(certPrefix)+1] = kindRevoke + 1
+	_, err = Verify(k.Public(), signRaw(t, k, canonical))
+	if !errors.Is(err, ErrBadCert) || !strings.Contains(err.Error(), "kind byte") {
+		t.Fatalf("a signed blob with an unknown kind = %v, want ErrBadCert naming the kind byte", err)
+	}
+}
+
+// TestDecodeRefusesAnOversizedStringLength: the decoder holds its own ceiling
+// on a length it reads out of a blob, rather than inheriting the bounds the
+// minting paths happen to impose. Signed under the real fleet key, because
+// the ceiling has to hold against a blob that verifies — a fleet key on a
+// compromised machine, or simply a future field bound that grew — and not
+// only against garbage.
+func TestDecodeRefusesAnOversizedStringLength(t *testing.T) {
+	k := testKey(t)
+	var canonical []byte
+	canonical = append(canonical, certPrefix...)
+	canonical = append(canonical, certVersion, kindMachine)
+	canonical = binary.BigEndian.AppendUint16(canonical, uint16(maxStringBytes+1))
+	canonical = append(canonical, bytes.Repeat([]byte{'a'}, maxStringBytes+1)...)
+	canonical = binary.BigEndian.AppendUint16(canonical, 0)
+	canonical = append(canonical, key32(0x11)...)
+	canonical = binary.BigEndian.AppendUint64(canonical, 1754700000)
+
+	_, err := Verify(k.Public(), signRaw(t, k, canonical))
+	if !errors.Is(err, ErrBadCert) || !strings.Contains(err.Error(), "ceiling") {
+		t.Fatalf("a signed blob with a %d-byte string field = %v, want ErrBadCert naming the ceiling", maxStringBytes+1, err)
+	}
+}
+
+// TestIATCeilingIsSharedByBothSides: the encoder must never sign an iat its
+// own Verify refuses. maxIAT is one constant for exactly that reason — before
+// it was, Sign(IAT: math.MaxInt64) succeeded and Verify rejected the bytes it
+// had just produced.
+func TestIATCeilingIsSharedByBothSides(t *testing.T) {
+	k := testKey(t)
+	if _, err := k.Sign(Revocation{Device: key32(0x22), IAT: math.MaxInt64}); err == nil {
+		t.Fatal("Sign accepted an iat that is not a unix time")
+	}
+	// The ceiling itself is on the accepting side of the line on both ends.
+	blob, err := k.Sign(Revocation{Device: key32(0x22), IAT: maxIAT})
+	if err != nil {
+		t.Fatalf("Sign at the ceiling: %v", err)
+	}
+	if _, err := Verify(k.Public(), blob); err != nil {
+		t.Fatalf("Verify of a blob signed at the ceiling: %v", err)
+	}
+}
+
 // TestSeedRoundTrip: the join line's spelling of the key comes back as the
 // same key, and the strict parses refuse what they should.
 func TestSeedRoundTrip(t *testing.T) {
diff --git a/internal/transport/relay/channel.go b/internal/transport/relay/channel.go
index bc5f4fa..ed4eed3 100644
--- a/internal/transport/relay/channel.go
+++ b/internal/transport/relay/channel.go
@@ -7,11 +7,12 @@ package relay
 // paired? The relay cannot answer it and is not asked to: it forwards opaque
 // bytes, and the proof arrives out of a Noise IK handshake this process runs
 // itself. Two proofs are accepted, in order (spec/fleet-trust.md): the
-// initiator's static key is in this machine's own device registry, or the
-// handshake's first message carried a device certificate for exactly that
-// key, signed by the fleet key and not revoked — a device paired on a
-// sibling machine, which this one then records as its own. A key with
-// neither is closed, not served, however well-formed its handshake was.
+// initiator's static key is in this machine's own device registry and not on
+// its revocation list, or the handshake's first message carried a device
+// certificate for exactly that key, signed by the fleet key and not revoked —
+// a device paired on a sibling machine, which this one then records as its
+// own. A key with neither is closed, not served, however well-formed its
+// handshake was.
 
 import (
 	"bytes"
@@ -354,11 +355,18 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 		return
 	}
 
