@serfab/cadre-core 0.12.0 → 1.0.0

package/src/cadre-node.ts

@@ -11,6 +11,8 @@ import type {
   StrandInstance,
   StrandRow,
   StrandConfig,
+  FoundStrandConfig,
+  FoundStrandResult,
   SAppConfig,
   CadreNodeEvents,
   ControlNetworkSeed,
@@ -23,6 +25,7 @@ import type {
   OpenInvitation,
   FormStrandResult,
   StrandFormationDisclosure,
+  StrandMembershipInvite,
   ResolveOpts,
   SelfRegistrationOutcome,
   ServiceWakeResult,
@@ -34,14 +37,19 @@ import type {
   PeerAddressRecord,
   ResolveDeviceTokenOpts
 } from './types.js';
-import { CONTROL_CLUSTER_POLICY, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
+import { controlClusterPolicy, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS } from './types.js';
 import { sign } from '@optimystic/quereus-plugin-crypto';
 import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
 import { strandTransportKey } from './strand-transport-key.js';
+import { controlStorageScope } from './storage-scope.js';
+import { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
+import { assertNotPreSplitStrand, issueInvite, PreSplitStrandIdentityError } from './strand-membership-writer.js';
+import { MEMBERSHIP_INVITE_TTL_MS } from './strand-formation-manager.js';
 import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore, type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
 import { MemoryBootstrapPeerStore, type BootstrapPeerStore } from './bootstrap-peer-store.js';
+import { MemoryEnrolledMachineStore, type EnrolledMachineStore } from './enrolled-machine-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './peer-addr-book.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
@@ -51,6 +59,7 @@ import {
   isPeerRecordFresh,
   orderSignalingFirst,
   isSignalingAddr,
+  trailingPeerId,
   withTrailingPeerId,
   currentMemberTrustPolicy,
   DEFAULT_PEER_RECORD_MAX_AGE_MS,
@@ -62,25 +71,33 @@ import {
   isPushPlatform
 } from './device-token.js';
 import { StrandWatcher, type StrandQueryable, type SAppIdLookup } from './strand-watcher.js';
-import { StrandInstanceManager } from './strand-instance-manager.js';
+import { StrandInstanceManager, liveStrandStatus } from './strand-instance-manager.js';
+import { PeerJoinBackfill } from './peer-join-backfill.js';
 import { deriveCohortMembers } from './strand-cohort.js';
 import type { CohortPeerRow } from './strand-cohort.js';
 import {
   selectControlCohortDials,
-  DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
   DEFAULT_CONTROL_COHORT_RECONCILE_MS,
-  DEFAULT_CONTROL_COHORT_TARGET_DEGREE
+  DEFAULT_CONTROL_COHORT_TARGET_DEGREE,
+  type ControlCohortReconcileResult
 } from './control-cohort.js';
-import { withDeadline } from './control-stream.js';
+import {
+  dialPeerAddrs,
+  DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
+  DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS,
+  type PeerDialBudget
+} from './peer-dial.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
-import { ControlDatabase, type RevokedRowRef } from './control-database.js';
+import { ControlDatabase, isStrandIdConflict, type RevokedRowRef } from './control-database.js';
+import type { ControlRetryAbandonment } from './control-retry.js';
 import { SeedBootstrapService, type SeedEventCallbacks } from './seed-bootstrap.js';
 import type { SeedTrustPolicy } from './seed-trust-policy.js';
 import {
   StrandSolicitationService,
   type StrandSolicitationServiceOptions
 } from './strand-solicitation.js';
+import { MAX_STRAND_ADDRS } from './strand-formation-protocol.js';
 import {
   createMembershipConnectionGater,
   DEFAULT_ENROLLMENT_WINDOW_MS,
@@ -97,7 +114,7 @@ import {
   peerStrandKey,
   type CircuitRelayTarget
 } from './delegate-admission.js';
-import { relayCircuitAddrs, resolveListenAddrs, RelayReservationFailedError } from './relay-addrs.js';
+import { relayCircuitAddrs, resolveListenAddrs, resolveTransportOptions, RelayReservationFailedError } from './relay-addrs.js';
 import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import {
   superviseRelayReservation,
@@ -115,6 +132,7 @@ import {
   type ConnectionLike
 } from './diagnostics/connection-path.js';
 import { TurnRelayTracker } from './diagnostics/webrtc-turn-tracker.js';
+import { timedStep } from './timed-step.js';
 
 const log = debug('sereus:cadre:node');
 const timing = debug('sereus:cadre:timing');
@@ -149,6 +167,30 @@ function relayStrandAddrPeer(relay: CircuitRelayTarget): StrandAddrPeer {
   return { peerId: relay.relayPeerId, addrs: [multiaddr(relay.relayAddr)] };
 }
 
+/**
+ * `primary` followed by the entries of `extra` it does not already contain, de-duplicated
+ * and order-preserving.
+ *
+ * Used wherever a strand's discovery seed unions two sources of address strings — the
+ * freshly-RPC'd sibling answers and the cross-party addresses learned at formation. The
+ * caller passes the FRESHER source as `primary`, so a stale entry can only ever be
+ * appended, never promoted ahead of a current one, and each source keeps whatever
+ * signaling-first ordering it arrived with.
+ */
+function unionAddrs(primary: readonly string[], extra: readonly string[]): string[] {
+  if (extra.length === 0) {
+    return [...primary];
+  }
+  const out = [...primary];
+  const seen = new Set(primary);
+  for (const addr of extra) {
+    if (seen.has(addr)) continue;
+    seen.add(addr);
+    out.push(addr);
+  }
+  return out;
+}
+
 /**
  * Build the signing callback the `ControlDatabase` writers expect: they hand it the
  * canonical row-bound message BYTES (see `buildAuthorizationMessage`), and it ed25519-signs
@@ -172,6 +214,60 @@ function requireNonBlank(value: string, label: string): string {
   return trimmed;
 }
 
+/**
+ * Is the live `Strand` row the one a publish of `desired` would have produced?
+ *
+ * "Identical content" means `(Type, MemberPrivateKey)` and deliberately NOT
+ * `FounderOwnerKey`: that column is provenance (WHICH machine published the row), not
+ * content. Two machines of one party racing to found the same id must keep resolving as
+ * "the winner's row stands" — the loser adopts the row and, since the winner's key is on
+ * it, correctly comes up as a joiner (see `launchStrand`'s founder derivation). Comparing
+ * it here would turn that benign race into a hard throw. `Id` is the lookup key and
+ * `StampId` is a single-use nonce, so the two compared columns are all the content there
+ * is. A live row matching on both is, by construction, the state a repeat publish would
+ * have reached, whichever branch of `Strand.AuthorizedInsert` seated it (owner-signed, or
+ * the unsigned consent branch an invite redemption uses).
+ *
+ * Returns the mismatching column names, empty when the row matches. The KEY's value is
+ * deliberately never returned or logged — it is the closed strand's read-gating secret.
+ */
+function strandRowMismatches(live: StrandRow, desired: StrandRow): string[] {
+  const mismatches: string[] = [];
+  if (live.Type !== desired.Type) {
+    mismatches.push(`Type is '${live.Type}', not the requested '${desired.Type}'`);
+  }
+  if ((live.MemberPrivateKey ?? null) !== (desired.MemberPrivateKey ?? null)) {
+    mismatches.push('MemberPrivateKey differs from the one supplied');
+  }
+  return mismatches;
+}
+
+/**
+ * The live row when it matches `desired` ({@link strandRowMismatches}); otherwise throw
+ * naming the columns that differ.
+ *
+ * A mismatch must stay a hard error: accepting one would let a retry reopen a strand the
+ * party closed, or swap the key that gates its reads — so the two cases the raw
+ * `UNIQUE constraint failed: Strand.Id` could not distinguish ("already done, carry on"
+ * vs. "genuine conflict, stop") are separated here rather than left to the caller.
+ *
+ * @param situation - How the row came to be there, as a verb phrase completing
+ *   `Strand <id> …`, e.g. `'is already published'`.
+ */
+function requireMatchingStrandRow(live: StrandRow, desired: StrandRow, situation: string): StrandRow {
+  const mismatches = strandRowMismatches(live, desired);
+  if (mismatches.length > 0) {
+    throw new Error(
+      `Strand ${desired.Id} ${situation} with DIFFERENT content, so this publish is a ` +
+      `conflict, not a repeat: ${mismatches.join('; ')}. Reconcile deliberately — attach ` +
+      'the existing strand with addStrand/foundStrand to keep it, or unpublishStrand first ' +
+      'to re-seat it (destructive for a closed strand: its MemberPrivateKey is stored ' +
+      'nowhere else).'
+    );
+  }
+  return live;
+}
+
 /**
  * CadreNode is the main entry point for a cadre member.
  * It manages:
@@ -203,6 +299,14 @@ export class CadreNode implements SAppIdLookup {
   private trustedOwnerStore: TrustedOwnerStore | null = null;
   private controlNode: Libp2p | null = null;
   private controlDatabase: ControlDatabase | null = null;
+  /**
+   * The CONTROL network's peer-join block catch-up — same module as the
+   * per-strand ones, but membership-gated (see {@link startControlBackfill}).
+   * Created in {@link start} after the control node and database are up, stopped
+   * and dropped in {@link cleanup} before either is torn down, so a stop()→
+   * start() cycle rebuilds it with a fresh caught-up-peer memo.
+   */
+  private controlBackfill: PeerJoinBackfill | null = null;
   private strandWatcher: StrandWatcher | null = null;
   private strandManager: StrandInstanceManager;
   private hibernationManager: HibernationManager;
@@ -228,10 +332,11 @@ export class CadreNode implements SAppIdLookup {
   private _running = false;
   /**
    * The control database's own raw storage (cache-wrapped), resolved once per
-   * `start()` and released in {@link cleanup}. Owning it is what keeps
-   * `config.storage.provider('control')` a once-per-runtime call: a `stop()` then
-   * `start()` cycle on this object re-resolves against a live cache, and never
-   * orphans the previous wrapper's registration in the shared cache pool.
+   * `start()` and released in {@link cleanup}. Owning it is what keeps the
+   * provider call for the control scope — `controlStorageScope(partyId)`, see
+   * `storage-scope.ts` — a once-per-runtime call: a `stop()` then `start()` cycle
+   * on this object re-resolves against a live cache, and never orphans the
+   * previous wrapper's registration in the shared cache pool.
    */
   private controlStorage: IRawStorage | null = null;
   /**
@@ -291,6 +396,15 @@ export class CadreNode implements SAppIdLookup {
   /** Map of strandId -> sAppConfig for sAppId filtering and management */
   private sAppConfigs: Map<string, SAppConfig> = new Map();
 
+  /**
+   * Strands the control network advertises that no local sAppConfig claims — the
+   * backlog behind `strand:discovered`. Maintained in {@link handleStrandAdded}
+   * (added), {@link addStrand} (claimed), {@link detachStrand} (stopped or its
+   * control row vanished) and {@link cleanup}. Read through
+   * {@link getDiscoveredStrands}.
+   */
+  private discoveredStrands: Map<string, StrandRow> = new Map();
+
   /**
    * Most-recently pushed invite addresses (see {@link setInviteAddresses}).
    * When non-null these take priority over `libp2pNode.getMultiaddrs()` when
@@ -397,40 +511,155 @@ export class CadreNode implements SAppIdLookup {
   private readonly strandPeerAddrRefreshAt = new Map<string, number>();
 
   /**
-   * Cold-start bootstrap dial targets: the owner-flagged peers of every seed
-   * this node has applied, keyed by peer id, valued by the seed's multiaddr
-   * strings (parsed lazily, at dial time). Written by
-   * {@link recordSeedBootstrapPeers}; read only by
-   * {@link dialColdStartBootstrap} while the control database still has no
-   * siblings to dial.
+   * CROSS-PARTY strand-network addresses learned at formation, keyed by strandId — the
+   * responder's live strand addrs, carried back on the formation result
+   * (`FormationResultMessage.strandAddrs`) and recorded by {@link formStrand}.
+   *
+   * This is the ONLY cross-party discovery input there is. The strand-addr RPC that
+   * resolves a strand's addresses is membership-gated and answers own-party siblings
+   * only, so without this map a joiner's cohort seed for a two-party strand is empty and
+   * the mesh never forms.
+   *
+   * Read by {@link resolveCohortSeed} (launch + hibernation resume) and re-merged by
+   * every {@link refreshStrandPeerAddrs} pass — the re-merge is what keeps the entries
+   * alive past the peerStore's one-hour address expiry, since nothing can re-resolve
+   * them.
+   *
+   * IN-MEMORY and ONE-SHOT, deliberately (see `docs/strands.md`): the addresses die with
+   * the process, and a restarted initiator with no sibling running the strand is back to
+   * an empty seed until the durability work lands
+   * (`backlog/feat-cross-party-strand-addr-durability`). They are also never refreshed,
+   * so a responder whose relay reservation rotates before the initiator dials leaves a
+   * dead entry behind; recovery today is a fresh invitation.
+   *
+   * NOTE: entries are kept for the node's lifetime, including across a
+   * {@link stopStrand} — a stopped strand may be rediscovered by the watcher and must
+   * still get its seed. Each strand's list is capped at `MAX_STRAND_ADDRS`, but the
+   * number of KEYS is bounded only by the strands this node has ever formed as an
+   * initiator (not by time); if a node ever forms strands at scale, evict on
+   * `unpublishStrand` or cap the map.
+   */
+  private readonly crossPartyStrandAddrs = new Map<string, string[]>();
+
+  /**
+   * PENDING strand membership invitations learned at formation, keyed by strandId — the
+   * single-use `Strand.Invite` credential a closed-strand formation result carried back
+   * ({@link FormStrandResult.membershipInvite}), waiting for this node's strand bring-up
+   * to redeem (`consumeInvite` seats the `Strand.Member` row under this party's own key
+   * — the `strand-node-binds-member-peer` half of the party-identity chain).
+   *
+   * IN-MEMORY, deliberately, like {@link crossPartyStrandAddrs}: a restarted joiner
+   * re-forms from scratch anyway (durability is
+   * `backlog/feat-cross-party-strand-addr-durability`'s problem), and re-forming issues
+   * a fresh invitation. A re-formation against the same strand REPLACES the entry — the
+   * fresh invitation supersedes one that may have expired. The party key the invitation
+   * admits, by contrast, IS persisted (`StrandPartyKey`, seated by
+   * {@link adoptFormationMembershipInvite} before the entry lands here), so a lost
+   * invitation never orphans an identity.
+   *
+   * INVALIDATION is owned by the strand's bring-up membership reconciler
+   * (`strand-membership-reconciler.ts`, wired via `StartStrandConfig.pendingMembershipInvite`
+   * in {@link launchStrand}): it deletes the entry once the invitation is redeemed, burned
+   * against an already-seated member, or found dead (expired / cancelled / consumed
+   * elsewhere / the strand sealed). Until the strand is actually launched here the entry
+   * just waits.
+   *
+   * NOTE: entries live for the node's lifetime (one small pair per formed closed
+   * strand), the same unbounded-keys tripwire {@link crossPartyStrandAddrs} documents —
+   * if a node ever forms strands at scale, evict alongside that map.
+   */
+  private readonly pendingMembershipInvites = new Map<string, StrandMembershipInvite>();
+
+  /**
+   * Founder launches refused because the strand was founded before the per-party
+   * identity split (`PreSplitStrandIdentityError`), keyed by strandId. Read by
+   * {@link issueStrandMembershipInvite}, which rethrows the recorded error so a bound
+   * redemption against the strand is rejected as "must be recreated" — not told to retry
+   * because the runtime is not live (a refused fresh launch leaves none) or failed by the
+   * `Strand.Invite` gate (a refused in-place founding leaves a joiner instance up whose
+   * party key is no manager).
+   *
+   * Written and cleared by {@link launchStrand}; also cleared by {@link detachStrand},
+   * {@link unpublishStrand} and {@link cleanup}, so a recreated id starts clean.
+   * In-memory: after a restart the next founder launch of the strand records it again;
+   * until then issuance still reads the fingerprint off the live rows whenever a runtime
+   * is up — only a strand with no runtime at all answers retryably meanwhile.
+   */
+  private readonly strandLaunchRefusals = new Map<string, PreSplitStrandIdentityError>();
+
+  /**
+   * Dial targets learned out of band, keyed by peer id, valued by the multiaddr
+   * strings this node was handed (parsed lazily, at dial time). Two writers:
+   * {@link recordSeedBootstrapPeers} retains the owner-flagged peers of every seed
+   * this node applies, and {@link addDrone} retains the addresses of every node
+   * this node adds. Two readers: {@link dialColdStartBootstrap} dials every entry
+   * while the control database still has no siblings, and
+   * {@link resolveControlDialAddrs} falls back to a sibling's entry when neither
+   * its signed record nor the address book yields an address.
    *
    * A STORE rather than a plain map (see `bootstrap-peer-store.ts`), because the
    * targets must outlive the process: a node seeded into a party it could not
    * reach has nothing else on disk naming that party's addresses (`applySeed`
    * writes no control row, and `CadrePeer` fills in only after a connection
    * succeeds), so an in-memory-only set left it stranded permanently across a
-   * restart. Constructed (or adopted from `config.bootstrapPeers.store`) by
+   * restart. An owner that added a node it cannot be dialed by is in the same
+   * position: the added node's row stays unsigned, so unresolvable, until that
+   * node self-publishes over a connection only the owner can open. Constructed (or
+   * adopted from `config.bootstrapPeers.store`) by
    * {@link initializeBootstrapPeerStore} during {@link start}; deliberately NOT
    * cleared by {@link cleanup}, so it survives a stop()→start() cycle of the same
    * node instance — same lifecycle as {@link trustedOwnerStore}. Durability
-   * depends on the injected backend: Node gets a file-backed store from the CLI,
-   * RN/browser stay ephemeral for now.
+   * depends on the injected backend; the default is in-memory.
    *
    * Deliberately NOT the libp2p peer store, which {@link peerStoreAddrs} already
    * reads for the steady-state path. The peer store is shared with everything
    * libp2p discovers, so "dial every entry" would grow into dialing arbitrary
    * discovered peers as the node lives longer; this store holds exactly the peers
-   * an owner-signed, trust-anchored seed nominated as owners. `applySeed` merges
-   * the same addresses into the peer store as well, so the two never disagree —
-   * this one is just the precisely-scoped subset.
+   * an owner-signed, trust-anchored seed nominated as owners, and the nodes this
+   * node chose to add. `applySeed` also merges a seed's addresses into the peer
+   * store, where they age out; an added node's addresses are never merged there,
+   * because only verified addresses go into the address book (see
+   * {@link warmSiblingAddrBook}).
    *
-   * A later seed OVERWRITES an entry rather than merging, so a re-seed after an
+   * A later record OVERWRITES an entry rather than merging, so a re-seed after an
    * owner's address changes replaces the stale address instead of accumulating
-   * dead ones. Entries are never evicted: they are the node's only way back into
-   * the party if it is ever stranded again.
+   * dead ones, and {@link warmSiblingAddrBook} replaces an entry with the addresses
+   * the sibling's signed record resolves to when they differ. Only this node's own
+   * {@link removePeer} evicts an entry: otherwise they are the node's only way back
+   * to those peers if it is ever stranded again.
    */
   private bootstrapPeerStore: BootstrapPeerStore | null = null;
 
