@serfab/cadre-core 0.13.0 → 1.0.0

package/dist/cadre-node.js

@@ -8,6 +8,10 @@ import { controlClusterPolicy, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WIND
 import { sign } from '@optimystic/quereus-plugin-crypto';
 import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64 } from './ed25519-key.js';
 import { strandTransportKey } from './strand-transport-key.js';
+import { controlStorageScope } from './storage-scope.js';
+import { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
+import { assertNotPreSplitStrand, issueInvite, PreSplitStrandIdentityError } from './strand-membership-writer.js';
+import { MEMBERSHIP_INVITE_TTL_MS } from './strand-formation-manager.js';
 import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore } from './trusted-owner-store.js';
@@ -16,14 +20,14 @@ import { MemoryEnrolledMachineStore } from './enrolled-machine-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId } from './peer-addr-book.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
-import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, withTrailingPeerId, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
+import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, trailingPeerId, withTrailingPeerId, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
 import { signDeviceTokenRecord, verifyDeviceTokenSignature, isPushPlatform } from './device-token.js';
 import { StrandWatcher } from './strand-watcher.js';
-import { StrandInstanceManager } from './strand-instance-manager.js';
+import { StrandInstanceManager, liveStrandStatus } from './strand-instance-manager.js';
 import { PeerJoinBackfill } from './peer-join-backfill.js';
 import { deriveCohortMembers } from './strand-cohort.js';
-import { selectControlCohortDials, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
-import { withDeadline } from './control-stream.js';
+import { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
+import { dialPeerAddrs, DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS, DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS } from './peer-dial.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager } from './hibernation-manager.js';
 import { ControlDatabase, isStrandIdConflict } from './control-database.js';
@@ -40,6 +44,7 @@ import { superviseRelayReservation, resolveRelayReservationState } from './relay
 import { PushFanoutService } from './push-fanout.js';
 import { summarizeConnectionPaths, classifyTransport } from './diagnostics/connection-path.js';
 import { TurnRelayTracker } from './diagnostics/webrtc-turn-tracker.js';
+import { timedStep } from './timed-step.js';
 const log = debug('sereus:cadre:node');
 const timing = debug('sereus:cadre:timing');
 /**
@@ -213,10 +218,11 @@ export class CadreNode {
         this._running = false;
         /**
          * The control database's own raw storage (cache-wrapped), resolved once per
-         * `start()` and released in {@link cleanup}. Owning it is what keeps
-         * `config.storage.provider('control')` a once-per-runtime call: a `stop()` then
-         * `start()` cycle on this object re-resolves against a live cache, and never
-         * orphans the previous wrapper's registration in the shared cache pool.
+         * `start()` and released in {@link cleanup}. Owning it is what keeps the
+         * provider call for the control scope — `controlStorageScope(partyId)`, see
+         * `storage-scope.ts` — a once-per-runtime call: a `stop()` then `start()` cycle
+         * on this object re-resolves against a live cache, and never orphans the
+         * previous wrapper's registration in the shared cache pool.
          */
         this.controlStorage = null;
         /**
@@ -272,6 +278,14 @@ export class CadreNode {
         this.controlBringUpInFlight = false;
         /** Map of strandId -> sAppConfig for sAppId filtering and management */
         this.sAppConfigs = new Map();
+        /**
+         * Strands the control network advertises that no local sAppConfig claims — the
+         * backlog behind `strand:discovered`. Maintained in {@link handleStrandAdded}
+         * (added), {@link addStrand} (claimed), {@link detachStrand} (stopped or its
+         * control row vanished) and {@link cleanup}. Read through
+         * {@link getDiscoveredStrands}.
+         */
+        this.discoveredStrands = new Map();
         /**
          * Most-recently pushed invite addresses (see {@link setInviteAddresses}).
          * When non-null these take priority over `libp2pNode.getMultiaddrs()` when
@@ -388,37 +402,89 @@ export class CadreNode {
          */
         this.crossPartyStrandAddrs = new Map();
         /**
-         * Cold-start bootstrap dial targets: the owner-flagged peers of every seed
-         * this node has applied, keyed by peer id, valued by the seed's multiaddr
-         * strings (parsed lazily, at dial time). Written by
-         * {@link recordSeedBootstrapPeers}; read only by
-         * {@link dialColdStartBootstrap} while the control database still has no
-         * siblings to dial.
+         * PENDING strand membership invitations learned at formation, keyed by strandId — the
+         * single-use `Strand.Invite` credential a closed-strand formation result carried back
+         * ({@link FormStrandResult.membershipInvite}), waiting for this node's strand bring-up
+         * to redeem (`consumeInvite` seats the `Strand.Member` row under this party's own key
+         * — the `strand-node-binds-member-peer` half of the party-identity chain).