+	// Rule 1, and both halves of it: FindByKey answers "paired here, and not
+	// revoked here" in one critical section (crypto.DeviceStore.FindByKey).
+	// The revocation half is not belt and braces — revoking writes the
+	// revocation before it removes the registry entry, so an entry that
+	// outlived a half-completed revoke is exactly the case a registry-only
+	// lookup would wave through.
 	dev, paired, err := t.devices.FindByKey(peerStatic)
 	if err != nil {
-		// The registry could not be read. Refusing is the only safe direction:
-		// this daemon cannot tell a paired device from an unpaired one right
-		// now, and it is not going to guess.
+		// The registry, or the revocation list it is read against, could not
+		// be read. Refusing is the only safe direction: this daemon cannot
+		// tell a paired device from an unpaired or a revoked one right now,
+		// and it is not going to guess.
 		t.log.Error("could not read the device registry for a relayed browser",
 			"channel", ch.id, "err", err)
 		t.tell(s, relaywire.Close{Channel: ch.id})
@@ -369,7 +377,9 @@ func (t *Transport) serveChannel(s *socket, ch *channel, origin string) {
 		// carrying a fleet device cert in its handshake payload. Rule 1 above
 		// deliberately never looked at the payload — a device in the registry
 		// is served cert or no cert, so pairing on this machine keeps working
-		// if the fleet key ever rotates away.
+		// if the fleet key ever rotates away. A revoked key reaches here too,
+		// and meets the same refusal on the way through: AddFromFleetCert
+		// checks the revocation list inside its own write.
 		dev, paired = t.admitByFleetCert(ch, peerStatic, payload)
 	}
 	if !paired {
@@ -439,13 +449,16 @@ func (t *Transport) admitByFleetCert(ch *channel, peerStatic, payload []byte) (c
 		return crypto.Device{}, false
 	}
 
-	name := cert.Name
-	if name == "" {
-		// The minting machine's ceremony never records an empty label
-		// (daemon.deviceLabel), but the encoding allows one and the Devices
-		// screen must not show a row nobody can safely act on.
-		name = "unnamed device"
-	}
+	// Signed is not the same as tame. The cert's name is authentic — the
+	// fleet vouched for it — and still arbitrary: the encoding bounds it at
+	// 512 bytes and permits newlines and control characters, while its
+	// destination is devices.json and a row on the Devices screen. So it goes
+	// through the normaliser the local pairing ceremony puts its own labels
+	// through (trimmed, 64 runes, never empty), rather than a second and
+	// laxer rule for names that happen to arrive over the fleet. An empty
+	// name — which the minting ceremony never records but the encoding
+	// allows — comes back as "unnamed device" from the same place.
+	name := daemon.DeviceLabel(cert.Name)
 	dev, err := t.devices.AddFromFleetCert(name, peerStatic, payload, time.Unix(cert.IAT, 0))
 	switch {
 	case errors.Is(err, crypto.ErrDeviceRevoked):
diff --git a/internal/transport/relay/channel_test.go b/internal/transport/relay/channel_test.go
index 00cc2da..d28f74b 100644
--- a/internal/transport/relay/channel_test.go
+++ b/internal/transport/relay/channel_test.go
@@ -520,6 +520,50 @@ func TestRelayChannelAdmitsAFleetCertifiedDevice(t *testing.T) {
 	}
 }
 