+  /**
+   * Node-local record of the party's enrolled-machine count (see
+   * `enrolled-machine-store.ts`), kept so the CONTROL node can declare a
+   * block-repair yardstick at bring-up. Constructed (or adopted from
+   * `config.enrolledMachines.store`) by {@link initializeEnrolledMachineStore};
+   * written by {@link refreshAuthorizedControlPeers}. Like
+   * {@link bootstrapPeerStore} it is deliberately NOT cleared by {@link cleanup},
+   * so it survives a stop()→start() cycle of the same node instance.
+   */
+  private enrolledMachineStore: EnrolledMachineStore | null = null;
+
+  /**
+   * The enrolled-machine count this node's CONTROL libp2p node was (or will be)
+   * built with — read out of {@link enrolledMachineStore} during {@link start},
+   * before {@link createControlNode}, and consumed by
+   * {@link buildControlNodeOptions}.
+   *
+   * A captured FIELD rather than a live `store.count()` read, deliberately: the
+   * store moves as membership changes, but Optimystic froze the policy when the
+   * node was built, so this field is the honest answer to "what did this node
+   * actually declare?" and does not drift away from the running node. It is
+   * re-read on each {@link start}, which is what makes a stop()→start() cycle pick
+   * up a count recorded during the previous run.
+   *
+   * `undefined` — a brand-new node, an unreadable slot, or the ephemeral default
+   * store — means "this node does not know", which `controlClusterPolicy` answers
+   * with the frozen base policy itself.
+   */
+  private declaredEnrolledMachines: number | undefined;
+
   /** Initial self-registration timer (see {@link scheduleSelfRegistration}). */
   private selfRegistrationTimer: ReturnType<typeof setTimeout> | null = null;
   /** TTL heartbeat that re-publishes the self record before it goes stale. */
@@ -450,7 +679,7 @@ export class CadreNode implements SAppIdLookup {
    * together; collapsing concurrent passes into one in-flight run prevents two
    * passes from double-dialing the same siblings (mirrors {@link registerSelfInFlight}).
    */
-  private reconcileControlCohortInFlight: Promise<void> | null = null;
+  private reconcileControlCohortInFlight: Promise<ControlCohortReconcileResult> | null = null;
   /**
    * Single-flight guard for {@link registerSelf}. Concurrent callers (the explicit
    * CLI `--owner` publish, the 1s startup timer, the TTL heartbeat, and the
@@ -458,6 +687,19 @@ export class CadreNode implements SAppIdLookup {
    * both read "no row yet" and race a duplicate INSERT (a `CadrePeer` PK conflict).
    */
   private registerSelfInFlight: Promise<SelfRegistrationOutcome> | null = null;
+  /**
+   * When this node last PUBLISHED its own `CadrePeer` address record (inserted or
+   * refreshed), or null if it never has in this session. Stamped by
+   * {@link noteSelfRecordPublished} on every successful publish, wherever it was driven
+   * from — the boot pass, the heartbeat, an address change, a drain or an explicit call.
+   *
+   * Read by {@link escalateIfSelfRecordStale} for the one consequence worth an operator's
+   * attention: once this gap exceeds {@link DEFAULT_PEER_RECORD_MAX_AGE_MS}, every other
+   * machine in the party is already discarding this node's address as stale.
+   */
+  private lastSelfRecordPublishAt: number | null = null;
+  /** Say-once latch for {@link escalateIfSelfRecordStale}; re-armed by the next publish. */
+  private selfRecordStaleWarned = false;
 
   // ── Write-while-alone re-replication (control-write-ensure-replicated) ──────
   /**
@@ -493,6 +735,14 @@ export class CadreNode implements SAppIdLookup {
    * exactly a "removals from before this lifetime" case).
    */
   private reissuedHeldRevocations = false;
+  /**
+   * Whether this process has seen the singleton `Revocation` ledger marker filed — its own
+   * `'opened'` or an `'already-open'` answer, in {@link openRevocationLedgerIfDue}. A
+   * record of work done, not a cached authorization answer: the marker can never be
+   * deleted (`NoDelete`), so this can only go stale if the database itself is replaced,
+   * which is why stop() clears it with the other per-process replication state.
+   */
+  private revocationLedgerOpened = false;
   /** This node's own `CadrePeer` self-write committed local-only (re-touched on growth). */
   private pendingSelfPeerWrite = false;
   /** This node's own `DeviceToken` self-write committed local-only (re-touched on growth). */
@@ -647,6 +897,26 @@ export class CadreNode implements SAppIdLookup {
     return this.strandManager.getInstances();
   }
 
+  /**
+   * Strands the control network advertises that no local sAppConfig claims —
+   * the backlog behind `strand:discovered`.
+   *
+   * The event fires once per strand, and it can fire before the app has
+   * subscribed (the watcher's first poll runs inside `start()`). So an app that
+   * auto-joins discovered strands must subscribe FIRST and then drain this map,
+   * not rely on the event alone. Entries leave the map when the strand is
+   * claimed ({@link addStrand}) or its control row disappears.
+   *
+   * Bounded by the number of strands this party has that this node does not run
+   * — the control database holds only this party's rows — so there is no cap and
+   * no eviction policy to reason about.
+   *
+   * Returns a snapshot; mutating it does not affect the node.
+   */
+  getDiscoveredStrands(): Map<string, StrandRow> {
+    return new Map(this.discoveredStrands);
+  }
+
   /**
    * Get a specific strand instance
    */
@@ -702,6 +972,14 @@ export class CadreNode implements SAppIdLookup {
       // loaded before the first reconcile pass could consult them.
       this.initializeBootstrapPeerStore();
 
+      // Read the party's enrolled-machine count out of its node-local record and
+      // capture it for buildControlNodeOptions below. This MUST precede
+      // createControlNode: Optimystic freezes the cluster policy when the node is
+      // built, and the ControlDatabase that could answer the question live does not
+      // exist until after that. Remembering the number across the restart is the
+      // only way to declare it at all — see `enrolled-machine-store.ts`.
+      this.initializeEnrolledMachineStore();
+
       // Arm the connection gate's BRING-UP QUIET PERIOD before the libp2p node
       // exists, so no connection can form ahead of it: `@libp2p/bootstrap` emits
       // its discovery events ~1 s after `libp2p.start()` and the connection
@@ -769,6 +1047,10 @@ export class CadreNode implements SAppIdLookup {
       // Committed-delete seam → write-while-alone revocation queue. Same wiring
       // window argument as the membership listener above.
       this.controlDatabase.setGuardedDeleteListener((revocation) => this.noteGuardedDelete(revocation));
+      // Abandoned-write seam. Wired here, before the first control write can run, so a
+      // write lost during the rest of bring-up is reported like any other.
+      this.controlDatabase.setControlWriteAbandonedListener(
+        (abandonment) => this.noteControlWriteAbandoned(abandonment));
 
       // Create strand queryable using the control database
       const queryable = this.createStrandQueryable();
@@ -835,6 +1117,13 @@ export class CadreNode implements SAppIdLookup {
       // write-while-alone re-replication drain must fire on the first 0→≥1 edge.
       this.wireControlConnectionListeners();
 
+      // Arm the control network's peer-join block catch-up now that the control
+      // DB (which the push-time membership gate reads) is up. Armed even when
+      // this node is alone — like the strand one, it only does work when the
+      // control libp2p node reports a peer connection, and arming it at start is
+      // what closes the "genesised alone, headers never replicate" hole.
+      this.startControlBackfill();
+
       // Seed the per-stream gate's materialized authorized set now that the
       // control DB is up (non-blocking; the helper never rejects). Until it
       // lands the snapshot is empty, which the stream gate treats as cold
@@ -846,7 +1135,7 @@ export class CadreNode implements SAppIdLookup {
       // scheduleSelfRegistration, so this node's first published `CadrePeer` row
       // already carries the `/p2p-circuit` address the reservation earns it.
       // Throws on a relay that will not have us — start() is fail-fast for a node
-      // whose operator named a relay.
+      // whose operator named a relay, unless network.requireRelay is false.
       await this.driveControlRelayReservation();
 
       // Schedule self-registration in background
@@ -1049,10 +1338,54 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * The node-local cold-start bootstrap-peer store (null before {@link start}) —
-   * the retained owner addresses {@link reconcileControlCohort}'s cold-start
-   * branch re-dials. Exposed for diagnostics and for a host that wants to show
-   * "what would this node dial if it is stranded?".
+   * Construct (or adopt) the node-local enrolled-machine store and capture the
+   * count this run will declare into {@link declaredEnrolledMachines}.
+   *
+   * Synchronous for the same reason {@link initializeBootstrapPeerStore} is: an
+   * injected store has already loaded its persisted count by the time it is handed
+   * in (its `open` is the async part), and the in-memory default has nothing to
+   * load. Must run BEFORE {@link createControlNode} — that is the whole point of
+   * the record; see `enrolled-machine-store.ts`.
+   *
+   * The store instance is kept across stop()→start() (so a count recorded during
+   * the previous run is not lost with the ephemeral default), but the DECLARED
+   * count is re-read every time — which is how a restart applies a number the
+   * previous run learned.
+   *
+   * A store scoped to a different party is a configuration error, fail closed. It
+   * is only a repair hint, but a hint sized by a foreign party's membership is a
+   * number nobody chose, and the mismatch always means a miswired embedder.
+   */
+  private initializeEnrolledMachineStore(): void {
+    const partyId = this.config.controlNetwork.partyId;
+    const store = this.enrolledMachineStore
+      ?? this.config.enrolledMachines?.store
+      ?? new MemoryEnrolledMachineStore(partyId);
+    if (store.partyId !== partyId) {
+      throw new Error(
+        `CadreNodeConfig: enrolledMachines.store is scoped to party ${store.partyId}, ` +
+        `but this node serves party ${partyId} — refusing to size a repair yardstick from a foreign party`
+      );
+    }
+    this.enrolledMachineStore = store;
+    this.declaredEnrolledMachines = store.count();
+    log('control repair yardstick will be declared from %o enrolled machine(s)', this.declaredEnrolledMachines);
+  }
+
+  /**
+   * The node-local enrolled-machine store (null before {@link start}) — what this
+   * node last knew about its party's size. Exposed for diagnostics and for a host
+   * that wants to show which repair yardstick the next launch will declare.
+   */
+  getEnrolledMachineStore(): EnrolledMachineStore | null {
+    return this.enrolledMachineStore;
+  }
+
+  /**
+   * The node-local bootstrap-peer store (null before {@link start}) — the dial
+   * targets learned out of band that {@link reconcileControlCohort} falls back to.
+   * Exposed for diagnostics and for a host that wants to show "what would this
+   * node dial if it is stranded?".
    */
   getBootstrapPeerStore(): BootstrapPeerStore | null {
     return this.bootstrapPeerStore;
@@ -1098,6 +1431,93 @@ export class CadreNode implements SAppIdLookup {
     return await createLibp2pNode(this.buildControlNodeOptions());
   }
 
+  /**
+   * The control libp2p node's Optimystic network name — ONE binding for every
+   * derivation from it (`db-p2p` namespaces all of the node's protocol ids as
+   * `/optimystic/<networkName>/...`), so the node options and the block-transfer
+   * protocol prefix the control backfill dials can never drift apart.
+   */
+  private controlNetworkName(): string {
+    return `control-${this.config.controlNetwork.partyId}`;
+  }
+
+  /**
+   * Arm the CONTROL network's peer-join block catch-up: push every block in the
+   * control database's own raw store to each newly connected AUTHORIZED member
+   * this runtime has not yet caught up. This is what physically replicates
+   * control blocks committed while the writer was alone — the named
+   * collection-header blocks written once at genesis above all, whose revision
+   * never moves again, so no later commit ever carries them to a member that
+   * joined after them. Without it, such a member that restarts offline reads
+   * the affected control tables as EMPTY, silently (`isMember()` answers false
+   * for peers it knew about before the restart).
+   *
+   * Unlike the per-strand instances (see `strand-instance-manager.ts`), pushes
+   * are gated on {@link isAuthorizedMember}, judged at push time: the control
+   * network's inbound connection gate deliberately admits non-members in
+   * several states (seed delivery to an un-enrolled node, an open enrollment
+   * window, an outstanding invitation, configured bootstrap/relay peers), and
+   * pushing the whole control store to such a peer would hand a stranger the
+   * party's entire membership, addresses and strand list. The receiving side
+   * needs no work of its own: `createLibp2pNode` registers the block-transfer
+   * handler on every node it builds, control node included, and this node's
+   * per-stream gate (`authorizeInboundControlStream`) covers the inbound
+   * direction. A denied peer is retried on its next `connection:open`, and —
+   * because the production join order is connect-then-authorize — on every
+   * committed membership change via {@link refreshAuthorizedControlPeers}'s
+   * `scheduleConnectedPeers()` call.
+   *
+   * No-ops (logged) when the embedder configured no control storage or the
+   * node exposes no key network — the backfill would have nothing to read or
+   * no way to dial.
+   */
+  private startControlBackfill(): void {
+    if (this.config.controlBackfill?.enabled === false || !this.controlNode) {
+      return;
+    }
+    // Through the resolver, not the {@link controlStorage} memo field: the resolver is
+    // idempotent (it returns the same wrapped store `buildControlNodeOptions` already
+    // resolved), so the catch-up cannot be silently disarmed by a future reordering that
+    // moves this call ahead of the one that populated the field.
+    const storage = this.resolveControlStorage();
+    const keyNetwork = (this.controlNode as Libp2pNodeWithRepo).keyNetwork;
+    if (!storage || !keyNetwork) {
+      log('Control peer-join block catch-up is inert: %s',
+        !storage ? 'no control storage configured' : 'control node exposes no keyNetwork');
+      return;
+    }
+    const networkName = this.controlNetworkName();
+    this.controlBackfill = new PeerJoinBackfill({
+      label: networkName,
+      libp2p: this.controlNode,
+      peerNetwork: keyNetwork,
+      storage,
+      // The same prefix the receiver registered its block-transfer handler
+      // under — derived from the same networkName binding the node options
+      // used, never re-spelled here.
+      protocolPrefix: `/optimystic/${networkName}`,
+      authorizePeer: (peerId) => this.isAuthorizedMember(peerId)
+    }, {
+      // A shorter settle window than the strand default (1000 ms): the control
+      // store is small (a party's membership — dozens of blocks), a re-push is
+      // idempotent, and the window a joiner is connected before going offline
+      // can be short (converge one row, then stop) — a slow debounce is the
+      // difference between that joiner holding the collection headers and
+      // reading its own membership as empty after an offline restart.
+      //
+      // NOTE: 250 is reasoned, not swept — the delete-while-alone scenario's
+      // phases 1-3 finish in about a second, so the 1000 ms strand default left
+      // the push racing the joiner's stop, and 250 gives margin. Nobody measured
+      // the shape of the curve either side of it. If the control gates start
+      // flaking on a joiner that stopped before being caught up, lower this
+      // before looking anywhere else; if catch-up pushes start showing up as
+      // connection-churn noise, raise it.
+      debounceMs: 250,
+      ...this.config.controlBackfill
+    });
+    this.controlBackfill.start();
+  }
+
   /**
    * The control database's cache-wrapped raw storage, resolved from
    * `config.storage.provider` on first use and then held in {@link controlStorage}
@@ -1124,8 +1544,12 @@ export class CadreNode implements SAppIdLookup {
     if (!provider) {
       return undefined;
     }
-    const resolved = typeof provider === 'function' ? provider('control') : provider;
-    this.controlStorage = wrapStorageWithCache(resolved, 'control');
+    // Party-scoped, not the bare literal 'control': the control database holds THIS
+    // party's records, so two parties on one device must not land in one store.
+    // Same key as the cache label, which also makes the shared pool's `stats()` readable.
+    const scope = controlStorageScope(this.config.controlNetwork.partyId);
+    const resolved = typeof provider === 'function' ? provider(scope) : provider;
+    this.controlStorage = wrapStorageWithCache(resolved, scope);
     return this.controlStorage;
   }
 
@@ -1140,9 +1564,8 @@ export class CadreNode implements SAppIdLookup {
    * operator whose relay slot is decorative may genuinely want only the announced
    * address, so this reports and proceeds.
    *
-   * Keyed off the RESOLVED listen addrs rather than `relayAddrs` alone, so a
-   * hand-written `/p2p-circuit` entry in `listenAddrs` — the same reservation by the
-   * longer route — is caught too.
+   * Keyed off `relayAddrs` AND `listenAddrs`, so a hand-written `/p2p-circuit` entry
+   * in `listenAddrs` — a reservation by the longer route — is caught too.
    *
    * NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
    * diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
@@ -1154,9 +1577,13 @@ export class CadreNode implements SAppIdLookup {
     if (!replacesAdvertisedAddrs(network)) {
       return;
     }
-    const listensOnCircuit = (resolveListenAddrs(network) ?? [])
-      .some((addr) => addr.includes('/p2p-circuit'));
-    if (!listensOnCircuit) {
+    // Read off the raw config, not the resolved listen set: the question is only
+    // "does this config name a relay", and the resolution throws on a hand-written
+    // `<relay>/p2p-circuit` listen entry — which still warrants this warning, and
+    // gets its own refusal a few lines later in `buildControlNodeOptions`.
+    const namesRelay = (network?.relayAddrs?.length ?? 0) > 0
+      || (network?.listenAddrs ?? []).some((addr) => addr.includes('/p2p-circuit'));
+    if (!namesRelay) {
       return;
     }
     console.warn(
@@ -1179,11 +1606,16 @@ export class CadreNode implements SAppIdLookup {
   private buildControlNodeOptions(): Parameters<typeof createLibp2pNode>[0] {
     const { controlNetwork, network, profile } = this.config;
     const identityKey = this.identityKey;
-    // `'search'`: `network.relayAddrs` contributes the bare `/p2p-circuit` SEARCH
-    // entry, which opens no connection — the reservation is driven explicitly at
-    // the END of `start()`, so the control database is built while this node holds
-    // zero control connections. See `relay-addrs.ts` and `start()`.
-    const listenAddrs = resolveListenAddrs(network, 'search');
+    // `network.relayAddrs` contributes the bare `/p2p-circuit` SEARCH entry, which
+    // opens no connection — the reservation is driven explicitly at the END of
+    // `start()`, so the control database is built while this node holds zero
+    // control connections. See `relay-addrs.ts` and `start()`.
+    const listenAddrs = resolveListenAddrs(network);
+    // The transports those listen entries imply. A `/ws` entry switches db-p2p's
+    // WebSocket transport on (without it the entry binds nothing and libp2p reports
+    // nothing); anything outside {tcp, ws/wss, p2p-circuit} throws here rather than
+    // being silently dropped at bring-up. See `relay-addrs.ts`.
+    const transportOptions = resolveTransportOptions(network, listenAddrs);
 
     const enableRelay = this.relayServerEnabled();
 