+         *
+         * IN-MEMORY, deliberately, like {@link crossPartyStrandAddrs}: a restarted joiner
+         * re-forms from scratch anyway (durability is
+         * `backlog/feat-cross-party-strand-addr-durability`'s problem), and re-forming issues
+         * a fresh invitation. A re-formation against the same strand REPLACES the entry — the
+         * fresh invitation supersedes one that may have expired. The party key the invitation
+         * admits, by contrast, IS persisted (`StrandPartyKey`, seated by
+         * {@link adoptFormationMembershipInvite} before the entry lands here), so a lost
+         * invitation never orphans an identity.
+         *
+         * INVALIDATION is owned by the strand's bring-up membership reconciler
+         * (`strand-membership-reconciler.ts`, wired via `StartStrandConfig.pendingMembershipInvite`
+         * in {@link launchStrand}): it deletes the entry once the invitation is redeemed, burned
+         * against an already-seated member, or found dead (expired / cancelled / consumed
+         * elsewhere / the strand sealed). Until the strand is actually launched here the entry
+         * just waits.
+         *
+         * NOTE: entries live for the node's lifetime (one small pair per formed closed
+         * strand), the same unbounded-keys tripwire {@link crossPartyStrandAddrs} documents —
+         * if a node ever forms strands at scale, evict alongside that map.
+         */
+        this.pendingMembershipInvites = new Map();
+        /**
+         * Founder launches refused because the strand was founded before the per-party
+         * identity split (`PreSplitStrandIdentityError`), keyed by strandId. Read by
+         * {@link issueStrandMembershipInvite}, which rethrows the recorded error so a bound
+         * redemption against the strand is rejected as "must be recreated" — not told to retry
+         * because the runtime is not live (a refused fresh launch leaves none) or failed by the
+         * `Strand.Invite` gate (a refused in-place founding leaves a joiner instance up whose
+         * party key is no manager).
+         *
+         * Written and cleared by {@link launchStrand}; also cleared by {@link detachStrand},
+         * {@link unpublishStrand} and {@link cleanup}, so a recreated id starts clean.
+         * In-memory: after a restart the next founder launch of the strand records it again;
+         * until then issuance still reads the fingerprint off the live rows whenever a runtime
+         * is up — only a strand with no runtime at all answers retryably meanwhile.
+         */
+        this.strandLaunchRefusals = new Map();
+        /**
+         * Dial targets learned out of band, keyed by peer id, valued by the multiaddr
+         * strings this node was handed (parsed lazily, at dial time). Two writers:
+         * {@link recordSeedBootstrapPeers} retains the owner-flagged peers of every seed
+         * this node applies, and {@link addDrone} retains the addresses of every node
+         * this node adds. Two readers: {@link dialColdStartBootstrap} dials every entry
+         * while the control database still has no siblings, and
+         * {@link resolveControlDialAddrs} falls back to a sibling's entry when neither
+         * its signed record nor the address book yields an address.
          *
          * A STORE rather than a plain map (see `bootstrap-peer-store.ts`), because the
          * targets must outlive the process: a node seeded into a party it could not
          * reach has nothing else on disk naming that party's addresses (`applySeed`
          * writes no control row, and `CadrePeer` fills in only after a connection
          * succeeds), so an in-memory-only set left it stranded permanently across a
-         * restart. Constructed (or adopted from `config.bootstrapPeers.store`) by
+         * restart. An owner that added a node it cannot be dialed by is in the same
+         * position: the added node's row stays unsigned, so unresolvable, until that
+         * node self-publishes over a connection only the owner can open. Constructed (or
+         * adopted from `config.bootstrapPeers.store`) by
          * {@link initializeBootstrapPeerStore} during {@link start}; deliberately NOT
          * cleared by {@link cleanup}, so it survives a stop()→start() cycle of the same
          * node instance — same lifecycle as {@link trustedOwnerStore}. Durability
-         * depends on the injected backend: Node gets a file-backed store from the CLI,
-         * RN/browser stay ephemeral for now.
+         * depends on the injected backend; the default is in-memory.
          *
          * Deliberately NOT the libp2p peer store, which {@link peerStoreAddrs} already
          * reads for the steady-state path. The peer store is shared with everything
          * libp2p discovers, so "dial every entry" would grow into dialing arbitrary
          * discovered peers as the node lives longer; this store holds exactly the peers
-         * an owner-signed, trust-anchored seed nominated as owners. `applySeed` merges
-         * the same addresses into the peer store as well, so the two never disagree —
-         * this one is just the precisely-scoped subset.