+// TestRelayChannelNormalisesTheCertName: a fleet-signed name is authentic,
+// which is not the same as bounded. The cert encoding permits 512 bytes with
+// newlines and control characters in them, and the value's destination is
+// devices.json and a row on the Devices screen — so it goes through the same
+// normaliser a local ceremony's label does (daemon.DeviceLabel), and there is
+// one rule for what a device may be called however the name arrived.
+func TestRelayChannelNormalisesTheCertName(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv, _ := newDaemonServer(t, id)
+	tr := newChannelTransport(t, r, srv, id, nil)
+	runTransport(t, tr)
+
+	c := r.accept(t)
+	long := unpairedKey(t)
+	// Padded with the whitespace a trim removes and 200 multibyte runes,
+	// which is well inside the encoding's 512-byte ceiling and well past the
+	// 64 runes a label may be.
+	b := attachWithPayload(t, c, 1, long, id.key.Public,
+		id.deviceCert(t, long.Public, "  \n"+strings.Repeat("é", 200)+"\n"))
+	if _, ok := b.recvControl().(wire.Welcome); !ok {
+		t.Fatal("the fleet-certified device was not welcomed")
+	}
+	got, ok, err := id.devices.FindByKey(long.Public)
+	if err != nil || !ok {
+		t.Fatalf("the admitted device is not in the registry: %v, %v", ok, err)
+	}
+	if want := strings.Repeat("é", 64); got.Label != want {
+		t.Fatalf("registry label = %q (%d runes), want it trimmed and capped at 64", got.Label, len([]rune(got.Label)))
+	}
+
+	// And the empty name the encoding allows but no ceremony produces: the
+	// fallback comes from the same one place.
+	blank := unpairedKey(t)
+	b = attachWithPayload(t, c, 2, blank, id.key.Public, id.deviceCert(t, blank.Public, ""))
+	if _, ok := b.recvControl().(wire.Welcome); !ok {
+		t.Fatal("the device with a blank cert name was not welcomed")
+	}
+	if got, _, _ := id.devices.FindByKey(blank.Public); got.Label != "unnamed device" {
+		t.Fatalf("registry label for a blank cert name = %q", got.Label)
+	}
+}
+
 // TestRelayChannelRefusesAFleetCertForADifferentKey: the cert is a public
 // artifact, so holding one proves nothing — the handshake's own static key
 // is what the initiator proved possession of, and the cert must name
@@ -666,6 +710,54 @@ func TestRelayRevocationOutranksTheFleetCert(t *testing.T) {
 	}
 }
 
+// TestRelayChannelRefusesARevokedKeyStillInTheRegistry pins the acceptance
+// rule's *first* branch against the one state that can produce this: a revoke
+// that recorded its signed revocation and then failed to remove the registry
+// entry. daemon.removeDevice writes the two in that order deliberately, on
+// the grounds that a revocation on file is what makes the key dead — and
+// while rule 1 was a registry lookup and nothing else, that grounds was
+// false. The entry alone let the key straight back in, and the operator's
+// revoke bought nothing at all until some later retry happened to land.
+func TestRelayChannelRefusesARevokedKeyStillInTheRegistry(t *testing.T) {
+	t.Parallel()
+	r := newFakeRelay(t, "s")
+	id := newIdentity(t)
+	srv := &readingServer{}
+	sink := &syncBuffer{}
+	tr := newChannelTransport(t, r, srv, id, slog.New(slog.NewTextHandler(sink, nil)))
+	runTransport(t, tr)
+
+	// The half-completed revoke, assembled directly: the revocation lands and
+	// the paired entry is left exactly where it was, which is what a failed
+	// DeviceStore.Remove leaves behind.
+	blob, err := id.fleet.Sign(fleet.Revocation{Device: id.deviceKey.Public, IAT: time.Now().Unix()})
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := id.devices.AddRevocation(id.deviceKey.Public, blob); err != nil {
+		t.Fatalf("AddRevocation: %v", err)
+	}
+	list, err := id.devices.List()
+	if err != nil {
+		t.Fatalf("List: %v", err)
+	}
+	if len(list) != 1 || list[0].ID != id.device.ID {
+		t.Fatalf("registry = %+v; this test needs the revoked device still listed", list)
+	}
+
+	c := r.accept(t)
+	attach(t, c, 1, id.deviceKey, id.key.Public)
+
+	expectClose(t, c, 1)
+	waitForLog(t, sink, "unpaired device", crypto.DeviceID(id.deviceKey.Public))
+	if n := len(srv.served()); n != 0 {
+		t.Fatalf("the daemon served %d connections for a revoked key, want 0", n)
+	}
+	if !c.stillOpen() {
+		t.Fatal("refusing one channel took the whole socket down")
+	}
+}
+
 // TestRelayChannelRefusesAForeignOrigin: the origin on an open is announced
 // rather than assumed precisely so it can be checked. A relay announcing an
 // origin this daemon did not dial is misconfigured or lying, and either way the
diff --git a/site/src/routes/index.tsx b/site/src/routes/index.tsx
index 2feaf1f..5fac6c7 100644
--- a/site/src/routes/index.tsx
+++ b/site/src/routes/index.tsx
@@ -28,9 +28,10 @@ const RELAY_LINES = [
   ok('worker deployed: flue-relay'),
   ok('web app uploaded'),
   ok('reachable at https://flue-relay.you.workers.dev'),
-  ok('this machine joined as laptop (laptop-9f3a)'),
+  ok('fleet key minted (Cloudflare never sees it)'),
+  ok('this machine joined as laptop (laptop-9f3a-3f9a12cd)'),
   output('\n  to add another machine, run this on it:\n'),
-  output('    flue relay join wss://flue-relay.you.workers.dev --secret …'),
+  output('    flue relay join wss://flue-relay.you.workers.dev --secret … --fleet …'),
 ]
 