@@ -1194,7 +1626,7 @@ export class CadreNode implements SAppIdLookup {
     const nodeOptions: Parameters<typeof createLibp2pNode>[0] = {
       port: 0,
       bootstrapNodes: controlNetwork.bootstrapNodes,
-      networkName: `control-${controlNetwork.partyId}`,
+      networkName: this.controlNetworkName(),
       storage: controlStorageProvider,
       fretProfile: profile === 'storage' ? 'core' : 'edge',
       relay: enableRelay,
@@ -1205,10 +1637,22 @@ export class CadreNode implements SAppIdLookup {
       // CONTROL_CLUSTER_POLICY: only the admission gate defaults to 2, while the read-repair
       // corroboration floor would otherwise fall back to this clusterSize of 16.
       clusterSize: CONTROL_REPLICATION_BREADTH,
-      clusterPolicy: CONTROL_CLUSTER_POLICY,
+      // The base control policy with the block-repair corroboration yardstick declared
+      // from the machines this party had enrolled at this node's last look
+      // ({@link declaredEnrolledMachines}, read in start() before this runs). Handed
+      // `undefined` — a brand-new node, an unreadable record, or an embedder that
+      // injected no store — this returns the frozen CONTROL_CLUSTER_POLICY object
+      // itself, so the unknown case is provably byte-for-byte the old behaviour.
+      // The yardstick moves ALONE: `assumedClusterSize` stays pinned at 2, because a
+      // party of phones cannot promise three quarters of its machines are awake.
+      clusterPolicy: controlClusterPolicy(this.declaredEnrolledMachines),
       arachnode: { enableRingZulu: profile === 'storage' },
       ...(identityKey && { privateKey: identityKey }),
       ...(network?.transports && { transports: network.transports }),
+      // `{ wsPort }` when a listen entry names WebSocket, otherwise `{}` — and always
+      // `{}` when `network.transports` is set, since the embedder owns transport policy
+      // then. Spread NEXT to `transports` because the two answer the same question.
+      ...transportOptions,
       // Configured `listenAddrs`, plus the bare `/p2p-circuit` search listener when
       // `network.relayAddrs` is set — that listener registers the pending reservation
       // `driveControlRelayReservation` fills after bring-up.
@@ -1554,6 +1998,68 @@ export class CadreNode implements SAppIdLookup {
       const members = await this.listAuthorizedMembers(false);
       this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
       log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
+      // Remember the party's size for the NEXT launch's control-node repair yardstick
+      // (see `enrolled-machine-store.ts`): this is the only place the count is known,
+      // and the control node that needs it was built long before this ran. Recorded
+      // from the snapshot just materialized — no second membership query.
+      //
+      // CONTROL-NETWORK ONLY, and that scope is load-bearing. Every enrolled machine
+      // runs the control node by construction, so here the party's machine count IS
+      // the count of machines serving the network — the quantity
+      // `resolveRepairYardstick` asks for. It is NOT that quantity for a strand, which
+      // launches only on machines whose embedder registered its sApp config (see
+      // {@link addStrand}), so this number must never be routed to a strand node:
+      // over-declaring pins Optimystic's repair corroboration floor at two peers and a
+      // strand that can field only one can then never repair. `launchStrand` therefore
+      // declares nothing; see the NOTE there.
+      //
+      // `+ 1` for this node, which is not in its own authorized set. An EMPTY snapshot
+      // is recorded as 1 rather than skipped. That is deliberate, and the reason
+      // is a party that genuinely SHRANK: if empty meant "record nothing", a party
+      // whose other machines were all revoked would keep declaring its old, larger
+      // number forever, and over-declaring is the unsafe direction — at a yardstick of
+      // 3 or more Optimystic pins the repair corroboration floor at two peers, so a
+      // cohort that can only field one peer could never repair at all. Recording 1
+      // lets the number come back down; the floor then turns it into 2, which is
+      // exactly what declaring nothing resolves to.
+      //
+      // NOTE: the cost of that choice is that a TRANSIENT empty read overwrites a good
+      // remembered count with 1 — a membership snapshot is legitimately empty early in
+      // a run on a node whose rows have not replicated yet or whose trusted-owner
+      // anchor is still unseeded (`listAuthorizedMembers` authorizes no one without an
+      // anchor). Bounded and safe: the next refresh once rows land re-records the real
+      // count, and the only node that loses anything is one stopped inside that window,
+      // which then declares 2 — today's behaviour — on its next launch. If a node ever
+      // needs to declare the right number on its FIRST post-restart launch, the fix is
+      // to distinguish "no rows yet" from "no members" at this site, not to skip empty.
+      //
+      // A removed peer stops counting at REVOCATION, not at reap: `queryCadrePeers`
+      // drops rows whose `StampId` is retired, and `listAuthorizedMembers` reads
+      // through it. That is why there is no reap hook writing this record.
+      //
+      // `void`: the store never rejects and logs its own persist failures, and this
+      // method's contract is never-rejects. A failed write leaves the in-memory count
+      // correct for this session and re-lands on the next refresh.
+      void this.enrolledMachineStore?.record(this.authorizedControlPeers.size + 1);
+      // Membership moved: give the control backfill another look at every
+      // connected peer. The production join order is connect-then-authorize, so
+      // a joiner's first catch-up pass was denied at the gate while its
+      // connection stays up — without this re-arm it would wait for a
+      // reconnect. Cheap and idempotent: caught-up peers are skipped before any
+      // timer is set, a peer whose pass is in flight is deferred to the end of
+      // that pass (the pass may already be past its gate check — this very
+      // commit is what would authorize it), and the gate re-judges at push time.
+      //
+      // NOTE: every refresh re-arms every connected peer that is not yet caught
+      // up, and each re-armed pass costs one `CadrePeer` query at the gate. A
+      // connection that is admitted but never authorized — a configured
+      // bootstrap or relay peer, the steady state for a NAT'd node — is
+      // therefore re-judged on every membership write and every timed reconcile
+      // tick, forever. Negligible at a cadre's handful of connections; if a node
+      // ever holds many such connections, or refreshes get frequent, skip
+      // re-arming peers whose last pass was denied under the SAME membership
+      // snapshot instead of re-arming unconditionally.
+      this.controlBackfill?.scheduleConnectedPeers();
     } catch (error) {
       log('refreshAuthorizedControlPeers(%s) failed — keeping previous snapshot: %o', reason, error);
     }
@@ -1701,6 +2207,7 @@ export class CadreNode implements SAppIdLookup {
       const record = this.signSelfRecord(peerId, signingKey, addrs, null);
       if (await this.seedBootstrapService.insertSelfPeerRecord(record)) {
         if (this.committedAlone()) this.pendingSelfPeerWrite = true;
+        this.noteSelfRecordPublished();
         log('registerSelf: inserted own CadrePeer record (owner-signed, updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
         return 'inserted';
       }
@@ -1738,10 +2245,89 @@ export class CadreNode implements SAppIdLookup {
     const record = this.signSelfRecord(peerId, signingKey, addrs, current);
     await this.controlDatabase.updateSelfPeerRecord(record);
     if (this.committedAlone()) this.pendingSelfPeerWrite = true;
+    this.noteSelfRecordPublished();
     log('registerSelf: refreshed own CadrePeer record (updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
     return 'refreshed';
   }
 
+  /**
+   * Record that this node's own address record just landed, and re-arm the stale-record
+   * warning. Called from BOTH publishing paths of {@link publishSelfRecord} and nowhere
+   * else — a `skipped` publish wrote nothing, so it must not refresh the stamp.
+   */
+  private noteSelfRecordPublished(): void {
+    this.lastSelfRecordPublishAt = Date.now();
+    this.selfRecordStaleWarned = false;
+  }
+
+  /**
+   * Report an abandoned control write to the embedding app.
+   *
+   * Every control write funnels through `ControlDatabase.lockedWithRetry`, which now tells
+   * this node when it gives one up. Foreground writes ALSO reject to their caller; the
+   * background ones ({@link startRecordRefresh}'s republish and the two replication
+   * drains) are fired unawaited with a `debug`-only catch, so this event is the only thing
+   * that reaches an app at all.
+   *
+   * Reporting only — the one operator-visible escalation lives on the republish path
+   * ({@link escalateIfSelfRecordStale}), where the consequence is measurable.
+   */
+  private noteControlWriteAbandoned(abandonment: ControlRetryAbandonment): void {
+    log('Control write abandoned [%s] after %d/%d attempt(s) in %dms (%s): %o',
+      abandonment.label ?? 'unlabelled', abandonment.attemptsMade, abandonment.attemptsAllowed,
+      abandonment.elapsedMs, abandonment.reason, abandonment.error);
+    this.emit('control:write-abandoned', abandonment);
+  }
+
+  /**
+   * Escalate ONE failed self-address republish to the operator — once — when the node has
+   * not published its own record for longer than a record stays fresh.
+   *
+   * The bar is the CONSEQUENCE, not a failure count: a resolver discards a `CadrePeer`
+   * record older than {@link DEFAULT_PEER_RECORD_MAX_AGE_MS} (15 minutes) and the heartbeat
+   * re-stamps at half that, so by the time this gap opens every other machine in the party
+   * has already stopped accepting this node's address. A count would fire far too early —
+   * one failed heartbeat is already half the budget, and a single miss costs nothing.
+   *
+   * Say-once, re-armed by the next successful publish ({@link noteSelfRecordPublished}), so
+   * a node that stays broken warns once rather than every 7.5 minutes.
+   *
+   * A node that has never published in this session is skipped: it has no record out there
+   * to go stale, and the reason it has none (not a member yet, no signing key, revoked) is
+   * already logged by `registerSelf` itself.
+   *
+   * Only a FAILED republish is checked. A heartbeat whose publish reports `skipped` neither
+   * stamps nor warns, so a node that stops being able to publish without erroring — revoked,
+   * or its row removed — goes quiet here. That is the intended reading: a revoked node has
+   * nothing to publish and its unreachability is the point, not a fault to report.
+   *
+   * NOTE: the second `console.*` in this library, and the reason
+   * {@link warnIfAnnounceAddrsDiscardRelay}'s note says a third should not simply be added:
+   * both are operator warnings about a configuration/health condition an embedder cannot
+   * see otherwise, and both have an event beside them (`control:write-abandoned` carries
+   * the underlying write failure). A third such condition should surface through
+   * {@link CadreNodeEvents} alone unless it likewise degrades the whole party in silence.
+   */
+  private escalateIfSelfRecordStale(reason: string, error: unknown): void {
+    const publishedAt = this.lastSelfRecordPublishAt;
+    if (publishedAt === null || this.selfRecordStaleWarned) {
+      return;
+    }
+    const staleForMs = Date.now() - publishedAt;
+    if (staleForMs < DEFAULT_PEER_RECORD_MAX_AGE_MS) {
+      return;
+    }
+    this.selfRecordStaleWarned = true;
+    console.warn(
+      `[sereus] this machine has not published its own address record for ${Math.round(staleForMs / 60_000)} `
+      + `minutes. The latest attempt (${reason}) failed with: `
+      + `${error instanceof Error ? error.message : String(error)}. `
+      + 'Other machines in the party discard an address record older than '
+      + `${Math.round(DEFAULT_PEER_RECORD_MAX_AGE_MS / 60_000)} minutes, so any of them not already `
+      + 'connected to this one can no longer reach it. Publishing keeps retrying; this is reported once.'
+    );
+  }
+
   /**
    * Sign this node's address record for publication, stamped strictly later than
    * `existing` (the row it is about to replace, or null for a first insert) so a
@@ -1787,6 +2373,30 @@ export class CadreNode implements SAppIdLookup {
     return null;
   }
 
+  /**
+   * Does the `Strand` row name THIS machine as its founder — i.e. is its
+   * `FounderOwnerKey` this node's own owner key (the key behind its PeerId)?
+   * A null/absent column (a consent-seated strand, or a hand-built row) and a
+   * node with no owner key both derive `false`: without a positive match this
+   * machine must attach, never bootstrap. Pure key derivation, no I/O — cheap
+   * enough for {@link launchStrand}'s tracked-instance early return.
+   *
+   * NOTE: reads "one owner key per machine" — the reference model, where the owner
+   * key IS the key behind the PeerId. Two machines running the SAME identity key
+   * would both derive `true` and each bootstrap on its own replica, which is the
+   * double-`Header` hazard this derivation exists to avoid. Unreachable today: that
+   * configuration also gives both machines one PeerId, which already breaks control
+   * networking well before any strand launches. Revisit if machines ever share an
+   * owner key while holding distinct transport identities — the derivation would
+   * then need a per-machine discriminator (the `CadrePeer` PeerId) on the row.
+   */
+  private isSelfFoundedRow(strand: StrandRow): boolean {
+    if (strand.FounderOwnerKey == null) {
+      return false;
+    }
+    return strand.FounderOwnerKey === this.getSelfSigningKey()?.publicKeyB64;
+  }
+
   /**
    * The owner keypair (base64url Ed25519) derived from this node's resolved
    * identity key. In the single-key reference model the owner signing key is
@@ -1839,7 +2449,12 @@ export class CadreNode implements SAppIdLookup {
     }
 
     const republish = (reason: string) => {
-      void this.registerSelf().catch((error) => log('Record refresh (%s) failed: %o', reason, error));
+      void this.registerSelf().catch((error) => {
+        log('Record refresh (%s) failed: %o', reason, error);
+        // The only failure in this file that degrades the whole party on its own, so it is
+        // the only one that escalates past `debug`. See escalateIfSelfRecordStale.
+        this.escalateIfSelfRecordStale(reason, error);
+      });
     };
     const reconcile = (reason: string) => {
       void this.reconcileControlCohort().catch((error) =>
@@ -1860,7 +2475,10 @@ export class CadreNode implements SAppIdLookup {
     // `CadrePeer` row, so its boot-time publish does nothing, and the two triggers
     // wired here are the only ones after that: `self:peer:update` needs an ADDRESS
     // CHANGE, and a relay-only node's addresses stop changing the moment its
-    // reservation lands — inside `start()`, before this listener exists. Harmless
+    // reservation lands — inside `start()`, before this listener exists (on the
+    // `network.requireRelay: false` posture the reservation may instead land LATER,
+    // from the retry supervisor, and then this listener is what publishes the
+    // `/p2p-circuit` address the boot-time publish could not carry). Harmless
     // where a late-authorized node's addresses keep churning (NAT/relay rotation
     // fire the event anyway), and invisible while parties authorize members before
     // they boot. If late enrollment becomes the normal path — an invited phone is
@@ -1927,10 +2545,16 @@ export class CadreNode implements SAppIdLookup {
     this.hasControlConnection = false;
     this.reconstructedLocalOnlyWrites = false;
     this.reissuedHeldRevocations = false;
+    this.revocationLedgerOpened = false;
     this.pendingPeerWrites.clear();
     this.pendingRevocations.clear();
     this.pendingSelfPeerWrite = false;
     this.pendingSelfDeviceWrite = false;
+    // Self-record publication history is per-session too: a restarted node re-publishes
+    // from scratch, and carrying the previous lifetime's stamp forward would either
+    // suppress the stale-record warning or fire it on a node that just came up.
+    this.lastSelfRecordPublishAt = null;
+    this.selfRecordStaleWarned = false;
   }
 
   /**
@@ -2028,7 +2652,7 @@ export class CadreNode implements SAppIdLookup {
    * Applied by ALL THREE sources of control-dial candidates, so no call site
    * invents its own rule and none can produce a mixed list: the signed record
    * ({@link resolvePeerAddrs}), the libp2p address book
-   * ({@link peerStoreAddrs}), and a seed's retained owner addresses
+   * ({@link peerStoreAddrs}), and a retained out-of-band dial target
    * ({@link bootstrapDialAddrs}).
    *
    * An address naming a DIFFERENT trailing peer id is dropped: it does not reach
@@ -2055,20 +2679,25 @@ export class CadreNode implements SAppIdLookup {
    * One address bound to `peerId`, or `null` when it cannot be — logged either
    * way, never thrown, so every caller's list-shaping stays total.
    *
+   * Used both to normalize addresses this node DIALS (a `CadrePeer` row, a
+   * retained bootstrap addr) and to normalize the ones it ANNOUNCES
+   * ({@link getStrandMultiaddrs}); the rule is the same either way — an address
+   * that does not reach `peerId` is not an address for `peerId`.
+   *
    * `withTrailingPeerId` encapsulates `/p2p/<peerId>`, which throws on a peer id
    * that does not parse. Unreachable for a `CadrePeer` row (the binding gate
-   * above parsed it already), reachable for a seed-supplied one
-   * ({@link bootstrapDialAddrs}).
+   * above parsed it already) and for our own node's id, reachable for a
+   * retained one ({@link bootstrapDialAddrs}).
    */
   private bindAddrToPeer(addr: Multiaddr, peerId: string): Multiaddr | null {
     try {
       const bound = withTrailingPeerId(addr, peerId);
       if (!bound) {
-        log('normalizeDialAddrs: dropping addr %s — it names a peer other than %s', addr.toString(), peerId);
+        log('bindAddrToPeer: dropping addr %s — it names a peer other than %s', addr.toString(), peerId);
       }
       return bound;
     } catch (error) {
-      log('normalizeDialAddrs: cannot bind %s to %s: %o', addr.toString(), peerId, error);
+      log('bindAddrToPeer: cannot bind %s to %s: %o', addr.toString(), peerId, error);
       return null;
     }
   }
@@ -2109,29 +2738,35 @@ export class CadreNode implements SAppIdLookup {
    * `self:peer:update` (all wired in {@link startRecordRefresh}).
    *
    * Concurrent triggers collapse into a single in-flight pass
-   * (see {@link reconcileControlCohortInFlight}) so two passes never double-dial.
+   * (see {@link reconcileControlCohortInFlight}) so two passes never double-dial;
+   * a call that joins an in-flight pass resolves to THAT pass's result.
    * Best-effort throughout: a failure to resolve/dial any one sibling is logged
    * and the pass continues; the whole pass is a no-op when the node is alone.
+   *
+   * Resolves to the peers the pass dialled ({@link ControlCohortReconcileResult}),
+   * so a caller can tell a link this pass opened from one something else opened —
+   * the pass skips a peer that is already connected. The timer and event triggers
+   * discard it.
    */
-  async reconcileControlCohort(): Promise<void> {
+  async reconcileControlCohort(): Promise<ControlCohortReconcileResult> {
     if (this.reconcileControlCohortInFlight) {
       return this.reconcileControlCohortInFlight;
     }
     const op = this.runReconcileControlCohort();
     this.reconcileControlCohortInFlight = op;
     try {
-      await op;
+      return await op;
     } finally {
       this.reconcileControlCohortInFlight = null;
     }
   }
 
   /** Body of {@link reconcileControlCohort}; serialised by its single-flight guard. */
-  private async runReconcileControlCohort(): Promise<void> {
+  private async runReconcileControlCohort(): Promise<ControlCohortReconcileResult> {
     // Shutdown / not-yet-started guard (mirrors publishSelfRecord). A pass that
     // fires after stop() began must early-return rather than touch a torn-down node.
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return;
+      return { dialed: [] };
     }
     // Ride this pass's cadence to refresh the per-stream gate's materialized
     // authorized set — membership changes that ARRIVED BY REPLICATION (rather
@@ -2141,11 +2776,15 @@ export class CadreNode implements SAppIdLookup {
     // CadrePeer query (two reads per pass), plus a third from
     // `refreshStrandPeerAddrs` on the passes where a strand is due AND this node
     // holds a control connection (one read for the whole pass, not one per
-    // strand); if those reads ever get costly, share one row-set across all
-    // three.
+    // strand). Each also reads Revocation first. Before the Revocation ledger
+    // marker exists (filed below, once connected) that block is missing, so every
+    // one of those reads consults the cohort about it; once the marker exists every
+    // block they touch is held and none of them does (both states pinned in
+    // control-founding-consult-budget.spec.ts). If those reads ever get costly,
+    // share one row-set across all three.
     await this.refreshMembershipGate('reconcile');
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return;
+      return { dialed: [] };
     }
     // Refresh relay delegate grants BEFORE the sibling enumeration below: a
     // solo cadre with a party relay has no siblings to dial but must still keep
@@ -2153,7 +2792,7 @@ export class CadreNode implements SAppIdLookup {
     // the reservation and faces the connection gate again).
     await this.refreshDelegateGrants();
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return;
+      return { dialed: [] };
     }
     // Then re-warm each running strand's own address book from its siblings, on
     // its own (much longer) throttle. Same reasoning as warmSiblingAddrBook
@@ -2161,7 +2800,7 @@ export class CadreNode implements SAppIdLookup {
     // layer under cadre-core dials strand peers by bare peer id.
     await this.refreshStrandPeerAddrs();
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return;
+      return { dialed: [] };
     }
     const selfPeerId = this.controlNode.peerId.toString();
 