+         * an owner-signed, trust-anchored seed nominated as owners, and the nodes this
+         * node chose to add. `applySeed` also merges a seed's addresses into the peer
+         * store, where they age out; an added node's addresses are never merged there,
+         * because only verified addresses go into the address book (see
+         * {@link warmSiblingAddrBook}).
          *
-         * A later seed OVERWRITES an entry rather than merging, so a re-seed after an
+         * A later record OVERWRITES an entry rather than merging, so a re-seed after an
          * owner's address changes replaces the stale address instead of accumulating
-         * dead ones. Entries are never evicted: they are the node's only way back into
-         * the party if it is ever stranded again.
+         * dead ones, and {@link warmSiblingAddrBook} replaces an entry with the addresses
+         * the sibling's signed record resolves to when they differ. Only this node's own
+         * {@link removePeer} evicts an entry: otherwise they are the node's only way back
+         * to those peers if it is ever stranded again.
          */
         this.bootstrapPeerStore = null;
         /**
@@ -458,6 +524,19 @@ export class CadreNode {
          * both read "no row yet" and race a duplicate INSERT (a `CadrePeer` PK conflict).
          */
         this.registerSelfInFlight = null;
+        /**
+         * When this node last PUBLISHED its own `CadrePeer` address record (inserted or
+         * refreshed), or null if it never has in this session. Stamped by
+         * {@link noteSelfRecordPublished} on every successful publish, wherever it was driven
+         * from — the boot pass, the heartbeat, an address change, a drain or an explicit call.
+         *
+         * Read by {@link escalateIfSelfRecordStale} for the one consequence worth an operator's
+         * attention: once this gap exceeds {@link DEFAULT_PEER_RECORD_MAX_AGE_MS}, every other
+         * machine in the party is already discarding this node's address as stale.
+         */
+        this.lastSelfRecordPublishAt = null;
+        /** Say-once latch for {@link escalateIfSelfRecordStale}; re-armed by the next publish. */
+        this.selfRecordStaleWarned = false;
         // ── Write-while-alone re-replication (control-write-ensure-replicated) ──────
         /**
          * Re-replication queue for owner `authorizePeer` writes that committed while
@@ -492,6 +571,14 @@ export class CadreNode {
          * exactly a "removals from before this lifetime" case).
          */
         this.reissuedHeldRevocations = false;
+        /**
+         * Whether this process has seen the singleton `Revocation` ledger marker filed — its own
+         * `'opened'` or an `'already-open'` answer, in {@link openRevocationLedgerIfDue}. A
+         * record of work done, not a cached authorization answer: the marker can never be
+         * deleted (`NoDelete`), so this can only go stale if the database itself is replaced,
+         * which is why stop() clears it with the other per-process replication state.
+         */
+        this.revocationLedgerOpened = false;
         /** This node's own `CadrePeer` self-write committed local-only (re-touched on growth). */
         this.pendingSelfPeerWrite = false;
         /** This node's own `DeviceToken` self-write committed local-only (re-touched on growth). */
@@ -627,6 +714,25 @@ export class CadreNode {
     getStrands() {
         return this.strandManager.getInstances();
     }
+    /**
+     * Strands the control network advertises that no local sAppConfig claims —
+     * the backlog behind `strand:discovered`.
+     *
+     * The event fires once per strand, and it can fire before the app has
+     * subscribed (the watcher's first poll runs inside `start()`). So an app that
+     * auto-joins discovered strands must subscribe FIRST and then drain this map,
+     * not rely on the event alone. Entries leave the map when the strand is
+     * claimed ({@link addStrand}) or its control row disappears.
+     *
+     * Bounded by the number of strands this party has that this node does not run
+     * — the control database holds only this party's rows — so there is no cap and
+     * no eviction policy to reason about.
+     *
+     * Returns a snapshot; mutating it does not affect the node.
+     */
+    getDiscoveredStrands() {
+        return new Map(this.discoveredStrands);
+    }
     /**
      * Get a specific strand instance
      */
@@ -742,6 +848,9 @@ export class CadreNode {
             // Committed-delete seam → write-while-alone revocation queue. Same wiring
             // window argument as the membership listener above.
             this.controlDatabase.setGuardedDeleteListener((revocation) => this.noteGuardedDelete(revocation));
+            // Abandoned-write seam. Wired here, before the first control write can run, so a
+            // write lost during the rest of bring-up is reported like any other.
+            this.controlDatabase.setControlWriteAbandonedListener((abandonment) => this.noteControlWriteAbandoned(abandonment));
             // Create strand queryable using the control database
             const queryable = this.createStrandQueryable();
             // Create and start the strand watcher with sAppId lookup
@@ -808,7 +917,7 @@ export class CadreNode {
             // scheduleSelfRegistration, so this node's first published `CadrePeer` row
             // already carries the `/p2p-circuit` address the reservation earns it.