 const PROBLEMS = [
diff --git a/web/src/components/cloudflare-connect.test.tsx b/web/src/components/cloudflare-connect.test.tsx
index df421ff..3aef0cf 100644
--- a/web/src/components/cloudflare-connect.test.tsx
+++ b/web/src/components/cloudflare-connect.test.tsx
@@ -61,7 +61,7 @@ describe('CloudflareConnectCard', () => {
       {
         steps: ['token verified', 'worker deployed: flue-relay', 'secret set'],
         origin: 'https://flue-relay.karn.workers.dev',
-        join_command: 'flue relay join wss://flue-relay.karn.workers.dev --secret s3cret',
+        join_command: 'flue relay join wss://flue-relay.karn.workers.dev --secret s3cret --fleet fl33t',
       },
     ])
     render(<CloudflareConnectCard info={INFO} setupCommand="flue relay setup" />)
@@ -76,7 +76,7 @@ describe('CloudflareConnectCard', () => {
     expect(await screen.findByText('worker deployed: flue-relay')).toBeTruthy()
     expect(screen.getByText(/To add another machine/)).toBeTruthy()
     expect(
-      screen.getByText('flue relay join wss://flue-relay.karn.workers.dev --secret s3cret'),
+      screen.getByText('flue relay join wss://flue-relay.karn.workers.dev --secret s3cret --fleet fl33t'),
     ).toBeTruthy()
     expect(screen.getByText(/also available from this screen later/)).toBeTruthy()
     // The form is gone: the flow is over and the token state was cleared.
diff --git a/web/src/components/cloudflare-connect.tsx b/web/src/components/cloudflare-connect.tsx
index e2794a0..9deb378 100644
--- a/web/src/components/cloudflare-connect.tsx
+++ b/web/src/components/cloudflare-connect.tsx
@@ -45,6 +45,12 @@ const TOKEN_PAGE = 'https://dash.cloudflare.com/profile/api-tokens'
 /** GET /api/relay/info, verbatim (daemon.RelayUIStatus). */
 export interface RelayUIInfo {
   configured: boolean
+  /**
+   * The faults that stop this daemon dialling the relay.json it has, in the
+   * daemon's own words — the same list `flue status` prints. Empty or absent
+   * when the file is one the transport accepts.
+   */
+  problems?: string[]
   origin?: string
   worker?: string
   can_deploy: boolean
@@ -632,12 +638,14 @@ function AddressChange({ origin }: { origin?: string }) {
 /**
  * The join line for adding another machine, behind a click.
  *
- * Behind a click and not on the page, because it carries the fleet secret:
- * the daemon will hand it to this authenticated loopback page whenever asked
- * (/api/relay/join rebuilds it from relay.json), but a secret should cross
- * onto a screen at the moment a human asked to see it, not on every visit.
- * Never rendered on a relay origin: the endpoint does not exist there, and
- * the secret must not be offered to a remote tab.
+ * Behind a click and not on the page, because it carries both of the relay's
+ * credentials — the daemon secret the Worker also holds, and the fleet key
+ * that nothing outside your own machines ever holds. The daemon will hand
+ * the line to this authenticated loopback page whenever asked
+ * (/api/relay/join rebuilds it from relay.json), but a credential should
+ * cross onto a screen at the moment a human asked to see it, not on every
+ * visit. Never rendered on a relay origin: the endpoint does not exist
+ * there, and neither credential may be offered to a remote tab.
  */
 export function JoinReveal() {
   const [cmd, setCmd] = useState('')
@@ -661,8 +669,9 @@ export function JoinReveal() {
     return (
       <div className="flex flex-col gap-y-1.5">
         <p className={NOTE}>
-          Run this on another machine to add it — it carries the relay's secret, so treat it like
-          one:
+          Run this on another machine to add it. It carries the relay's secret and the fleet key
+          that every machine here trusts, so anyone who gets the line gets the fleet — paste it into
+          a terminal, not into anything that keeps history:
         </p>
         <Copyable text={cmd} />
       </div>
diff --git a/web/src/routes/remote.test.tsx b/web/src/routes/remote.test.tsx
index d0da3cb..dbddaa1 100644
--- a/web/src/routes/remote.test.tsx
+++ b/web/src/routes/remote.test.tsx
@@ -116,6 +116,42 @@ describe('RemoteRoute', () => {
     expect(screen.getByText(SETUP)).toBeTruthy()
   })
 