@@ -2203,7 +2842,28 @@ export class CadreNode implements SAppIdLookup {
         log('reconcileControlCohort: reap pass failed (continuing): %o', error);
       }
       if (!this._running || !this.controlNode || !this.controlDatabase) {
-        return;
+        return { dialed: [] };
+      }
+
+      // File the Revocation ledger marker once, so that table stops being a never-written
+      // block, which the storage layer re-checks with the cohort on every read (and every
+      // membership lookup and guarded insert reads it). Connected-only for the reap's
+      // reason above: a marker committed alone is local-only, and one filed by a
+      // disconnected owner while another machine creates the same collection is exactly
+      // that fork. Owner-only, and at most once per process — see openRevocationLedgerIfDue.
+      //
+      // NOTE: accepted tradeoff — a solo founder does not file the marker until it holds a
+      // control connection (normally its first sibling; a relay or bootstrap connection also
+      // counts — see getControlConnectionCount — and is the reap's same residual), so until
+      // then it keeps paying one local findCluster per read of
+      // the missing Revocation block (0.009 ms each, measured upstream; no network work on
+      // a cohort of one). Fork safety weighed over that and kept; revisit if findCluster
+      // ever shows up as material in a device profile, or if a solo-founding marker can be
+      // made fork-safe (e.g. filed inside the genesis transaction, before any other machine
+      // can hold the party's collections).
+      await this.openRevocationLedgerIfDue();
+      if (!this._running || !this.controlNode || !this.controlDatabase) {
+        return { dialed: [] };
       }
     }
 
@@ -2218,12 +2878,11 @@ export class CadreNode implements SAppIdLookup {
       // because filling this table needs a connection and getting a connection
       // needs this table. Fall back to the seed's bootstrap addresses; a solo
       // cadre has none and this is a no-op. Must not throw or busy-loop.
-      await this.dialColdStartBootstrap();
-      return;
+      return { dialed: await this.dialColdStartBootstrap() };
     }
     // Re-guard after the await: a stop() may have raced the membership read.
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return;
+      return { dialed: [] };
     }
 
     // 2. Classify backbone (owner) members and select a bounded dial set.
@@ -2234,7 +2893,7 @@ export class CadreNode implements SAppIdLookup {
     // the anchor if owner status here ever gates something trusted.
     const ownerKeys = await this.controlDatabase.getOwnerKeys();
     if (!this._running || !this.controlNode) {
-      return;
+      return { dialed: [] };
     }
     const targetDegree = this.config.network?.controlCohort?.targetDegree
       ?? DEFAULT_CONTROL_COHORT_TARGET_DEGREE;
@@ -2249,7 +2908,7 @@ export class CadreNode implements SAppIdLookup {
     //    keeping what resolved for the dial loop below.
     const resolved = await this.warmSiblingAddrBook(siblings);
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return;
+      return { dialed: [] };
     }
 
     // 4. Skip already-connected peers (no re-dial / churn for live connections).
@@ -2257,20 +2916,46 @@ export class CadreNode implements SAppIdLookup {
 
     // 5. Dial each selected, not-yet-connected sibling, best-effort, from the
     //    addresses step 3 already resolved for it.
-    let dialed = 0;
+    const dialed: string[] = [];
     for (const sibling of dials) {
       if (!this._running || !this.controlNode) {
-        return;
+        return { dialed };
       }
       if (connected.has(sibling.peerId)) {
         continue;
       }
       if (await this.dialControlSibling(sibling, resolved.get(sibling.peerId) ?? [])) {
-        dialed++;
+        dialed.push(sibling.peerId);
       }
     }
     log('reconcileControlCohort: pass complete (siblings=%d, selected=%d, dialed=%d)',
-      siblings.length, dials.length, dialed);
+      siblings.length, dials.length, dialed.length);
+    return { dialed };
+  }
+
+  /**
+   * The owner-only half of the reconcile pass's ledger-marker step: file the singleton
+   * `Revocation` marker ({@link SeedBootstrapService.openRevocationLedger}) unless this
+   * process has already seen it filed. The connectivity gate is the caller's
+   * ({@link runReconcileControlCohort}); why the marker exists is on
+   * {@link ControlDatabase.openRevocationLedger}.
+   *
+   * Sets {@link revocationLedgerOpened} on `'opened'` or `'already-open'`. A node that
+   * cannot sign as an owner does nothing: it picks the owner's marker up the first time it
+   * reads the table, like any other replicated row. Best-effort like every step of the
+   * pass — a failure is logged and leaves the flag clear, so the next connected pass retries.
+   */
+  private async openRevocationLedgerIfDue(): Promise<void> {
+    if (this.revocationLedgerOpened || !this.seedBootstrapService?.canAuthorize()) {
+      return;
+    }
+    try {
+      const outcome = await this.seedBootstrapService.openRevocationLedger();
+      this.revocationLedgerOpened = true;
+      log('reconcileControlCohort: revocation ledger marker %s', outcome);
+    } catch (error) {
+      log('reconcileControlCohort: filing the revocation ledger marker failed (retrying next pass): %o', error);
+    }
   }
 
   /**
@@ -2292,6 +2977,9 @@ export class CadreNode implements SAppIdLookup {
    * resolves to nothing (revoked, stale, untrusted) is not written at all, so its
    * existing entry ages out on its own.
    *
+   * The same resolution also keeps a sibling's retained out-of-band dial target
+   * current ({@link refreshDialHint}).
+   *
    * NOTE: this resolves EVERY sibling serially before the dial loop below runs,
    * so it costs one record query per sibling per reconcile pass (~15s) and each
    * one delays the pass's first dial. A cadre is a handful of devices, so today
@@ -2301,6 +2989,9 @@ export class CadreNode implements SAppIdLookup {
   private async warmSiblingAddrBook(siblings: CohortPeerRow[]): Promise<Map<string, Multiaddr[]>> {
     const resolved = new Map<string, Multiaddr[]>();
     const counts: Record<MergeAddrsResult, number> = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
+    // One copy of the store's map for the whole loop; a refresh replaces an entry
+    // rather than mutating it, so the copy stays a consistent "before" view.
+    const hints = this.bootstrapPeerStore?.all();
     for (const sibling of siblings) {
       if (!this._running || !this.controlNode) {
         break;
@@ -2313,6 +3004,7 @@ export class CadreNode implements SAppIdLookup {
       if (!this._running || !controlNode) {
         break;
       }
+      this.refreshDialHint(sibling.peerId, addrs, hints?.get(sibling.peerId)?.addrs);
       // `mergePeerAddrs` owns the whole best-effort contract — including parsing
       // a malformed `CadrePeer.PeerId` — so one bad row cannot abort the pass.
       counts[await mergePeerAddrs(controlNode, sibling.peerId, addrs)]++;
@@ -2322,6 +3014,41 @@ export class CadreNode implements SAppIdLookup {
     return resolved;
   }
 
+  /**
+   * Replace a sibling's retained out-of-band dial target (see
+   * {@link bootstrapPeerStore}) with the addresses its signed record just resolved
+   * to, when the two differ — so an address change this node saw while the record
+   * was fresh (a new port, a new LAN address) is what it dials after a relaunch
+   * that outlives the record's freshness window.
+   *
+   * Only a sibling that already HAS an entry (`retained`) is refreshed: the store
+   * holds peers learned out of band and must not grow into a copy of every
+   * sibling's addresses. An empty resolution leaves the entry alone — a stale or
+   * not-yet-signed record is exactly when the entry is needed. The comparison is
+   * order-insensitive and runs on the retained addresses after binding them to the
+   * peer id, so an entry recorded without `/p2p/` suffixes is not rewritten merely
+   * for lacking them.
+   *
+   * NOTE: replaces rather than merges, so the entry becomes exactly what the
+   * sibling announces. If a node's signed record ever lists fewer addresses this
+   * node can reach than it was added with (say an announce override naming only a
+   * public address, for a node added by its LAN address), a relaunch dials the
+   * worse set; merge the two lists here if that shows up.
+   */
+  private refreshDialHint(peerId: string, resolved: Multiaddr[], retained: string[] | undefined): void {
+    if (!retained || resolved.length === 0) {
+      return;
+    }
+    // Both lists are de-duplicated by `normalizeDialAddrs`, so equal size plus
+    // containment is set equality.
+    const current = resolved.map((addr) => addr.toString());
+    const previous = new Set(this.bootstrapDialAddrs(peerId, retained).map((addr) => addr.toString()));
+    if (current.length === previous.size && current.every((addr) => previous.has(addr))) {
+      return;
+    }
+    this.retainDialTarget(peerId, current, 'refreshDialHint');
+  }
+
   /**
    * {@link resolvePeerAddrs} for one sibling, best-effort: a control-DB read
    * failure yields `[]` (and the cold-start fallback then gets its turn) rather
@@ -2337,26 +3064,32 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Budget for ONE proactive dial of the reconcile pass — steady-state sibling
+   * Time limits for dialing ONE control-network peer from its candidate
+   * addresses ({@link dialPeerAddrs}): the reconcile pass's steady-state sibling
    * ({@link dialControlSibling}) and cold-start bootstrap peer
-   * ({@link dialBootstrapPeer}) alike, since both feed a whole address list to
-   * one `dial()` and both run in a sequential loop that the next entry waits on.
+   * ({@link dialBootstrapPeer}) dials, and — handed to every
+   * {@link SeedBootstrapService} this node builds — `applySeed`'s owner dials and
+   * `dialInvite`.
    *
-   * See {@link DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS} for why the pass bounds
-   * this itself rather than inheriting each address's libp2p attempt timeout.
+   * See {@link DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS} for why a peer's dial is
+   * bounded as a whole, and {@link DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS}
+   * for why each address is bounded as well.
    */
-  private controlDialTimeoutMs(): number {
-    return this.config.network?.controlCohort?.dialTimeoutMs
-      ?? DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS;
+  private controlDialBudget(): PeerDialBudget {
+    const cohort = this.config.network?.controlCohort;
+    return {
+      perAddressMs: cohort?.perAddressDialTimeoutMs ?? DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS,
+      totalMs: cohort?.dialTimeoutMs ?? DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
+    };
   }
 
   /**
    * Dial one sibling from its already-resolved addresses, best-effort. Returns
-   * whether a dial was attempted (false when no address resolves).
+   * whether the dial resolved (false when no address resolves or the dial fails).
    *
    * A per-peer failure (NAT, offline, relay down, connection-gater denial, or
-   * the {@link controlDialTimeoutMs} budget expiring) is logged and swallowed so
-   * one unreachable sibling never aborts the pass — exactly like
+   * the {@link controlDialBudget} expiring) is logged and swallowed so one
+   * unreachable sibling never aborts the pass — exactly like
    * {@link SeedBootstrapService.applySeed}'s owner-dial loop. A failed dial is
    * simply retried on the next pass.
    */
@@ -2372,10 +3105,11 @@ export class CadreNode implements SAppIdLookup {
     }
     try {
       log('reconcileControlCohort: dialing sibling %s (%d addr(s))', sibling.peerId, addrs.length);
-      await withDeadline(
-        this.controlDialTimeoutMs(),
-        `reconcileControlCohort dial of sibling ${sibling.peerId}`,
-        (signal) => controlNode.dial(addrs, { signal })
+      await dialPeerAddrs(
+        controlNode,
+        addrs,
+        this.controlDialBudget(),
+        `reconcileControlCohort dial of sibling ${sibling.peerId}`
       );
       return true;
     } catch (error) {
@@ -2385,20 +3119,66 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * A sibling's control-network dial addresses for the reconcile pass.
+   * A sibling's control-network dial addresses for the reconcile pass, from the
+   * first of three sources that yields any:
+   *
+   *  1. the signed, fresh, trust-gated control addresses `resolved` for it by
+   *     {@link warmSiblingAddrBook} — passed in rather than re-resolved, so the
+   *     pass makes one record query per sibling;
+   *  2. the libp2p address book ({@link peerStoreAddrs}) — the entries `applySeed`
+   *     and identify put there, until they age out;
+   *  3. the sibling's retained out-of-band dial target ({@link retainedDialAddrs}).
+   *     For a node that cannot listen, this is the only source for a sibling it
+   *     added but has not yet connected to: the added node's row stays unsigned
+   *     until it self-publishes, which needs the connection this dial opens. It is
+   *     also what a relaunch that outlived the record's freshness window uses.
+   *
+   * Returns `[]` (never throws) when none yields an address — that sibling is
+   * skipped this pass.
    *
-   * Primary (steady state): the signed, fresh, trust-gated control addresses
-   * `resolved` for it by {@link warmSiblingAddrBook} — passed in rather than
-   * re-resolved, so the pass makes one record query per sibling. Fallback (cold
-   * start): the libp2p peerStore entries `applySeed` populated, used only while
-   * the record is not yet resolvable. Returns `[]` (never throws) when neither
-   * yields an address — that sibling is skipped this pass.
+   * The list may name transports this node cannot dial (a lent node reports TCP
+   * and `/ws` addresses to a phone that dials WebSockets only). That needs no
+   * filtering here: libp2p's dial queue (`calculateMultiaddrs`, libp2p 3.1.3)
+   * rejects an address no transport can dial before touching the network, so
+   * such an address costs a log line.
+   *
+   * The list is NOT handed to one `dial()`. libp2p tries a multi-address dial's
+   * addresses one after another under a single deadline, with no limit per
+   * address, and sorts loopback addresses last — so one or two addresses that
+   * never answer used up the whole deadline before the address that worked was
+   * tried. {@link dialPeerAddrs} dials each address on its own time limit instead.
    */
   private async resolveControlDialAddrs(peerId: string, resolved: Multiaddr[]): Promise<Multiaddr[]> {
     if (resolved.length > 0) {
       return resolved;
     }
-    return this.peerStoreAddrs(peerId);
+    const booked = await this.peerStoreAddrs(peerId);
+    if (booked.length > 0) {
+      return booked;
+    }
+    return this.retainedDialAddrs(peerId);
+  }
+
+  /**
+   * A sibling's retained out-of-band dial target (see {@link bootstrapPeerStore}),
+   * bound to its peer id through {@link bootstrapDialAddrs}; `[]` when it has none.
+   *
+   * These addresses are never merged into the libp2p address book: they are
+   * unverified, and the address book takes only verified ones (see
+   * `mergePeerAddrs`). Layers that dial by bare peer id use the connection this
+   * dial opens, and after it drops the next reconcile pass dials again.
+   *
+   * NOTE: an entry is consulted here only for a current sibling, so a peer revoked
+   * by another owner is not dialed from it, even though the entry stays (only this
+   * node's own {@link removePeer} forgets one). The cold-start branch
+   * ({@link dialColdStartBootstrap}) still dials every entry while there are no
+   * siblings at all; if entries for revoked peers ever cause dial churn there,
+   * prune entries whose peer has a retired `CadrePeer` row during the membership
+   * refresh.
+   */
+  private retainedDialAddrs(peerId: string): Multiaddr[] {
+    const entry = this.bootstrapPeerStore?.all().get(peerId);
+    return entry ? this.bootstrapDialAddrs(peerId, entry.addrs) : [];
   }
 
   /**
@@ -2450,39 +3230,57 @@ export class CadreNode implements SAppIdLookup {
    * signature-checked against a trust-anchored signer before this runs, and the
    * flag only *selects a dial target*; a dial grants no authority.
    *
-   * Self is excluded. `createSeed` projects EVERY `CadrePeer` row, so an owner
-   * that applies a seed minted after it joined finds itself in the owner list;
-   * retaining that would make the cold-start pass dial this node forever (the
-   * steady-state pass filters self out of its sibling list for the same reason).
+   * Addressless peers and self are skipped by {@link retainDialTarget}.
    */
   private recordSeedBootstrapPeers(seed: ControlNetworkSeed): void {
+    for (const peer of seed.peers) {
+      if (peer.isOwner) {
+        this.retainDialTarget(peer.peerId, peer.multiaddrs, 'recordSeedBootstrapPeers');
+      }
+    }
+  }
+
+  /**
+   * Retain (or replace) one peer's out-of-band dial target in
+   * {@link bootstrapPeerStore}. Shared by every writer: seed intake, {@link addDrone}
+   * and {@link refreshDialHint}.
+   *
+   * Fire-and-log: the entry is visible synchronously by the store's contract, and
+   * the promise tracks durability only. A persist failure costs restart survival,
+   * never this session's dial set — the same trade
+   * `SeedBootstrapService.anchorAcceptedSigner` makes — so it is logged rather than
+   * failing a seed or an add that has already been accepted.
+   *
+   * Two peers are never retained. One with no address: there is nothing to dial.
+   * And self: `createSeed` projects EVERY `CadrePeer` row, so an owner that applies
+   * a seed minted after it joined finds itself in the owner list, and `addDrone`
+   * could be handed this node's own id. Retaining self would make the cold-start
+   * pass dial this node forever (the steady-state pass filters self out of its
+   * sibling list for the same reason).
+   */
+  private retainDialTarget(peerId: string, addrs: readonly string[], caller: string): void {
     const store = this.bootstrapPeerStore;
     if (!store) {
       // Unreachable in production: start() builds the store before any network
-      // bring-up, and both intake paths need a started node (an uninitialized
-      // SeedBootstrapService rejects the seed, so noteAppliedSeed returns early).
-      log('recordSeedBootstrapPeers: no bootstrap-peer store yet; retaining nothing');
+      // bring-up, and every caller needs a started node (an uninitialized
+      // SeedBootstrapService rejects a seed or an add, and the reconcile pass
+      // needs a running one).
+      log('%s: no bootstrap-peer store yet; not retaining %s', caller, peerId);
       return;
     }
-    const selfPeerId = this.controlNode?.peerId.toString();
-    for (const peer of seed.peers) {
-      if (!peer.isOwner || peer.multiaddrs.length === 0 || peer.peerId === selfPeerId) {
-        continue;
-      }
-      // Sync-visible by contract; the promise tracks durability only. A persist
-      // failure costs restart survival, never this session's retry set — the same
-      // trade `SeedBootstrapService.anchorAcceptedSigner` makes — so log and carry
-      // on rather than failing the seed that was already accepted.
-      void store.record(peer.peerId, peer.multiaddrs).catch((error: unknown) => {
-        log('recordSeedBootstrapPeers: persisting bootstrap peer %s failed (retained in memory): %o',
-          peer.peerId, error);
-      });
+    if (addrs.length === 0 || peerId === this.controlNode?.peerId.toString()) {
+      return;
     }
+    void store.record(peerId, addrs).catch((error: unknown) => {
+      log('%s: persisting dial target %s failed (retained in memory): %o', caller, peerId, error);
+    });
   }
 
   /**
-   * Cold-start branch of the reconcile pass: re-dial the seed's owner peers
-   * while the control database still has no siblings to dial.
+   * Cold-start branch of the reconcile pass: re-dial every retained out-of-band
+   * dial target (see {@link bootstrapPeerStore}) — in practice the owner peers of
+   * the seeds this node applied — while the control database still has no
+   * siblings to dial.
    *
    * `SeedBootstrapService.applySeed` dials those owners exactly ONCE, best-effort.
    * When that single dial fails — owner momentarily down, relay reservation not
@@ -2503,20 +3301,20 @@ export class CadreNode implements SAppIdLookup {
    * Best-effort per peer, exactly like {@link dialControlSibling}: one dead
    * address never aborts the pass.
    */
-  private async dialColdStartBootstrap(): Promise<void> {
+  private async dialColdStartBootstrap(): Promise<string[]> {
     const controlNode = this.controlNode;
     // Snapshot up front: the store hands back a copy, so a seed applied mid-pass
     // cannot mutate what we are iterating.
     const targets = this.bootstrapPeerStore?.all();
     if (!controlNode || !targets || targets.size === 0) {
-      return;
+      return [];
     }
     // Same skip rule as step 3 of the steady-state pass: no churn on live links.
     const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
-    let dialed = 0;
+    const dialed: string[] = [];
     for (const [peerId, entry] of targets) {
       if (!this._running || !this.controlNode) {
-        return;
+        return dialed;
       }
       // NOTE: a connection this node still holds in `status: 'open'` after the remote
       // has already aborted it counts as connected here, so the cold-start retry stays
@@ -2529,21 +3327,23 @@ export class CadreNode implements SAppIdLookup {
         continue;
       }
       if (await this.dialBootstrapPeer(peerId, entry.addrs)) {
-        dialed++;
+        dialed.push(peerId);
       }
     }
     log('reconcileControlCohort: cold-start pass complete (bootstrap=%d, connected=%d, dialed=%d)',
-      targets.size, connected.size, dialed);
+      targets.size, connected.size, dialed.length);
+    return dialed;
   }
 
