[P2-E8.7] Multi-node dedicated synchronizer topology (fault tolerance)

**Context.** MVP is currently designed as a single sequencer plus mediator, with BFT explicitly
out of scope (design doc Sections 5 and 11, Appendix G). Raised on the Appendix C registration
story: a centralized node gives no fault tolerance, and the MVP is meant to be production-grade.
Moritz confirmed a 4-node synchronizer "is not hard to setup" and that we should support it;
Itai asked for it to be included in the plan. Neither the plan nor the design doc reflects this
today.

**Open before scoping:** confirm with DA whether "4-node" means four sequencer/mediator pairs
run by a single operator, or a BFT operator set. The trust model differs — design doc Section 12
assumes a single trusted operator for MVP — and so does the reconciliation work.

**Deliverable.** A supported multi-node topology for a dedicated synchronizer: documented node
count and layout, bootstrap that stands it up, and operator-side reconciliation running correctly
against more than one sequencer.

**Acceptance.** A multi-node dedicated synchronizer stands up from the documented bootstrap;
traffic purchased on the global synchronizer is granted correctly with more than one sequencer
present; the design doc no longer asserts that MVP is single-sequencer.

**Depends on.** P2-E8.1 (#98) bootstrapping. Touches P2-E5.3 (#32) reconciliation, which must not
hard-wire a single sequencer, and P2-E9.1 (#102) LocalNet topology.

**Scope note.** This arrived after the end-October working-back and is not in the Appendix B
estimate. It needs to be reflected in the feasibility conversation rather than absorbed silently.

**Refs.** Design doc Sections 5, 11, 12 and Appendix G (all currently assert a single-node MVP);
Appendix C registration story comment thread.

—
Epic: #71 · Plan: [P2-E8-deployment-ops.md](https://github.com/ChainSafe/canton-extending-mainnet/blob/main/docs/planning/phase-2-epics/P2-E8-deployment-ops.md)

Start by resolving with DA whether the four nodes are sequencer/mediator pairs or a BFT operator set, then read design doc Sections 5, 11, 12 and Appendix G. Review P2-E8.1 (#98), P2-E5.3 (#32), P2-E9.1 (#102), and the P2-E8 planning document. Done means the topology and bootstrap are documented, multi-sequencer reconciliation works, and the single-sequencer MVP assertions are updated.

Written by the indexing model from the issue text.