+  it('separates a relay it will not dial from having no relay, and names the fault', async () => {
+    // The transport reports `off` for both "no relay configured" and "a
+    // relay.json this daemon refuses" — so the second rendered as the first:
+    // a badge saying nothing was set up and a paragraph of setup instructions,
+    // on a machine whose relay had just stopped working. The upgrade that
+    // produces it is silent otherwise (a relay.json from before the fleet key
+    // carries no seed, and relay.New refuses that), so the daemon names each
+    // fault on /api/relay/info and this screen repeats it.
+    const info = {
+      configured: true,
+      problems: ['no fleet key'],
+      can_deploy: true,
+      version: 'v',
+    }
+    const fetchImpl = vi.fn(
+      async () =>
+        new Response(JSON.stringify(info), {
+          status: 200,
+          headers: { 'Content-Type': 'application/json' },
+        }),
+    )
+    vi.stubGlobal('fetch', fetchImpl)
+    try {
+      await mountRemote()
+
+      expect(await screen.findByText('Not usable')).toBeTruthy()
+      expect(screen.queryByText('Not configured')).toBeNull()
+      // The daemon's word for it, verbatim, and the command that says the
+      // same thing in a terminal.
+      expect(screen.getByText(/no fleet key/)).toBeTruthy()
+      expect(screen.getByText(STATUS)).toBeTruthy()
+    } finally {
+      vi.unstubAllGlobals()
+    }
+  })
+
   it('copies the address the relay carries this machine at', async () => {
     // Copyable for the same reason the commands are: this is a string somebody
     // sends to themselves, and it is longer than a phone is wide.
@@ -264,7 +300,7 @@ describe('JoinReveal', () => {
       const body =
         url === '/api/relay/info'
           ? { configured: true, can_deploy: true, version: 'v', worker: 'flue-relay' }
-          : { join_command: 'flue relay join wss://r --secret s' }
+          : { join_command: 'flue relay join wss://r --secret s --fleet f' }
       return new Response(JSON.stringify(body), {
         status: 200,
         headers: { 'Content-Type': 'application/json' },
@@ -282,7 +318,7 @@ describe('JoinReveal', () => {
 
       await user.click(await screen.findByRole('button', { name: 'Show the join command' }))
 
-      expect(await screen.findByText('flue relay join wss://r --secret s')).toBeTruthy()
+      expect(await screen.findByText('flue relay join wss://r --secret s --fleet f')).toBeTruthy()
       expect(fetchImpl.mock.calls.map((c) => String(c[0]))).toContain('/api/relay/join')
     } finally {
       vi.unstubAllGlobals()
diff --git a/web/src/routes/remote.tsx b/web/src/routes/remote.tsx
index 91406d5..222489d 100644
--- a/web/src/routes/remote.tsx
+++ b/web/src/routes/remote.tsx
@@ -65,8 +65,19 @@ function connectionNotice(status: ConnStatus): string | null {
  * and `client.relay` folds that into the same `{status:'off'}` a daemon with no
  * relay sends. Rendering "Not configured" from it would put the loudest claim
  * on this screen on the page before anything had said it.
+ *
+ * `unusable` splits the last of those: the transport says `off` both for a
+ * machine that never had a relay and for one whose relay.json the daemon
+ * refuses to dial, and calling the second "Not configured" is how an upgrade
+ * that ended remote access reads as a machine that never set it up.
  */
-function StatusBadge({ status }: { status: RelayInfo['status'] | null }) {
+function StatusBadge({
+  status,
+  unusable,
+}: {
+  status: RelayInfo['status'] | null
+  unusable?: boolean
+}) {
   if (status === null) {
     return (
       <Badge variant="outline" className="shrink-0">
@@ -93,6 +104,13 @@ function StatusBadge({ status }: { status: RelayInfo['status'] | null }) {
       </Badge>
     )
   }
+  if (unusable) {
+    return (
+      <Badge variant="outline" className="shrink-0">
+        Not usable
+      </Badge>
+    )
+  }
   return (
     <Badge variant="outline" className="shrink-0">
       Not configured
@@ -188,6 +206,49 @@ function NotConfigured({ info }: { info: RelayUIInfo | null }) {
   )
 }
 