   /**
-   * Bind a bootstrap peer's seed addresses to its peer id, so the dial
-   * authenticates the peer it is aiming at rather than trusting whoever answers.
+   * Bind a retained dial target's addresses (see {@link bootstrapPeerStore}) to
+   * its peer id, so the dial authenticates the peer it is aiming at rather than
+   * trusting whoever answers.
    *
    * The same {@link normalizeDialAddrs} rule the resolved and address-book paths
    * use, on the third and last source of control-dial candidates: an address that
    * already terminates in `/p2p/<id>` must carry THIS peer's id or it is dropped
-   * (a seed that disagrees with itself is not a dial target); one that does not —
+   * (an entry that disagrees with itself is not a dial target); one that does not —
    * a bare listen addr, or a relay hop with the destination missing — gets the id
    * encapsulated; an unencapsulatable one is dropped rather than dialed bare.
    */
@@ -2564,10 +3364,11 @@ export class CadreNode implements SAppIdLookup {
     }
     try {
       log('reconcileControlCohort(cold-start): dialing bootstrap peer %s (%d addr(s))', peerId, parsed.length);
-      await withDeadline(
-        this.controlDialTimeoutMs(),
-        `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`,
-        (signal) => controlNode.dial(parsed, { signal })
+      await dialPeerAddrs(
+        controlNode,
+        parsed,
+        this.controlDialBudget(),
+        `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`
       );
       return true;
     } catch (error) {
@@ -3276,6 +4077,13 @@ export class CadreNode implements SAppIdLookup {
       // (register a config + addStrand); the strand-agnostic seam keeps this
       // class free of any app's join policy. A self-configured strand (config
       // already present) keeps auto-starting below, unchanged.
+      //
+      // Recorded BEFORE the emit so a handler that synchronously drains
+      // `getDiscoveredStrands()` sees this strand too. The watcher never offers
+      // the same strand twice (its `knownStrands` retains the id for the life of
+      // the process), so this map — not the event — is what a late subscriber
+      // reads. See the `strand:discovered` doc in types.ts.
+      this.discoveredStrands.set(strand.Id, strand);
       this.emit('strand:discovered', { strandId: strand.Id, strand });
       return;
     }
@@ -3396,8 +4204,10 @@ export class CadreNode implements SAppIdLookup {
     // Stop all strand instances
     await this.strandManager.stopAll();
 
-    // Clear sApp configs
+    // Clear sApp configs, recorded launch refusals and the unclaimed-strand backlog
     this.sAppConfigs.clear();
+    this.strandLaunchRefusals.clear();
+    this.discoveredStrands.clear();
 
     // Drop delegate-admission state: the grants are scoped to the session that
     // recorded them, so a stop()/start() cycle on this object must not keep
@@ -3406,12 +4216,22 @@ export class CadreNode implements SAppIdLookup {
     this.delegateAdmission.clear();
     this.delegateAnnounceAt.clear();
 
+    // Control backfill first — before the database closes and the control node
+    // stops — so no NEW catch-up push is issued against a torn-down transport.
+    // A push already in flight is not awaited; it fails into the module's own
+    // per-chunk catch. (Mirrors releaseRuntime in strand-instance-manager.ts.)
+    if (this.controlBackfill) {
+      this.controlBackfill.stop();
+      this.controlBackfill = null;
+    }
+
     // Close control database (this also shuts down the collection factory).
     // Detach the membership hub first: nothing this teardown does should drive a
     // gate refresh, and a notification arriving after this point is a no-op.
     if (this.controlDatabase) {
       this.controlDatabase.setMembershipChangeListener(null);
       this.controlDatabase.setGuardedDeleteListener(null);
+      this.controlDatabase.setControlWriteAbandonedListener(null);
       await this.controlDatabase.close();
       this.controlDatabase = null;
     }
@@ -3444,6 +4264,22 @@ export class CadreNode implements SAppIdLookup {
     this._running = false;
   }
 
+  /**
+   * A gated joiner's database was just published (`StartStrandConfig.onWritable`): the
+   * instance is `'active'` now, so re-arm its idle timer as any activity would. Nothing
+   * records activity on a gated joiner, so its idle timer may already have fired — the
+   * instance read `'idle'` with a hibernate timer pending — and without this the flip
+   * back to `'active'` would leave that timer to quiesce a strand the app just started
+   * using. Emits `strand:writable` after the timers are settled.
+   */
+  private handleStrandWritable(strandId: string): void {
+    const instance = this.strandManager.getInstance(strandId);
+    if (instance) {
+      this.hibernationManager.recordActivity(instance);
+    }
+    this.emit('strand:writable', { strandId });
+  }
+
   // Hibernation callbacks
   private async handleStrandIdle(strandId: string): Promise<void> {
     const instance = this.strandManager.getInstance(strandId);
@@ -3498,9 +4334,10 @@ export class CadreNode implements SAppIdLookup {
       return;
     }
 
-    // Still live (idle wake, or defensive double-wake): no rebuild needed.
+    // Still live (idle wake, or defensive double-wake): no rebuild needed. A joiner
+    // still behind its first-sync gate wakes back to `'syncing'`, not `'active'`.
     if (instance.libp2pNode || instance.database) {
-      instance.status = 'active';
+      instance.status = liveStrandStatus(instance);
       instance.lastActivity = new Date();
       log('Strand %s woke (already live)', strandId);
       this.emit('strand:waking', { strandId });
@@ -3519,8 +4356,8 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Rebuild a quiesced strand's runtime, re-resolving the volatile cohort input
    * first: the discovery seed may have grown since the strand last ran. Shared by
-   * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so
-   * both apply the same fresh seed resolution. `resumeStrand` is idempotent
+   * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so both
+   * apply the same fresh resolution. `resumeStrand` is idempotent
    * (returns the live instance unchanged) as a backstop against double-resume.
    */
   private async resumeStrandRuntime(strandId: string): Promise<void> {
@@ -3531,6 +4368,9 @@ export class CadreNode implements SAppIdLookup {
       ? peerIdFromPrivateKey(await strandTransportKey(this.identityKey, strandId)).toString()
       : undefined;
     const bootstrapNodes = await this.resolveCohortSeed(strandId, delegatePeerId);
+    // NOTE: no `servingMachines` override — see `launchStrand` for why a strand node
+    // declares no repair yardstick, and `StartStrandConfig.servingMachines` for the
+    // count that would legitimately go here once one exists.
     const instance = await this.strandManager.resumeStrand(strandId, { bootstrapNodes });
     // Same reason as the launch path: `bootstrapNodes` only reaches the address
     // book through @libp2p/bootstrap discovery, so merge it directly as well.
@@ -3622,7 +4462,7 @@ export class CadreNode implements SAppIdLookup {
 
     const sawActivity = instance.lastActivity !== activityMark;
     if (sawActivity) {
-      instance.status = 'active';
+      instance.status = liveStrandStatus(instance);
       this.emit('strand:waking', { strandId });
       log('Wake window: strand %s saw activity during the window; staying active', strandId);
       return true;
@@ -3672,29 +4512,90 @@ export class CadreNode implements SAppIdLookup {
    * Add a strand with its sApp configuration.
    * The hosting application must provide the sApp schema when creating a strand.
    *
+   * This is the ATTACH half only — it starts the local instance and never publishes the
+   * `Strand` row. A joiner (the row arrived over the control network) wants exactly this; a
+   * FOUNDER wants {@link foundStrand}, which publishes and attaches in one resumable call.
+   * With no explicit `founder` flag, founder-ness is derived from the row's
+   * `FounderOwnerKey` (see {@link StrandConfig.founder}) — so attaching a row THIS machine
+   * published (e.g. re-attaching its own orphan after a restart) founds it, and attaching
+   * anyone else's row joins, without the caller needing to know which it is.
+   *
    * A rejected call leaves nothing running but DOES leave the sApp config
    * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
-   * automatic relaunch need it. So once the strand's row is visible on the control
-   * network (via {@link publishStrand} or another member), a failed launch keeps
-   * being re-attempted in the background — each failure re-emitting `strand:error`
-   * — until it succeeds. {@link detachStrand} (reached via {@link stopStrand}) is
-   * what abandons a strand for good.
+   * automatic relaunch need it. That background relaunch covers only a strand the
+   * WATCHER launched: it forgets a row whose `onStrandAdded` threw and re-attempts it
+   * on a later poll (each failure re-emitting `strand:error`) until it succeeds. A
+   * strand claimed here after it was DISCOVERED gets no such retry — the watcher
+   * already recorded it in its `knownStrands` when it offered it as
+   * `strand:discovered`, and no later poll re-offers a strand it knows. This call has
+   * also already dropped it from {@link getDiscoveredStrands}, so a failed claim
+   * leaves the strand dormant until the caller retries or the node restarts (see
+   * `backlog/bug-discovered-strand-lost-when-claim-fails`).
+   * {@link detachStrand} (reached via {@link stopStrand}) is what abandons a strand
+   * for good.
    */
   async addStrand(config: StrandConfig): Promise<StrandInstance> {
     if (!this._running) {
       throw new Error('CadreNode not running');
     }
 
-    const { strandRow, sAppConfig, founder } = config;
+    const { strandRow, sAppConfig, founder, partyMemberPrivateKey } = config;
+    if (partyMemberPrivateKey !== undefined && strandRow.Type !== 'c') {
+      // Only a closed strand seats a Member/Manager, so an open launch would drop this
+      // key silently. Refuse instead: the caller has confused the party identity key
+      // with something an open strand uses, and a silent drop hides that.
+      throw new Error(
+        `addStrand(${strandRow.Id}): partyMemberPrivateKey belongs to a CLOSED strand ` +
+        `(Type 'c'), but this row is Type '${strandRow.Type}' — an open strand seats no ` +
+        'Member/Manager, so the key would be ignored.'
+      );
+    }
 
-    // Store sApp config for this strand
+    // Store sApp config for this strand. The strand is claimed now, so it leaves the
+    // unclaimed backlog — a later `getDiscoveredStrands()` drain must not re-offer it.
     this.sAppConfigs.set(strandRow.Id, sAppConfig);
+    this.discoveredStrands.delete(strandRow.Id);
     log('Registered sAppConfig for strand %s (sApp: %s, founder: %s)',
-      strandRow.Id, sAppConfig.id, founder ?? false);
+      strandRow.Id, sAppConfig.id, founder ?? 'derived');
+
+    // An unset `founder` is DERIVED from the row inside launchStrand (this node founds
+    // iff the row's FounderOwnerKey is its own owner key); an explicit flag wins — the
+    // formation/responder flows pass one deliberately, since their consent-seated rows
+    // carry a null column. See StrandConfig.founder. Same rule for the explicit
+    // partyMemberPrivateKey: it wins over the StrandPartyKey control-row read.
+    const instance = await this.launchStrand(strandRow, sAppConfig, founder, partyMemberPrivateKey);
+
+    // The first-sync write gate: a JOINING machine's database is withheld until it has
+    // received the strand's Header from another member, because a write before that
+    // forks every table it touches (see strand-first-sync-gate.ts). Waiting here is what
+    // lets an app write straight after `addStrand` resolves — the reference chat apps
+    // do — so the default is to wait, bounded by `strandFirstSync.timeoutMs`. A timeout
+    // rejects with the retryable `StrandAwaitingFirstSyncError` and leaves the launch
+    // up: this same call, made again once a member is reachable, completes the attach
+    // (the tracked-instance path above returns the still-syncing instance, and this
+    // wait picks it up). Founders and machines that already hold the Header resolve at
+    // once. Only a LIVE gated instance is waited on — a hibernating one is returned as
+    // it always was (no database either; a wake publishes it).
+    if (config.awaitFirstSync !== false && this.strandManager.isAwaitingFirstSync(strandRow.Id)) {
+      await this.strandManager.whenWritable(strandRow.Id, { timeoutMs: this.config.strandFirstSync?.timeoutMs });
+    }
+    return instance;
+  }
 
-    // `founder` only flows from the explicit addStrand path — the control-discovered
-    // join path never founds, so its rows arrive via sync (see handleStrandAdded).
-    return await this.launchStrand(strandRow, sAppConfig, founder);
+  /**
+   * Resolve once a launched strand is writable — its database published to the app and
+   * its status `'active'` — or reject with the retryable `StrandAwaitingFirstSyncError`
+   * after `timeoutMs` (default `strandFirstSync.timeoutMs`, else
+   * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS`). The promise form of the `strand:writable`
+   * event, for a caller that attached without waiting ({@link StrandConfig.awaitFirstSync}
+   * `false`) or that holds a strand the watcher launched. Resolves immediately for a
+   * strand that is already writable; rejects immediately for one this node does not run.
+   * A hibernating strand is not woken — wake it first if that is what is wanted.
+   */
+  async whenStrandWritable(strandId: string, options?: { timeoutMs?: number }): Promise<StrandInstance> {
+    return await this.strandManager.whenWritable(strandId, {
+      timeoutMs: options?.timeoutMs ?? this.config.strandFirstSync?.timeoutMs
+    });
   }
 
   /**
@@ -3702,40 +4603,231 @@ export class CadreNode implements SAppIdLookup {
    * owner identity, so other cadre members discover it via control-network
    * sync (their {@link StrandWatcher} fires `strand:discovered`).
    *
-   * This is the owner-signed `Strand` INSERT that {@link addStrand}
-   * deliberately omits: `addStrand` only starts the LOCAL strand instance,
-   * whereas publishing makes the strand visible cadre-wide. A typical creator
-   * does both (start locally + publish); a discovering peer only does
-   * `addStrand` (the row already exists).
+   * **Founding a strand is TWO steps** — this one (publish the row cadre-wide) and
+   * {@link addStrand} (start the local instance, `founder: true` to write the strand's
+   * `Header`/founding membership). `addStrand` deliberately omits the insert: it only
+   * starts the LOCAL instance, whereas publishing makes the strand visible cadre-wide. A
+   * discovering peer only does `addStrand` (the row already exists). Callers founding a
+   * strand should use {@link foundStrand}, which performs both steps and is safe to
+   * re-run — hand-rolling the pair is what left strands half-founded when an app was
+   * killed between them.
+   *
+   * **Idempotent for identical content.** A live row whose `(Type, MemberPrivateKey)` match
+   * the arguments is the state this call would have produced, so the call logs and returns
+   * that row instead of writing — a publish interrupted after it committed can be repeated.
+   * DIFFERENT content on the same id throws, naming the columns that differ, rather than
+   * surfacing the raw `UNIQUE constraint failed: Strand.Id`: silently accepting it would
+   * let a retry reopen a closed strand or swap the key gating its reads. The read and the
+   * insert are not atomic, so a concurrent founder (two machines of one party, same id) is
+   * caught on the insert's uniqueness rejection and resolved the same way — re-read, no-op
+   * on a match, rethrow otherwise. Never an overwrite either way.
+   *
+   * A tombstoned strand is NOT resurrected here: {@link unpublishStrand} deletes the row, so
+   * the idempotent branch is unreachable and the ordinary publish path re-seats it, exactly
+   * as that method documents.
+   *
+   * **Already stuck on `UNIQUE constraint failed: Strand.Id`?** The row is already published
+   * — attach, do NOT republish: `addStrand` (or {@link foundStrand}) with the id and, for a
+   * closed strand, the `MemberPrivateKey` read back from the row. `unpublishStrand` + a
+   * fresh publish also clears it for an OPEN strand, but is destructive for a closed one
+   * (the key exists nowhere else). No app-data wipe is needed for either.
    *
    * The insert is signed with the ed25519 key behind this node's PeerId — which
    * {@link ed25519KeyPairFromLibp2p} also exposes as the node's owner keypair,
-   * so peer identity and owner key are one and the same. That key must be
-   * enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
+   * so peer identity and owner key are one and the same. That key is also persisted on the
+   * row as `FounderOwnerKey` (the schema pins the column to the verified signer), which is
+   * what later lets any launch derive "this machine is the founder" from the row alone.
+   * The key must be enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
    * at genesis) or the schema's `Strand.AuthorizedInsert` constraint rejects the write.
    * Failing loudly here is intentional: a silently-unpublished strand would run
    * as a local-only island that no peer could ever discover or join.
    *
+   * A CLOSED strand's publish also seats this party's own membership identity key —
+   * the `StrandPartyKey` row {@link ensureStrandPartyKey} documents — which is what the
+   * founder bootstrap derives `Member.Key`/`Manager.MemberKey` from. The
+   * `memberPrivateKey` ARGUMENT stays the strand-wide read secret formation hands to
+   * joiners; it derives nobody's identity.
+   *
    * @param strandId - Unique strand identifier (typically the same id passed to
    *   {@link addStrand}).
    * @param type - `'o'` for open (default) or `'c'` for closed.
-   * @param memberPrivateKey - Optional membership key for a closed strand.
-   * @throws if the node is not started, exposes no owner signing key, the id is blank, or
-   *   the control DB rejects the (unauthorized) insert.
-   */
-  async publishStrand(strandId: string, type: 'o' | 'c' = 'o', memberPrivateKey?: string): Promise<void> {
+   * @param memberPrivateKey - Optional shared membership (read) key for a closed strand.
+   * @returns The live `Strand` row — the one just inserted, or the matching one already
+   *   there. A closed strand's caller should carry THIS row's `MemberPrivateKey` forward:
+   *   on a repeat it is the stored key, not the argument.
+   * @throws if the node is not started, exposes no owner signing key, the id is blank, a
+   *   row with the same id holds different content, or the control DB rejects the
+   *   (unauthorized) insert.
+   */
+  async publishStrand(strandId: string, type: 'o' | 'c' = 'o', memberPrivateKey?: string): Promise<StrandRow> {
     const signingKey = this.requireOwnerSigningKey(`publish strand ${strandId}`);
     // Trim/reject here so the id that lands matches the one unpublishStrand looks up: it
     // trims too, and an untrimmed row would be unreachable by the same string.
     const trimmed = requireNonBlank(strandId, 'strand id');
-    await this.controlDatabase!.insertStrand(
-      trimmed,
-      type,
-      signingKey.publicKeyB64,
-      signMessageWith(signingKey.privateKeyB64),
-      memberPrivateKey
-    );
+    // FounderOwnerKey records THIS machine as the row's publisher (the schema pins it to
+    // the signing owner), which is what later lets a relaunch derive founder-ness.
+    const desired: StrandRow = {
+      Id: trimmed,
+      Type: type,
+      MemberPrivateKey: memberPrivateKey ?? null,
+      FounderOwnerKey: signingKey.publicKeyB64,
+    };
+
+    // Read first rather than leaning on the insert's collision for BOTH readings. The
+    // ordinary resume (an app killed after its own publish committed) then needs no error
+    // matching at all: the collision path can only recognise itself by the engine's message
+    // TEXT (see isStrandIdConflict), and an upstream reword there must degrade the RARE race,
+    // not the common resume. It also spends no stamp or signature on a known no-op.
+    const existing = await this.controlDatabase!.queryStrand(trimmed);
+    if (existing) {
+      // NOTE: reads local converged state, and `queryStrand` does not filter rows whose
+      // StampId a Revocation has retired. So on a sibling that still physically holds a row
+      // deleted elsewhere while ALONE (the delete-while-alone gap in docs/architecture.md),
+      // an owner-signed republish now no-ops onto that doomed row instead of re-seating the
+      // id under a fresh stamp. Harmless while that gap is itself unresolved — both
+      // behaviours end at the same unconverged state — but if delete-while-alone ever gains
+      // real replay, filter retired stamps here (queryStrandStampId + the Revocation read)
+      // so a re-seat is not mistaken for a repeat.
+      const matched = requireMatchingStrandRow(existing, desired, 'is already published');
+      log('publishStrand(%s): already published (type %s) with identical content — no-op', trimmed, type);
+      // A closed strand THIS machine published must hold a party key (its own membership
+      // identity — see ensureStrandPartyKey). Insert-if-absent, so the ordinary repeat
+      // is a read-only no-op and a publish interrupted between the row insert and the
+      // mint heals here. A row another machine published is that machine's to mint for.
+      if (type === 'c' && this.isSelfFoundedRow(matched)) {
+        await this.ensureStrandPartyKey(trimmed);
+      }
+      return matched;
+    }
+
+    try {
+      await this.controlDatabase!.insertStrand(
+        trimmed,
+        type,
+        signingKey.publicKeyB64,
+        signMessageWith(signingKey.privateKeyB64),
+        memberPrivateKey
+      );
+    } catch (error) {
+      // Only the uniqueness collision is a candidate for the idempotent reading; every
+      // other rejection (unauthorized signer, retired stamp) must keep surfacing.
+      if (!isStrandIdConflict(error)) {
+        throw error;
+      }
+      const landed = await this.controlDatabase!.queryStrand(trimmed);
+      if (!landed) {
+        // Collided, yet no row is readable: not the race this branch handles (a row
+        // deleted between the rejection and the re-read, or a stale local view). Surface
+        // the original rather than guessing.
+        throw error;
+      }
+      log('publishStrand(%s): lost a concurrent founding race; re-read the landed row', trimmed);
+      return requireMatchingStrandRow(landed, desired, 'landed concurrently from another founder');
+    }
     log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signingKey.publicKeyB64);
+    // A closed strand's publish also mints this party's own membership identity key
+    // (StrandPartyKey) — the key the founder bootstrap derives Member/Manager from,
+    // deliberately distinct from the shared memberPrivateKey argument above. A failure
+    // here surfaces (the strand row has already committed, so a retried publish takes
+    // the idempotent branch and heals the mint; so does the next founder launch).
+    if (type === 'c') {
+      await this.ensureStrandPartyKey(trimmed);
+    }
+    return desired;
+  }
+
+  /**
+   * Found a strand — publish its row cadre-wide AND start the local instance as its
+   * founder — in one resumable call. The single entry point for creating a strand; a
+   * caller joining one someone else founded uses {@link addStrand} alone.
+   *
+   * Safe to re-run from any point of interruption, which hand-rolling
+   * {@link publishStrand} + {@link addStrand} is not. Either half can already have
+   * happened:
+   *
+   * - **row already published** → the stored row is adopted rather than re-published, so a
+   *   run killed after the insert committed no longer dies on
+   *   `UNIQUE constraint failed: Strand.Id`. For a closed strand the row's STORED
+   *   `MemberPrivateKey` wins over `config.memberPrivateKey`: a caller that mints a key per
+   *   attempt (as the reference apps do) would otherwise present a key that does not match
+   *   the membership already seated in the strand.
+   * - **instance already running** → the tracked instance is returned, and — because the
+   *   `Strand` row records its publishing machine (`FounderOwnerKey`) — a founder request
+   *   against an instance that was first launched as a joiner now runs the (idempotent,
+   *   insert-if-absent) founder bootstrap on it rather than silently skipping it
+   *   ({@link StrandInstanceManager.foundExistingStrand}). So a strand that something else
+   *   attached first — the reference RN app's `strand:discovered` handler after a restart,
+   *   or this node's own {@link StrandWatcher} poll winning `launchStrand`'s
+   *   `resolveCohortSeed` window — still ends up with its `Strand.Header` written.
+   *
+   * Founder-ness is resolved FROM THE ROW, not assumed: this machine founds iff the
+   * resolved row's `FounderOwnerKey` is its own owner key. A fresh publish records this
+   * machine, so the common path founds; a machine that lost a concurrent founding race to
+   * a sibling adopts the sibling's row and ATTACHES instead — deliberately, since two
+   * machines bootstrapping the same strand on separate replicas is the double-`Header`
+   * hazard. The returned {@link FoundStrandResult.founded} says which happened.
+   *
+   * `Type` is compared, not adopted: a stored row of the other type means the caller and
+   * the control plane disagree about what this strand IS, so it throws.
+   *
+   * @returns The instance AND the row the strand actually runs under — read the membership
+   *   key from the returned row, not from a freshly minted one ({@link FoundStrandResult}).
+   * @throws if the node is not started, the id is blank, a published row of the same id has
+   *   a different `Type`, or either half rejects.
+   */
+  async foundStrand(config: FoundStrandConfig): Promise<FoundStrandResult> {
+    const { strandId, type = 'o', memberPrivateKey, sAppConfig, awaitFirstSync } = config;
+    if (!this._running || !this.controlDatabase) {
+      throw new Error(`CadreNode must be started before attempting to found strand ${strandId}`);
+    }
+    const controlDatabase = this.controlDatabase;
+    const trimmed = requireNonBlank(strandId, 'strand id');
+    const timed = <T>(step: string, op: () => Promise<T>) => timedStep('foundStrand', trimmed, step, op);
+    const tTotal = performance.now();
+    const published = await timed('queryStrand', () => controlDatabase.queryStrand(trimmed));
+    const strandRow = published
+      ? this.adoptPublishedStrand(published, type, memberPrivateKey)
+      : await timed('publishStrand', () => this.publishStrand(trimmed, type, memberPrivateKey));
+    // Derived, not hardcoded `true`: adopting a row another machine published means that
+    // machine runs the bootstrap — this one must attach or it would write a second Header.
+    const founded = this.isSelfFoundedRow(strandRow);
+    if (!founded) {
+      log('foundStrand(%s): the stored row was published by a different machine ' +
+        '(FounderOwnerKey is not this node\'s owner key) — attaching as a joiner; ' +
+        'the founder bootstrap runs on the publishing machine', trimmed);
+    }
+    const instance = await timed('addStrand',
+      () => this.addStrand({ strandRow, sAppConfig, founder: founded, awaitFirstSync }));
+    timing(`[foundStrand:${trimmed}] total: ${Math.round(performance.now() - tTotal)}ms`);
+    return { instance, strandRow, founded };
+  }
+
+  /**
+   * Resume onto an already-published `Strand` row: keep its stored content, reject a type
+   * disagreement. The stored `MemberPrivateKey` is authoritative — see {@link foundStrand}
+   * for why a caller-minted key must lose here (and why that is NOT the same rule as
+   * {@link publishStrand}'s, which throws on a key mismatch because it is being asked to
+   * WRITE that key, not to resume onto what already exists).
+   */
+  private adoptPublishedStrand(
+    published: StrandRow,
+    type: 'o' | 'c',
+    memberPrivateKey?: string
+  ): StrandRow {
+    if (published.Type !== type) {
+      throw new Error(
+        `Cannot found strand ${published.Id} as type '${type}': it is already published as ` +
+        `type '${published.Type}'. Reconcile deliberately rather than re-founding — a ` +
+        'published open strand cannot be closed, nor a closed one opened, by re-publishing.'
+      );
+    }
+    if (memberPrivateKey !== undefined && memberPrivateKey !== published.MemberPrivateKey) {
+      log('foundStrand(%s): already published — resuming on the STORED MemberPrivateKey; ' +
+        'the supplied key is discarded (read it back from the returned instance)', published.Id);
+    } else {
+      log('foundStrand(%s): already published (type %s) — adopting the stored row', published.Id, type);
+    }
+    return published;
   }
 
   /**
@@ -3751,10 +4843,12 @@ export class CadreNode implements SAppIdLookup {
    * is an owner-signed control-plane write like every other, not "destroy the network".
    *
    * Irreversible for a closed strand (`Type='c'`): the row carries `MemberPrivateKey`,
-   * this party's membership secret for that network, and it is stored nowhere else.
-   * With it gone the party can never again admit a member to that closed strand, and a
-   * re-published row would carry a DIFFERENT key that does not match the membership
-   * already written into the strand's RBAC layer. The strand id itself is NOT
+   * this party's read secret for that network, and the strand's `StrandPartyKey` row —
+   * this party's own membership identity, removed (and tombstoned) in the SAME
+   * transaction — is stored nowhere else either. With both gone the party can never
+   * again sign as its seated member/manager there, and a re-published row mints a fresh
+   * identity that does not match the membership already written into the strand's RBAC
+   * layer. The strand id itself is NOT
    * blacklisted: a fresh owner-signed {@link publishStrand} re-seats it under a new
    * stamp — only the unsigned consent re-seat is permanently foreclosed (the removal's
    * `Revocation` tombstone names the id, which the consent branch of
@@ -3809,6 +4903,26 @@ export class CadreNode implements SAppIdLookup {
         'row deletion itself cannot be replayed, so other nodes may keep running the strand ' +
         'until the collection converges.', trimmed);
     }
+    // A refused pre-split launch left no tracked instance, so the stop below never
+    // reaches detachStrand for it — clear the refusal here so a re-founded id starts clean.
+    this.strandLaunchRefusals.delete(trimmed);
+    // Clear THIS machine's own MemberPeer binding while the strand runtime — and the
+    // retained party key — is still live: the delete above already destroyed the
+    // party's StrandPartyKey row, so once this process forgets the key nothing can
+    // ever sign the removal again. Runs AFTER the control delete so a rejected
+    // unpublish (unauthorized signer) never strips a binding the party still needs;
+    // best-effort by contract (never throws) — a hibernating or unreachable strand
+    // keeps the stale binding, which grants nothing today. Sibling machines observing
+    // this removal via their watchers do NOT clear their own bindings (see the NOTE on
+    // StrandInstanceManager.clearOwnMemberPeerBinding).
+    //
+    // NOTE: this makes unpublishStrand await a STRAND-NETWORK write it never used to —
+    // however long that write takes to reject or commit is now added to unpublish's
+    // wall-clock. Fine while strand writes fail fast on an unreachable quorum; if
+    // unpublish ever starts hanging on an isolated strand, give this call its own
+    // deadline rather than dropping it (a binding cleared late is still worth more than
+    // one never cleared).
+    await this.strandManager.clearOwnMemberPeerBinding(trimmed);
     // Converge locally now rather than waiting up to a poll interval. The watcher fires
     // onStrandRemoved for a strand it tracked; the explicit stop below covers a node whose
     // strandFilter never admitted this strand (the watcher never knew it, so it will never
@@ -3821,6 +4935,105 @@ export class CadreNode implements SAppIdLookup {
     log('Unpublished strand %s from control DB under owner %s', trimmed, signingKey.publicKeyB64);
   }
 
+  /**
+   * Seat this party's own strand membership identity key — the `StrandPartyKey` row —
+   * for `strandId`, minting a fresh one when none is given, and adopting the stored one
+   * when a row already exists. Insert-if-absent and stable thereafter: the founding
+   * `Member.Key` must not change across restarts, or the bootstrap's insert-if-absent
+   * guards stop matching.
+   *
+   * This is the identity half of the closed-strand key split: the row's `PrivateKey` —
+   * NOT the strand row's shared `MemberPrivateKey`, which formation hands to every
+   * joining party — is what the founder bootstrap derives `Member.Key`/`Manager.MemberKey`
+   * from. It replicates to every machine this party owns (same plaintext-at-rest stance
+   * as `MemberPrivateKey`; docs/strands.md → "Closed-Strand Member Key Handling") and is
+   * never put on the formation wire.
+   *
+   * Called internally by {@link publishStrand} (closed strands mint at publish) and by a
+   * founder launch that finds no row (a publish interrupted before its mint); public so a
+   * test harness — or a joiner flow that persists a formation-issued identity — can seat
+   * a specific key deliberately.
+   *
+   * @param strandId - The strand the key is this party's identity for.
+   * @param partyMemberPrivateKey - Optional specific key (base64 protobuf, as
+   *   `generateStrandMemberKey` mints). When a row already holds a DIFFERENT key this
+   *   throws — a party has one identity per strand; rotation is a deliberate
+   *   remove-then-insert, not a silent swap.
+   * @returns The live party key: the one just seated, or the stored one.
+   */
+  async ensureStrandPartyKey(strandId: string, partyMemberPrivateKey?: string): Promise<string> {
+    const trimmed = requireNonBlank(strandId, 'strand id');
+    const signingKey = this.requireOwnerSigningKey(`seat a party key for strand ${trimmed}`);
+    const existing = await this.controlDatabase!.queryStrandPartyKey(trimmed);
+    if (existing !== null) {
+      if (partyMemberPrivateKey !== undefined && partyMemberPrivateKey !== existing) {
+        // Neither key is included: the party key is this party's membership identity secret.
+        throw new Error(
+          `Strand ${trimmed} already has a party key and the supplied one differs. The stored ` +
+          'key is the identity the strand membership was seated under; to rotate it, remove ' +
+          'the row deliberately (deleteStrandPartyKey) rather than overwriting it.'
+        );
+      }
+      return existing;
+    }
+    const key = partyMemberPrivateKey ?? await generateStrandMemberKey();
+    try {
+      await this.controlDatabase!.insertStrandPartyKey(
+        trimmed, key, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+    } catch (error) {
+      // The read and the insert are not atomic; a concurrent seat of the same strand's
+      // key can land in between. Adopt the landed row when it satisfies this request —
+      // the same resolution publishStrand applies to its own read-then-insert window —
+      // and rethrow every other rejection (unauthorized signer, retired stamp).
+      const landed = await this.controlDatabase!.queryStrandPartyKey(trimmed);
+      if (landed === null || (partyMemberPrivateKey !== undefined && partyMemberPrivateKey !== landed)) {
+        throw error;
+      }
+      log('ensureStrandPartyKey(%s): lost a concurrent seat race; adopting the landed key', trimmed);
+      return landed;
+    }
+    log('Seated strand party key for %s under owner %s', trimmed, signingKey.publicKeyB64);
+    return key;
+  }
+
+  /**
+   * Resolve the party membership key a closed strand's launch threads into the founder
+   * bootstrap: the explicit attach-time key when given, else the party's persisted
+   * `StrandPartyKey` row, else — on the one machine whose owner key the row names as
+   * founder — a freshly minted-and-persisted key, which seats the identity for a publish
+   * that was interrupted before its mint. Everyone else resolves undefined: non-founding
+   * machines never mint (no mint race between a party's machines), and only a founder
+   * bootstrap needs the key at all.
+   *
+   * Minting does NOT repair a strand founded before the key split: its founding
+   * membership was seated under the shared `MemberPrivateKey`, and nothing re-seats it —
+   * the founder bootstrap refuses such a strand (`PreSplitStrandIdentityError`) instead.
+   *
+   * NOTE: "founding machine" here is the ROW's provenance, not the launch's resolved
+   * `founder` flag — so an explicit `founder: false` over a row this machine published
+   * still mints, an owner-signed write a caller that said "I am not founding" did not ask
+   * for. Harmless (the party needs that identity for the strand either way, and the mint
+   * is insert-if-absent) and unreachable today: the one explicit `founder: false` caller
+   * passes a row with a null `FounderOwnerKey`. If a caller ever pairs `founder: false`
+   * with its own published row, gate the mint on the resolved flag too.
+   */
+  private async resolveStrandPartyKey(strand: StrandRow, explicitKey?: string): Promise<string | undefined> {
+    if (explicitKey !== undefined) {
+      return explicitKey;
+    }
+    if (!this.controlDatabase) {
+      return undefined;
+    }
+    const stored = await this.controlDatabase.queryStrandPartyKey(strand.Id);
+    if (stored !== null) {
+      return stored;
+    }
+    if (!this.isSelfFoundedRow(strand)) {
+      return undefined;
+    }
+    return await this.ensureStrandPartyKey(strand.Id);
+  }
+
   /**
    * Publish an owner-signed `FormationInvite` (open-invitation token) to the
    * shared control database, so a later {@link formStrand} redemption can be
@@ -3974,26 +5187,109 @@ export class CadreNode implements SAppIdLookup {
    * seed, starts the strand, and registers it with the hibernation manager
    * before emitting `strand:started`.
    *
-   * Idempotent no-op when the strand manager already tracks `strand.Id` — the
-   * ordinary founding sequence is `addStrand` (starts it locally) followed by
-   * `publishStrand` (makes it visible), so this node's own `StrandWatcher`
-   * rediscovers a row it already started and calls this again via
-   * `handleStrandAdded`. Without the guard that re-entry would resolve a fresh
+   * Founder-ness: an explicit `founder` argument wins (the formation/responder flows pass
+   * one deliberately — their consent-seated rows carry a null `FounderOwnerKey`); when
+   * unset it is DERIVED from the row, so the control-discovered path
+   * (`handleStrandAdded`) and a restart's re-attach found this machine's own strands
+   * without the caller having to know. The derivation is pure key comparison — no I/O.
+   *
+   * Idempotent when the strand manager already tracks `strand.Id` — the watcher
+   * rediscovers a row this node already started and calls this again via
+   * `handleStrandAdded`; without the guard that re-entry would resolve a fresh
    * (already-connected) cohort seed and re-emit `strand:started` for an
    * instance that never stopped. The guard runs before the cohort-seed RPC
-   * fan-out, so a rediscovery costs nothing beyond the map lookup.
+   * fan-out, so a rediscovery costs nothing beyond the map lookup plus the (pure)
+   * founder derivation. NOT a silent no-op any more when the launch resolves as a
+   * FOUNDER: the tracked instance may have been launched first as a joiner (an app
+   * attach, or this node's own watcher poll winning the `resolveCohortSeed` window
+   * below), which used to drop the founder request and leave the strand headerless —
+   * now the tracked instance is founded in place
+   * ({@link StrandInstanceManager.foundExistingStrand}), waking it first if quiesced
+   * so the bootstrap actually runs before this resolves.
+   *
+   * A founder launch refused as pre-split (`PreSplitStrandIdentityError`) is recorded in
+   * {@link strandLaunchRefusals} for the formation arm, then rethrown; a founder launch
+   * that succeeds clears the record (it ran the bootstrap's pre-split check and passed).
    */
   private async launchStrand(
     strand: StrandRow,
     sAppConfig: SAppConfig,
-    founder?: boolean
+    founder?: boolean,
+    explicitPartyKey?: string
+  ): Promise<StrandInstance> {
+    const resolvedFounder = founder ?? this.isSelfFoundedRow(strand);
+    try {
+      const instance = await this.startOrFoundStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey);
+      if (resolvedFounder) {
+        this.strandLaunchRefusals.delete(strand.Id);
+      }
+      return instance;
+    } catch (error) {
+      if (error instanceof PreSplitStrandIdentityError) {
+        this.strandLaunchRefusals.set(strand.Id, error);
+      }
+      throw error;
+    }
+  }
+
+  /**
+   * The launch itself, for {@link launchStrand} (which documents the behaviour): found a
+   * tracked instance in place, or start a fresh one.
+   */
+  private async startOrFoundStrand(
+    strand: StrandRow,
+    sAppConfig: SAppConfig,
+    resolvedFounder: boolean,
+    explicitPartyKey: string | undefined
   ): Promise<StrandInstance> {
+    const timed = <T>(step: string, op: () => Promise<T>) => timedStep('startOrFoundStrand', strand.Id, step, op);
     const existing = this.strandManager.getInstance(strand.Id);
     if (existing) {
-      log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+      if (resolvedFounder) {
+        // The resolver runs only when the retained config lacks a party key for a
+        // closed strand (see foundExistingStrand), so the common watcher re-entry
+        // ('already-founder') still costs no control read.
+        const outcome = await timed('foundExistingStrand', () => this.strandManager.foundExistingStrand(strand.Id,
+          () => this.resolveStrandPartyKey(strand, explicitPartyKey)));
+        if (outcome === 'needs-resume') {
+          try {
+            // Quiesced instance: the retained config now founds, but founding promises
+            // the bootstrap has RUN by the time the caller resolves — wake through the
+            // hibernation manager (coalesced with any in-flight wake, timer-aware) so
+            // the rebuild executes it now rather than at some eventual wake.
+            await timed('wakeStrand', () => this.wakeStrand(strand.Id));
+            // The wake's rebuild founds — UNLESS a wake was already in flight when the
+            // config flipped, in which case it had already read the pre-flip config and
+            // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
+            // (insert-if-absent) bootstrap so founding never resolves headerless.
+            await timed('ensureFounderBootstrap', () => this.strandManager.ensureFounderBootstrap(strand.Id));
+          } catch (error) {
+            // The founding did not happen (e.g. the rebuild refused a pre-split strand and
+            // rolled back, leaving the instance tracked with no runtime): withdraw the flip
+            // so the next attempt re-runs the founding instead of resolving
+            // 'already-founder' over an instance that never founded.
+            this.strandManager.withdrawFounderRequest(strand.Id);
+            throw error;
+          }
+        }
+        log('launchStrand: strand %s already tracked — founder request honored (%s)',
+          strand.Id, outcome);
+      } else {
+        log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+      }
       return existing;
     }
 