+/**
+ * A relay this machine has a configuration file for and will not dial.
+ *
+ * The state the screen used to swallow. relay.json exists and parses, so the
+ * daemon calls itself configured; the transport refuses the file, so no socket
+ * is ever opened and the welcome reports `off` — the same word a machine that
+ * never had a relay gets. The commonest way in is an upgrade: a relay.json
+ * written before the fleet key existed carries no fleet seed, and the fleet
+ * key is not optional (spec/fleet-trust.md).
+ *
+ * The faults are repeated in the daemon's own words rather than paraphrased.
+ * They are the strings `flue status` prints (relayProblems in
+ * cmd/flue/main.go), and a second wording for the same fact is one more thing
+ * that can drift away from it.
+ */
+function Unusable({ info }: { info: RelayUIInfo }) {
+  return (
+    <>
+      <StatePanel
+        icon={GlobeAltIcon}
+        title="This machine will not dial the relay it is configured for"
+      >
+        <p className={cn(PROSE, 'max-w-[65ch]')}>
+          The daemon found a relay configured here and refuses it — {(info.problems ?? []).join(', ')}{' '}
+          — so nothing outside this computer can reach these sessions, and pairing a device stays
+          shut.
+        </p>
+        <p className={cn(PROSE, 'max-w-[65ch]')}>
+          Running the join line on this machine, from a machine already on the relay, writes a
+          complete configuration and costs nothing else. Deploying below replaces the relay
+          entirely — a fresh secret and a fresh fleet key — which every other machine then has to
+          re-join and every paired browser has to pair again.
+        </p>
+        <Command command={STATUS_COMMAND} />
+      </StatePanel>
+
+      <Integrations>
+        <CloudflareConnectCard info={info} setupCommand={SETUP_COMMAND} />
+      </Integrations>
+    </>
+  )
+}
+
 /**
  * A relay this daemon is configured for and cannot reach yet.
  *
@@ -348,6 +409,17 @@ export function RemoteRoute() {
   const status: RelayInfo['status'] =
     relay.status === 'connected' && origin === '' ? 'connecting' : relay.status
 
+  /*
+   * Whether the daemon is refusing a relay.json it has, rather than having
+   * none. The transport cannot tell the two apart — both are `off` on the
+   * welcome — so the fact comes from the daemon's own answer about its config
+   * file, which names each fault (`problems` on /api/relay/info). Null while
+   * that answer is on its way, and on a relay origin where it is never asked
+   * for; both read as false, which keeps this to the loopback screen it is
+   * about.
+   */
+  const unusable = Boolean(relayUI?.configured && relayUI.problems?.length)
+
   return (
     /*
       The cap moves up here from the panels inside it, which each carried
@@ -364,7 +436,7 @@ export function RemoteRoute() {
       */}
       <PageHeader
         crumbs={[{ label: 'Remote access' }]}
-        actions={<StatusBadge status={greeted ? status : null} />}
+        actions={<StatusBadge status={greeted ? status : null} unusable={unusable} />}
       >
         <p className={cn(PROSE, 'max-w-[65ch]')}>
           The daemon listens on this computer and nowhere else. A relay gives it an address the
@@ -384,7 +456,8 @@ export function RemoteRoute() {
       </PageHeader>
 
       {!greeted && <AwaitingWelcome connecting={conn === 'connecting'} />}
-      {greeted && status === 'off' && <NotConfigured info={relayUI} />}
+      {greeted && status === 'off' && unusable && relayUI && <Unusable info={relayUI} />}
+      {greeted && status === 'off' && !unusable && <NotConfigured info={relayUI} />}
       {greeted && status === 'connecting' && <Dialling />}
       {greeted && status === 'connected' && (
         <>