+    // A closed strand's launch carries the party's OWN membership identity key: the
+    // explicit attach-time key, else the control-layer StrandPartyKey row — minted here
+    // when this machine is the row-derived founder and no row exists yet (a publish
+    // interrupted before its mint). A joiner with no persisted key threads undefined;
+    // only a FOUNDER bootstrap needs the key, and that path throws loudly without one
+    // (StrandDatabase).
+    const partyMemberPrivateKey = strand.Type === 'c'
+      ? await timed('resolveStrandPartyKey', () => this.resolveStrandPartyKey(strand, explicitPartyKey))
+      : undefined;
+
     // Each strand node gets its own transport identity, derived from the cadre
     // identity key + strandId (see strand-transport-key.ts). Sharing the
     // control node's key here gave every node one peerId, which collides at a
@@ -4009,8 +5305,9 @@ export class CadreNode implements SAppIdLookup {
     // identity is ever supported, fall back to `undefined` here — libp2p then
     // generates a random per-strand key, which still avoids the collision but
     // gives up peerId stability across restarts.
-    const transportKey = this.identityKey
-      ? await strandTransportKey(this.identityKey, strand.Id)
+    const identityKey = this.identityKey;
+    const transportKey = identityKey
+      ? await timed('strandTransportKey', () => strandTransportKey(identityKey, strand.Id))
       : undefined;
 
     // Derived BEFORE seed resolution so the seed pass doubles as the delegate
@@ -4018,9 +5315,9 @@ export class CadreNode implements SAppIdLookup {
     // `libp2p.start()` (the responder records the grant before replying; the
     // client awaits the replies).
     const delegatePeerId = transportKey ? peerIdFromPrivateKey(transportKey).toString() : undefined;
-    const bootstrapNodes = await this.resolveCohortSeed(strand.Id, delegatePeerId);
+    const bootstrapNodes = await timed('resolveCohortSeed', () => this.resolveCohortSeed(strand.Id, delegatePeerId));
 
-    const instance = await this.strandManager.startStrand({
+    const instance = await timed('strandManager.startStrand', () => this.strandManager.startStrand({
       strandRow: strand,
       sAppConfig,
       storage: this.config.storage,
@@ -4031,16 +5328,47 @@ export class CadreNode implements SAppIdLookup {
       bootstrapNodes,
       requireSignedSchemas: this.config.requireSignedSchemas,
       clusterSize: this.config.strandClusterSize,
+      // NOTE: deliberately NO `servingMachines`, so the strand node declares no repair
+      // yardstick and runs the frozen STRAND_CLUSTER_POLICY. The only count this node holds
+      // is the party's enrolled machines (`authorizedControlPeers`), and passing that here
+      // is the regression `bug-strand-yardstick-counts-party-machines` removed — a strand
+      // runs on a subset of the party, and over-declaring makes repair impossible rather
+      // than merely weak. The full argument, and the count that will legitimately go here,
+      // are on `StartStrandConfig.servingMachines`.
       backfill: this.config.strandBackfill,
-      founder
-    });
+      revocationEnforcement: this.config.strandRevocationEnforcement,
+      membershipReconciliation: this.config.strandMembershipReconciliation,
+      onSelfRevoked: (revokedStrandId) => this.emit('strand:revoked', { strandId: revokedStrandId }),
+      // The joiner's first-sync write gate (strand-first-sync-gate.ts): a launch that
+      // comes up `'syncing'` announces the moment its database is published.
+      firstSync: this.config.strandFirstSync,
+      onWritable: (writableStrandId) => this.handleStrandWritable(writableStrandId),
+      // Re-announce the delegate to ONE relay before the strand node's reservation
+      // supervisor re-drives it (see announceDelegateToRelay). Retained with the
+      // launch config, so a hibernation wake's rebuilt supervisors get it too.
+      announceDelegateToRelay: (announcedStrandId, relayAddr, announcedDelegatePeerId) =>
+        this.announceDelegateToRelay(announcedStrandId, relayAddr, announcedDelegatePeerId),
+      // The staged formation invitation seam for the bring-up membership
+      // reconciler: read lazily per pass (a re-formation replaces the entry) and
+      // cleared once spent, burned, or dead — see pendingMembershipInvites.
+      pendingMembershipInvite: {
+        get: () => this.pendingMembershipInvites.get(strand.Id),
+        clear: () => { this.pendingMembershipInvites.delete(strand.Id); }
+      },
+      // The RESOLVED flag, never the raw argument — see the doc comment above.
+      founder: resolvedFounder,
+      // Retained with the launch config, so a hibernation wake rebuilds under the
+      // same identity without re-reading the control DB.
+      partyMemberPrivateKey
+    }));
 
     // The seed reached the node as `bootstrapNodes`, which only enters the
     // address book via @libp2p/bootstrap discovery. Merge it directly too, so a
     // sibling is dialable by bare peer id from the first moment (see
     // mergeStrandPeerAddrs; refreshStrandPeerAddrs keeps it warm from here on).
-    if (instance.libp2pNode) {
-      await this.mergeStrandPeerAddrs(instance.libp2pNode, bootstrapNodes, strand.Id);
+    const strandNode = instance.libp2pNode;
+    if (strandNode) {
+      await timed('mergeStrandPeerAddrs', () => this.mergeStrandPeerAddrs(strandNode, bootstrapNodes, strand.Id));
     }
 
     this.hibernationManager.trackStrand(instance);
@@ -4075,6 +5403,21 @@ export class CadreNode implements SAppIdLookup {
    * for a relay we are not yet connected to.
    */
   private async resolveCohortSeed(strandId: string, delegatePeerId?: string): Promise<string[]> {
+    const siblings = await this.resolveSiblingSeed(strandId, delegatePeerId);
+    // Sibling answers FIRST: they were resolved just now, while a contact-map entry is as
+    // old as the formation that produced it. `unionAddrs` appends only what the siblings
+    // did not already name, so a fresher answer is never displaced and each source keeps
+    // its own signaling-first ordering.
+    return unionAddrs(siblings, this.crossPartyStrandAddrs.get(strandId) ?? []);
+  }
+
+  /**
+   * The own-party half of {@link resolveCohortSeed}: strand-network addresses resolved
+   * from CONNECTED cohort siblings over the control-mesh strand-addr RPC, doubling as
+   * the delegate announcement when `delegatePeerId` is given. Empty when the control DB
+   * or node is absent (not yet started / torn down).
+   */
+  private async resolveSiblingSeed(strandId: string, delegatePeerId?: string): Promise<string[]> {
     if (!this.controlDatabase || !this.controlNode) {
       return [];
     }
@@ -4177,10 +5520,10 @@ export class CadreNode implements SAppIdLookup {
    * Recorded OPTIMISTICALLY at announce time: `collectStrandAddrs` folds
    * per-peer failure to `[]` and reports no per-peer success, and threading
    * success out would change its API for little gain. A failed INITIAL announce
-   * is fatal-at-start anyway (the relay denies the reservation,
-   * `libp2p.start()` throws, and wake/check-in re-resume retries with a fresh
-   * announce); a failed REFRESH retries within `DELEGATE_GRANT_TTL_MS / 2`
-   * (15 min), still inside the 30 min TTL.
+   * costs the strand supervisor its first attempt only (the relay denies the
+   * reservation; every re-drive re-announces first through
+   * {@link announceDelegateToRelay}); a failed REFRESH retries within
+   * `DELEGATE_GRANT_TTL_MS / 2` (15 min), still inside the 30 min TTL.
    */
   private recordDelegateAnnounces(relayPeerIds: readonly string[], strandId: string, now = Date.now()): void {
     for (const relayPeerId of relayPeerIds) {
@@ -4226,6 +5569,55 @@ export class CadreNode implements SAppIdLookup {
     ));
   }
 
+  /**
+   * Announce ONE strand's delegate peerId to ONE relay, UNTHROTTLED — the
+   * `beforeRedrive` hook of that strand node's per-relay reservation supervisor
+   * (`strand-instance-manager.ts` → `buildStrandRuntime`), run before every
+   * re-drive after the first attempt.
+   *
+   * Why a re-drive must re-announce first: a party control node running the relay
+   * server admits the strand node's derived peerId on an in-memory delegate grant
+   * (`delegate-admission.ts`), and a relay restart drops every grant it held
+   * without telling the announcer. {@link refreshDelegateGrants} would re-announce
+   * on its own at most every `DELEGATE_GRANT_TTL_MS / 2` (15 min) per (relay,
+   * strand) — far slower than the supervisor's backoff — so without this the first
+   * re-drives after a relay restart would be denied at the relay's connection gate.
+   * The throttle map is updated afterwards, so the periodic pass does not announce
+   * again right away.
+   *
+   * Against a dedicated ops relay (no strand-addr RPC) the request fails per-peer
+   * and `collectStrandAddrs` folds it to `[]`: one wasted protocol negotiation per
+   * re-drive attempt, bounded by the supervisor's backoff. Never throws on that
+   * path; a relay addr that names no peer id is logged and skipped (the hook's
+   * caller runs the drive regardless).
+   *
+   * NOTE: against a relay that is DOWN this hook costs up to two strand-addr
+   * timeouts (10 s each: dial by peer id, then by addr) before the 10 s drive even
+   * starts, so one failed re-drive can hold the supervisor `driving` for ~30 s.
+   * Bounded and harmless while the relay is unreachable anyway; if recovery
+   * latency after a relay comes back ever matters, skip the announce when the
+   * control node holds no connection to the relay (the drive's own dial fails
+   * faster) rather than shortening the strand-addr timeout.
+   */
+  private async announceDelegateToRelay(strandId: string, relayAddr: string, delegatePeerId: string): Promise<void> {
+    const controlNode = this.controlNode;
+    if (!controlNode) {
+      return;
+    }
+    const relayPeerId = trailingPeerId(multiaddr(relayAddr));
+    if (relayPeerId === null) {
+      log('announceDelegateToRelay: relay addr %s names no peer id; strand %s not announced', relayAddr, strandId);
+      return;
+    }
+    await collectStrandAddrs(
+      controlNode,
+      [{ peerId: relayPeerId, addrs: [multiaddr(relayAddr)] }],
+      strandId,
+      { delegatePeerId }
+    );
+    this.recordDelegateAnnounces([relayPeerId], strandId);
+  }
+
   /** One strand's share of {@link refreshDelegateGrants}: announce to the relays whose grant is due. */
   private async announceDelegateToDueRelays(
     strandId: string,
@@ -4296,36 +5688,42 @@ export class CadreNode implements SAppIdLookup {
     if (due.length === 0) {
       return;
     }
-    // A due strand with nobody to ask leaves its throttle unstamped (see below),
-    // so this pass re-enters on EVERY 15 s reconcile tick for as long as the node
-    // is alone — which is the steady state of a solo node running a strand.
     // `connectedSiblingTargets`' membership read is unbounded, and with zero
-    // connections its answer is empty whatever the table holds, so decide it here
-    // from the connection list instead of paying for the read once a tick.
-    if (this.controlNode.getConnections().length === 0) {
-      return;
-    }
+    // connections its answer is empty whatever the table holds, so decide it from the
+    // connection list instead of paying for the read once a tick. Note this only skips
+    // the RPC: a strand carrying cross-party contact addresses still refreshes below,
+    // because those never came from a sibling in the first place.
+    //
     // NOTE: one strand-addr RPC per (due strand × connected sibling) per refresh
     // interval — each a tiny request/response on an already-open control
     // connection. If a node ever runs MANY strands at once, batch the RPC to
     // carry several strand ids per request rather than one fan-out per strand.
-    const targets = await this.connectedSiblingTargets().catch((error): StrandAddrPeer[] => {
-      log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
-      return [];
-    });
-    // No sibling to ask (or a shutdown landed mid-enumeration): leave every stamp
-    // untouched so the next reconcile tick retries, rather than sitting out the
-    // whole refresh interval having asked nobody.
-    if (targets.length === 0 || !this._running || !this.controlNode) {
+    const targets = this.controlNode.getConnections().length === 0
+      ? []
+      : await this.connectedSiblingTargets().catch((error): StrandAddrPeer[] => {
+        log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
+        return [];
+      });
+    // A shutdown landed mid-enumeration.
+    if (!this._running || !this.controlNode) {
       return;
     }
     await Promise.all(due.map((strandId) => this.refreshOneStrandPeerAddrs(strandId, targets, now)));
   }
 
   /**
-   * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, then
-   * merge their answers into this strand's address book. Errors are logged and
-   * swallowed so one strand's failure never costs the others their refresh.
+   * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, union their
+   * answers with this strand's cross-party contact addresses, and merge the lot into the
+   * strand's address book. Errors are logged and swallowed so one strand's failure never
+   * costs the others their refresh.
+   *
+   * `targets` may be EMPTY — a solo node, or one whose only control peers are strangers.
+   * The cross-party addresses still have to be re-merged in that case: they were learned
+   * at formation and can never be re-resolved, so this periodic re-merge is the ONLY
+   * thing standing between them and the peerStore's one-hour expiry. A strand with
+   * neither a sibling to ask nor a contact entry does nothing and leaves its throttle
+   * unstamped, so the next reconcile tick retries rather than sitting out the whole
+   * refresh interval having done nothing.
    */
   private async refreshOneStrandPeerAddrs(
     strandId: string,
@@ -4337,13 +5735,19 @@ export class CadreNode implements SAppIdLookup {
     if (!controlNode || !strandNode) {
       return;
     }
+    const contactAddrs = this.crossPartyStrandAddrs.get(strandId) ?? [];
+    if (targets.length === 0 && contactAddrs.length === 0) {
+      return;
+    }
     try {
       // The running strand node's own peerId is the delegate to announce — see
       // the relationship note on refreshStrandPeerAddrs.
-      const addrs = await collectStrandAddrs(controlNode, [...targets], strandId, {
-        delegatePeerId: strandNode.peerId.toString()
-      });
-      // Stamped on the RPC having happened, not on its answer: the fan-out is
+      const siblingAddrs = targets.length === 0
+        ? []
+        : await collectStrandAddrs(controlNode, [...targets], strandId, {
+          delegatePeerId: strandNode.peerId.toString()
+        });
+      // Stamped on the pass having happened, not on its answer: the fan-out is
       // what the throttle exists to bound, and an all-empty round is a normal
       // steady state for a strand no connected sibling currently runs.
       this.strandPeerAddrRefreshAt.set(strandId, now);
@@ -4352,7 +5756,7 @@ export class CadreNode implements SAppIdLookup {
       if (!this._running || this.strandManager.getInstance(strandId)?.libp2pNode !== strandNode) {
         return;
       }
-      await this.mergeStrandPeerAddrs(strandNode, addrs, strandId);
+      await this.mergeStrandPeerAddrs(strandNode, unionAddrs(siblingAddrs, contactAddrs), strandId);
     } catch (error) {
       log('refreshStrandPeerAddrs: strand %s refresh failed (continuing): %o', strandId, error);
     }
@@ -4376,6 +5780,15 @@ export class CadreNode implements SAppIdLookup {
    * handshake, and a bad entry costs one failed dial that ages out at the
    * peerStore's one-hour expiry. No new gating here — cross-party strand trust is
    * `backlog/strand-network-nat-relay-reachability`.
+   *
+   * NOTE: one input does NOT age out — the cross-party addresses a formation
+   * carried back ({@link crossPartyStrandAddrs}). Nothing can re-resolve them, so
+   * {@link refreshStrandPeerAddrs} re-merges the same stored list every pass, which
+   * also means a junk entry from a responder survives for the node's lifetime rather
+   * than an hour. Bounded to {@link MAX_STRAND_ADDRS} per strand, from a party this
+   * node deliberately formed a strand with, and still authority-free — so the
+   * exposure is a handful of failed dials, not a trust hole. Evict on
+   * `unpublishStrand` if that ever stops being an acceptable price.
    */
   private async mergeStrandPeerAddrs(strandNode: Libp2p, addrs: string[], strandId: string): Promise<void> {
     const counts: Record<MergeAddrsResult, number> = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
@@ -4419,14 +5832,40 @@ export class CadreNode implements SAppIdLookup {
     if (!node) {
       return [];
     }
-    return orderSignalingFirst(node.getMultiaddrs().map((ma) => ma.toString()));
+    // Every entry is bound to THIS strand node's id, because both consumers — the
+    // strand-addr RPC answer and the formation result's `strandAddrs` — are attributed
+    // per peer on arrival (`groupAddrsByPeerId`) and an entry naming no destination is
+    // dropped there. libp2p already appends the id to its announced addresses, so this
+    // is normally a no-op; it is the guard for a bare listen addr and for a relay hop
+    // whose trailing `/p2p/` names the RELAY. An addr terminating in a DIFFERENT id is
+    // dropped rather than announced — it does not reach this node, and announcing it
+    // would file our address under someone else's id in the receiver's book.
+    //
+    // Re-parsed through this package's own `multiaddr` rather than passed straight in:
+    // libp2p hands back its nested `@multiformats/multiaddr` copy, a structurally
+    // different type from the one `withTrailingPeerId` takes (see
+    // `backlog/reference-app-web-libp2p-interface-dedup`). Re-parsing a string libp2p
+    // itself produced cannot fail.
+    const selfId = node.peerId.toString();
+    const addrs: string[] = [];
+    for (const ma of node.getMultiaddrs()) {
+      const bound = this.bindAddrToPeer(multiaddr(ma.toString()), selfId);
+      if (bound !== null) {
+        addrs.push(bound.toString());
+      }
+    }
+    return orderSignalingFirst(addrs);
   }
 
   /**
    * Stop a strand on THIS node only: untrack it from hibernation, drop its sApp config,
    * stop the local instance, and emit `strand:stopped`. The shared `Strand` row is left
-   * intact, so on the next node restart (or watcher poll) the strand is rediscovered and
-   * surfaces as `strand:discovered` again. Party-wide removal is {@link unpublishStrand}.
+   * intact, so on the next node RESTART the strand is rediscovered and surfaces as
+   * `strand:discovered` again — not on the next watcher poll, which never re-offers a
+   * strand it has already seen (`StrandWatcher.knownStrands` retains the id for the life
+   * of the process). The stop also drops the strand from {@link getDiscoveredStrands},
+   * so a drain cannot undo a deliberate stop. Party-wide removal is
+   * {@link unpublishStrand}.
    */
   async stopStrand(strandId: string): Promise<void> {
     if (!this._running) {
@@ -4438,20 +5877,28 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Local teardown for one strand, shared by the caller-driven {@link stopStrand} and the
-   * watcher-driven `handleStrandRemoved`: untrack hibernation, drop the sApp config, stop
-   * the instance, emit `strand:stopped`. Touches no control-plane row — which side of the
-   * removal the node is on is the caller's concern, not this method's.
+   * watcher-driven `handleStrandRemoved`: untrack hibernation, drop the sApp config and any
+   * recorded launch refusal, stop the instance, emit `strand:stopped`. Touches no
+   * control-plane row — which side of the removal the node is on is the caller's concern,
+   * not this method's.
    *
    * The stop + emit are skipped when the strand manager holds no instance for `strandId` —
    * e.g. a party owner that published a strand's row but never ran it locally, or an
    * explicit {@link stopStrand} for an id this node never started. `hibernationManager`
-   * untrack and the `sAppConfigs` delete stay unconditional (both are no-ops when there is
-   * nothing to remove), so a launch that failed before an instance was ever tracked still
-   * gets its stray sApp config cleared.
+   * untrack and the `sAppConfigs` / {@link strandLaunchRefusals} / {@link discoveredStrands}
+   * deletes stay unconditional (all no-ops when there is nothing to remove), so a launch
+   * that failed before an instance was ever tracked still gets its stray entries cleared.
+   *
+   * Dropping the {@link discoveredStrands} entry here covers both callers, and both
+   * readings are the intended one: `handleStrandRemoved` arrives because the control row
+   * is gone, and an explicit {@link stopStrand} is a deliberate abandonment — neither
+   * strand may be re-offered to a later `getDiscoveredStrands()` drain.
    */
   private async detachStrand(strandId: string): Promise<void> {
     this.hibernationManager.untrackStrand(strandId);
     this.sAppConfigs.delete(strandId);
+    this.strandLaunchRefusals.delete(strandId);
+    this.discoveredStrands.delete(strandId);
     if (!this.strandManager.hasStrand(strandId)) {
       log('detachStrand: strand %s not tracked locally — no-op (no stop, no strand:stopped)', strandId);
       return;
@@ -4677,6 +6124,11 @@ export class CadreNode implements SAppIdLookup {
    * relay indistinguishable from a hung start, and much shorter would fail nodes
    * on links that were merely slow. The retries carry on in the background after
    * this resolves, exactly as they do for a {@link reserveRelays} caller.
+   *
+   * `network.requireRelay === false` softens only the outcome below: a first
+   * attempt that lands no `/p2p-circuit` address is logged instead of thrown, and
+   * `start()` carries on with the retry supervisor already running in the
+   * background (the same supervisor {@link reserveRelays} always starts).
    */
   private async driveControlRelayReservation(): Promise<void> {
     const relayAddrs = this.config.network?.relayAddrs ?? [];
@@ -4687,6 +6139,11 @@ export class CadreNode implements SAppIdLookup {
     const state = await this.reserveRelays([...relayAddrs]);
     timing('[start] reserveRelays: %dms', Math.round(performance.now() - t0));
     if (state.status !== 'reserved') {
+      if (this.config.network?.requireRelay === false) {
+        log('Relay reservation did not land on the first attempt (status: %s); ' +
+          'continuing without it because network.requireRelay is false: %o', state.status, state);
+        return;
+      }
       throw new RelayReservationFailedError(relayAddrs, state);
     }
     log('Reserved a relay slot: %o', state.circuitAddrs);
@@ -4841,6 +6298,7 @@ export class CadreNode implements SAppIdLookup {
       partyId: this.config.controlNetwork.partyId,
       ownerPrivateKey,
       inviteAddressResolver: () => this.resolveInviteAddresses(),
+      dialBudget: this.controlDialBudget(),
       trustPolicy: this.config.seedTrustPolicy,
       // Seed trust anchors on the node-local store (seeded just above with this
       // node's own genesis key), never on the replicated OwnerKey table.
@@ -5093,6 +6551,7 @@ export class CadreNode implements SAppIdLookup {
       partyId: this.config.controlNetwork.partyId,
       // No owner key - this node only receives seeds
       inviteAddressResolver: () => this.resolveInviteAddresses(),
+      dialBudget: this.controlDialBudget(),
       trustPolicy: this.config.seedTrustPolicy,
       // A listener-only node accepts a wire-delivered seed solely against this
       // anchor (there is no per-call override on the inbound handler): with no
@@ -5173,6 +6632,26 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /**
+   * Re-materialize a CLOSED strand's revoked-peer deny set now, and hang up any
+   * connected peer it newly covers — the strand-side counterpart to
+   * {@link refreshMembershipGate}.
+   *
+   * Unlike that one, NOTHING calls this automatically: strand membership is
+   * written through the strand's own `Database` handle
+   * (`strand-membership-writer.ts`), which raises no notification this runtime
+   * can hook, and a revocation that arrives by REPLICATION raises none either.
+   * The gate therefore polls (default 30 s). An app that has just called
+   * `revokeMember` or `leaveStrand` should follow the write with this call so
+   * the cut is immediate rather than up to one poll interval late.
+   *
+   * Quiet no-op for a strand that is not running, is quiesced, is open, or has
+   * the gate disabled. Never rejects; resolves once the sweep has finished.
+   */
+  async refreshRevocationEnforcement(strandId: string): Promise<void> {
+    await this.strandManager.refreshRevocationEnforcement(strandId);
+  }
+
   /**
    * The single in-flight refresh loop behind {@link refreshMembershipGate}: read
    * until the stale flag stays clear, then release the slot.
@@ -5246,6 +6725,10 @@ export class CadreNode implements SAppIdLookup {
     await this.seedBootstrapService.authorizePeer({ peerId, multiaddrs });
     // Queue for re-replication if this committed local-only (no connected cohort).
     this.noteControlWrite(peerId, 'authorize');
+    // NOTE: unlike addDrone, `multiaddrs` is not retained as a dial target: the
+    // flows that vouch through here have the new peer reach this node (it applies a
+    // seed naming the owners, or it dialed in with an invite). If one ever vouches a
+    // peer that cannot reach this node, retain its addresses as addDrone does.
   }
 
   /**
@@ -5263,6 +6746,13 @@ export class CadreNode implements SAppIdLookup {
     await this.seedBootstrapService.removePeer(peerId);
     // Track + loudly flag a delete that committed local-only (security-relevant).
     this.noteControlWrite(peerId, 'remove');
+    // A removed peer is no longer a dial target, however this node learned its
+    // address. Gone from the store synchronously; a persist failure only lets the
+    // entry reappear after a restart, so it is logged rather than failing a
+    // removal that has already committed.
+    void this.bootstrapPeerStore?.forget(peerId).catch((error: unknown) => {
+      log('removePeer: persisting the removal of dial target %s failed (forgotten in memory): %o', peerId, error);
+    });
   }
 
   /**
@@ -5304,6 +6794,7 @@ export class CadreNode implements SAppIdLookup {
       const tempService = new SeedBootstrapService({
         partyId: seed.partyId,
         trustPolicy: this.config.seedTrustPolicy,
+        dialBudget: this.controlDialBudget(),
         // The anchor is node-scoped, not service-scoped: a throwaway service
         // must consult (and persist an accepted signer into) the SAME store the
         // persistent one would, or a cold-start enrollment via this path would
@@ -5393,6 +6884,20 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Add a drone to the cadre (for phone/server adding provider-hosted node).
    * Creates authorization and seed for drone initialization.
+   *
+   * Also retains the drone's handed-over addresses as a durable dial target (see
+   * {@link bootstrapPeerStore}). The drone cannot dial an owner that does not
+   * listen (a phone), and its `CadrePeer` row stays unsigned — so unresolvable —
+   * until it self-publishes over a connection; this node therefore has to open
+   * that connection from the addresses it was handed, on this launch or a later
+   * one.
+   *
+   * Nothing is dialed here: the drone has not received the seed yet. After
+   * delivering it, call {@link reconcileControlCohort} to dial straight away;
+   * otherwise the next timed reconcile pass does. A pass already in flight is
+   * joined rather than restarted, and one that listed siblings before this add
+   * does not dial the drone, so a caller waiting for the connection should allow
+   * for one more timed pass.
    */
   async addDrone(options: AddDroneOptions): Promise<DroneInitResult> {
     if (!this.seedBootstrapService) {
@@ -5400,7 +6905,12 @@ export class CadreNode implements SAppIdLookup {
     }
     // The drone's `CadrePeer` insert notifies the membership hub on the way to the
     // seed, so the per-stream gate already admits it here.
-    return await this.seedBootstrapService.addDrone(options);
+    const result = await this.seedBootstrapService.addDrone(options);
+    // Same queueing as authorizePeer: a phone adding its first always-on node has
+    // no control connection, so the insert usually committed local-only.
+    this.noteControlWrite(options.dronePeerId, 'authorize');
+    this.retainDialTarget(options.dronePeerId, options.droneMultiaddrs, 'addDrone');
+    return result;
   }
 
   /**
@@ -5479,6 +6989,7 @@ export class CadreNode implements SAppIdLookup {
       const tempService = new SeedBootstrapService({
         partyId: invite.partyId,
         trustPolicy: this.config.seedTrustPolicy,
+        dialBudget: this.controlDialBudget(),
       });
       if (this.controlNode && this.controlDatabase) {
         tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
@@ -5507,7 +7018,15 @@ export class CadreNode implements SAppIdLookup {
     this.strandSolicitationService = new StrandSolicitationService({
       ...options,
       partyId: this.config.controlNetwork.partyId,
-      cadrePeerAddrs: this.getMultiaddrs()
+      cadrePeerAddrs: this.getMultiaddrs(),
+      // Overrides any caller-supplied hook, exactly like partyId/cadrePeerAddrs: only
+      // this node can say which strand-network addresses it is actually listening on,
+      // and a wrong answer here seeds a joiner's mesh with addresses that reach nobody.
+      resolveStrandAddrs: (strandId: string) => this.getStrandMultiaddrs(strandId),
+      // Overridden on the same grounds: only this node holds the running strand
+      // instance's database and this party's `StrandPartyKey` identity, and a wrong
+      // issuer here would admit joiners under someone else's authority.
+      issueMembershipInvite: (strandId: string) => this.issueStrandMembershipInvite(strandId)
     });
 
     // Register as responder on the control node
@@ -5569,11 +7088,190 @@ export class CadreNode implements SAppIdLookup {
       this.initializeStrandSolicitation();
     }
 
-    return await this.strandSolicitationService!.formStrand(
+    const result = await this.strandSolicitationService!.formStrand(
       invitation,
       disclosure,
       this.controlNode
     );
+    this.recordCrossPartyStrandAddrs(result.strandId, result.strandAddrs);
+    // A closed host strand's approval carries the joiner's own membership invitation —
+    // persist this party's identity key and stage the invitation for bring-up to redeem.
+    // Runs AFTER the addr recording so a persistence failure (which throws — see the
+    // method) still leaves the cross-party seed in place for a manual recovery.
+    if (result.membershipInvite) {
+      await this.adoptFormationMembershipInvite(result.strandId, result.membershipInvite);
+    }
+    return result;
+  }
+
+  /**
+   * Adopt an approved closed-strand formation's membership half on the JOINER:
+   *
+   * 1. Mint-or-reuse this party's own strand identity — {@link ensureStrandPartyKey}
+   *    with no explicit key returns the stored `StrandPartyKey` row when one exists (a
+   *    re-formation by an existing member party: lost addresses, an app reinstall with
+   *    an intact control DB) and mints + persists a fresh one otherwise. The invitation
+   *    will admit THIS key's public half as the `Strand.Member`.
+   * 2. Stage the invitation in {@link pendingMembershipInvites} for the strand
+   *    bring-up flow (`strand-node-binds-member-peer`) to redeem via `consumeInvite`.
+   *
+   * Throws — failing the whole {@link formStrand} — when the identity cannot be
+   * persisted: a joiner "joined" without a persistable identity could never become a
+   * member, and failing loudly beats a silent half-member. The formation itself has
+   * already succeeded by then and its one-time token is SPENT, so the error says so:
+   * recovery is fixing the underlying cause (no owner signing key / control DB write
+   * rejected) and redeeming a FRESH invitation.
+   */
+  private async adoptFormationMembershipInvite(strandId: string, invite: StrandMembershipInvite): Promise<void> {
+    try {
+      await this.ensureStrandPartyKey(strandId);
+    } catch (error) {
+      throw new Error(
+        `Formation for strand ${strandId} was approved (its one-time token is spent), but ` +
+        'persisting this party\'s membership identity (StrandPartyKey) failed — the joiner ' +
+        'cannot become a member without it. Fix the underlying cause, then redeem a fresh ' +
+        'invitation (the delivered one dies with this error).',
+        { cause: error }
+      );
+    }
+    // NOTE: staging alone is not enough on a node whose reconciler for this strand has
+    // already finished. `StrandMembershipReconciler` latches a terminal stopped state on
+    // its `done` path and is rebuilt only by a strand relaunch, so a RE-formation against
+    // an already-launched strand stages an invitation no loop will ever look at. Harmless
+    // for a party that is still a member (the invitation would only be burned), and the
+    // live defect for one that has been REMOVED — which is exactly when an app re-forms.
+    // Tracked as `backlog/bug-removed-party-cannot-redeem-its-way-back`; pinned by
+    // `strand-party-removal-via-formation-e2e.integration.ts` (test 2).
+    this.pendingMembershipInvites.set(strandId, invite);
+    log('formStrand: staged membership invitation for strand %s (party key persisted)', strandId);
+  }
+
+  /**
+   * The pending single-use membership invitation a closed-strand formation carried back
+   * for `strandId`, or `undefined` when none is staged — the seam the strand bring-up
+   * membership reconciler (`strand-membership-reconciler.ts`) reads to redeem the
+   * joiner's `Strand.Member` seat. `undefined` therefore also means "already redeemed,
+   * burned, or found dead": the reconciler clears the entry as soon as it settles the
+   * invitation, so a caller polling this sees it disappear on its own. In-memory only;
+   * see {@link pendingMembershipInvites} for lifetime and re-formation semantics.
+   */
+  getPendingMembershipInvite(strandId: string): StrandMembershipInvite | undefined {
+    return this.pendingMembershipInvites.get(strandId);
+  }
+
+  /**
+   * Responder-side issuer behind the formation manager's `issueMembershipInvite` seam
+   * (see `StrandFormationManagerOptions.issueMembershipInvite` for the contract this
+   * implements): mint a single-use `Strand.Invite` against the LIVE host strand so a
+   * validated joiner can seat its own `Strand.Member` row.
+   *
+   * - Open host strand → `null` (no members, nothing to invite into).
+   * - Closed host strand whose founder launch was refused as pre-split
+   *   ({@link strandLaunchRefusals}) → rethrow the recorded `PreSplitStrandIdentityError`;
+   *   the manager maps it to the NON-retryable `HOST_STRAND_MUST_BE_RECREATED_REASON`.
+   * - Closed host strand with no `StrandPartyKey` row → throw: this party's identity is
+   *   the invite's issuing manager, and without it nothing can sign the issuance. (The
+   *   founder's publish/launch paths mint it, so this is a not-yet-converged sibling.)
+   *   The manager maps the throw to a clean retryable rejection BEFORE the formation
+   *   token is spent.
+   * - Closed host strand with no running local instance/database → throw, same mapping:
+   *   a joiner admitted without an invitation would look joined and never become a
+   *   member, and a responder not running the strand cannot serve its sync anyway.
+   * - Closed host strand whose LIVE rows carry the pre-split fingerprint
+   *   (`assertNotPreSplitStrand`) → throw `PreSplitStrandIdentityError`, same mapping as
+   *   the recorded refusal. Covers the responders that never ran a refused founder launch:
+   *   a sibling machine of the founding party, or a node restarted since the refusal.
+   *
+   * The recorded refusal is checked first: it is an in-memory read and the only
+   * permanent diagnosis. Identity is checked BEFORE the runtime: it is the cheaper read
+   * and the more actionable diagnosis when both are missing (a missing runtime is
+   * transient, a missing identity is not), and it keeps the branch reachable without
+   * standing a strand runtime up.
+   *
+   * The invitation expires `MEMBERSHIP_INVITE_TTL_MS` from now — see that constant for
+   * the slow-joiner / lost-result tradeoff.
+   *
+   * NOTE: the issuing identity must be a `Strand.Manager` (the schema's `InviteValid`
+   * gate), and only the FOUNDING party's key is seated as one. Today only the founder
+   * party can host a bound formation at all — a joining party never gets the host
+   * strand's control `Strand` row, so `resolveStrand` reports `missing` on it — so this
+   * never bites. If a joined party is ever able to host formations into a strand it
+   * joined (re-invite / multi-hop join), issuance here fails the manager gate and every
+   * such redemption rejects with the retryable-sounding
+   * `MEMBERSHIP_INVITE_UNAVAILABLE_REASON` forever; that flow needs manager delegation,
+   * not a retry.
+   */
+  private async issueStrandMembershipInvite(strandId: string): Promise<StrandMembershipInvite | null> {
+    if (!this.controlDatabase) {
+      throw new Error(`Cannot issue a membership invitation for strand ${strandId}: control database unavailable`);
+    }
+    const row = await this.controlDatabase.queryStrand(strandId);
+    if (!row) {
+      // The bound resolution saw this row moments ago; a vanished row is a concurrent
+      // unpublish — reject rather than invite into a strand this party just removed.
+      throw new Error(`Cannot issue a membership invitation for strand ${strandId}: its Strand row is gone`);
+    }
+    if (row.Type !== 'c') {
+      return null;
+    }
+    const refusal = this.strandLaunchRefusals.get(strandId);
+    if (refusal) {
+      throw refusal;
+    }
+    const partyKey = await this.controlDatabase.queryStrandPartyKey(strandId);
+    if (partyKey === null) {
+      throw new Error(
+        `Cannot issue a membership invitation for closed strand ${strandId}: this party holds ` +
+        'no StrandPartyKey row for it (identity not yet converged from the machine that published it)'
+      );
+    }
+    const db = this.strandManager.getInstance(strandId)?.database?.getDatabase();
+    if (!db) {
+      throw new Error(
+        `Cannot issue a membership invitation for closed strand ${strandId}: its runtime is ` +
+        'not live on this responder (not launched, hibernating, or quiescing)'
+      );
+    }
+    if (row.MemberPrivateKey) {
+      await assertNotPreSplitStrand(db, strandId, strandMemberKeyPair(row.MemberPrivateKey).publicKeyB64);
+    }
+    return await issueInvite(db, {
+      managerKeyPair: strandMemberKeyPair(partyKey),
+      expiration: Date.now() + MEMBERSHIP_INVITE_TTL_MS
+    });
+  }
+
+  /**
+   * Remember the responder's strand-network addresses for a strand this node just
+   * formed, so the strand's discovery seed has something to work with when the app
+   * launches it (see {@link crossPartyStrandAddrs}).
+   *
+   * Scoped strictly to `strandId`: these addresses reach ONE strand node of ONE other
+   * party and must never seed another strand's mesh or the control peerStore. An empty
+   * list is recorded as no entry at all rather than an empty one, so a later formation
+   * against the same strand that DOES disclose addresses is not shadowed.
+   */
+  private recordCrossPartyStrandAddrs(strandId: string, strandAddrs: readonly string[]): void {
+    if (strandAddrs.length === 0) {
+      log('formStrand: responder disclosed no strand addrs for %s — cross-party seed stays empty', strandId);
+      return;
+    }
+    // Capped at the same `MAX_STRAND_ADDRS` one arriving list is, because this
+    // ACCUMULATES: re-forming against the same strand (the documented recovery for a
+    // responder whose relay reservation rotated) unions a fresh list onto the old one,
+    // and nothing here can tell a dead entry from a live one. Without the cap, the seed
+    // — and the peerStore rows every refresh pass re-merges from it — would grow by up
+    // to 16 entries per redemption for the node's lifetime. Oldest entries fall off the
+    // end, which is the right end to lose: `unionAddrs` keeps the freshest list first.
+    const merged = unionAddrs(strandAddrs, this.crossPartyStrandAddrs.get(strandId) ?? [])
+      .slice(0, MAX_STRAND_ADDRS);
+    this.crossPartyStrandAddrs.set(strandId, merged);
+    // A strand already running when this lands (a re-formation) would otherwise wait out
+    // the rest of its ~10-minute refresh throttle before the new addresses reached its
+    // address book. Clearing the stamp makes the next 15 s reconcile tick merge them,
+    // which matters precisely because re-forming is the recovery path for a dead entry.
+    this.strandPeerAddrRefreshAt.delete(strandId);
+    log('formStrand: recorded %d cross-party strand addr(s) for %s', merged.length, strandId);
   }
 
   /**