             // Throws on a relay that will not have us — start() is fail-fast for a node
-            // whose operator named a relay.
+            // whose operator named a relay, unless network.requireRelay is false.
             await this.driveControlRelayReservation();
             // Schedule self-registration in background
             this.scheduleSelfRegistration();
@@ -1025,10 +1134,10 @@ export class CadreNode {
         return this.enrolledMachineStore;
     }
     /**
-     * The node-local cold-start bootstrap-peer store (null before {@link start}) —
-     * the retained owner addresses {@link reconcileControlCohort}'s cold-start
-     * branch re-dials. Exposed for diagnostics and for a host that wants to show
-     * "what would this node dial if it is stranded?".
+     * The node-local bootstrap-peer store (null before {@link start}) — the dial
+     * targets learned out of band that {@link reconcileControlCohort} falls back to.
+     * Exposed for diagnostics and for a host that wants to show "what would this
+     * node dial if it is stranded?".
      */
     getBootstrapPeerStore() {
         return this.bootstrapPeerStore;
@@ -1180,8 +1289,12 @@ export class CadreNode {
         if (!provider) {
             return undefined;
         }
-        const resolved = typeof provider === 'function' ? provider('control') : provider;
-        this.controlStorage = wrapStorageWithCache(resolved, 'control');
+        // Party-scoped, not the bare literal 'control': the control database holds THIS
+        // party's records, so two parties on one device must not land in one store.
+        // Same key as the cache label, which also makes the shared pool's `stats()` readable.
+        const scope = controlStorageScope(this.config.controlNetwork.partyId);
+        const resolved = typeof provider === 'function' ? provider(scope) : provider;
+        this.controlStorage = wrapStorageWithCache(resolved, scope);
         return this.controlStorage;
     }
     /**
@@ -1195,9 +1308,8 @@ export class CadreNode {
      * operator whose relay slot is decorative may genuinely want only the announced
      * address, so this reports and proceeds.
      *
-     * Keyed off the RESOLVED listen addrs rather than `relayAddrs` alone, so a
-     * hand-written `/p2p-circuit` entry in `listenAddrs` — the same reservation by the
-     * longer route — is caught too.
+     * Keyed off `relayAddrs` AND `listenAddrs`, so a hand-written `/p2p-circuit` entry
+     * in `listenAddrs` — a reservation by the longer route — is caught too.
      *
      * NOTE: the only direct `console.*` in this library — a boot-time operator warning, not a
      * diagnostic trace (those use `debug`, which an operator never sees without `DEBUG=`). If a
@@ -1209,9 +1321,13 @@ export class CadreNode {
         if (!replacesAdvertisedAddrs(network)) {
             return;
         }
-        const listensOnCircuit = (resolveListenAddrs(network) ?? [])
-            .some((addr) => addr.includes('/p2p-circuit'));
-        if (!listensOnCircuit) {
+        // Read off the raw config, not the resolved listen set: the question is only
+        // "does this config name a relay", and the resolution throws on a hand-written
+        // `<relay>/p2p-circuit` listen entry — which still warrants this warning, and
+        // gets its own refusal a few lines later in `buildControlNodeOptions`.
+        const namesRelay = (network?.relayAddrs?.length ?? 0) > 0
+            || (network?.listenAddrs ?? []).some((addr) => addr.includes('/p2p-circuit'));
+        if (!namesRelay) {
             return;
         }
         console.warn('network.announceAddrs is set alongside a circuit-relay listener (from network.relayAddrs, ' +
@@ -1231,11 +1347,11 @@ export class CadreNode {
     buildControlNodeOptions() {
         const { controlNetwork, network, profile } = this.config;
         const identityKey = this.identityKey;
-        // `'search'`: `network.relayAddrs` contributes the bare `/p2p-circuit` SEARCH
-        // entry, which opens no connection — the reservation is driven explicitly at
-        // the END of `start()`, so the control database is built while this node holds
-        // zero control connections. See `relay-addrs.ts` and `start()`.
-        const listenAddrs = resolveListenAddrs(network, 'search');
+        // `network.relayAddrs` contributes the bare `/p2p-circuit` SEARCH entry, which
+        // opens no connection — the reservation is driven explicitly at the END of
+        // `start()`, so the control database is built while this node holds zero
+        // control connections. See `relay-addrs.ts` and `start()`.
+        const listenAddrs = resolveListenAddrs(network);
         // The transports those listen entries imply. A `/ws` entry switches db-p2p's
         // WebSocket transport on (without it the entry binds nothing and libp2p reports
         // nothing); anything outside {tcp, ws/wss, p2p-circuit} throws here rather than
@@ -1809,6 +1925,7 @@ export class CadreNode {
             if (await this.seedBootstrapService.insertSelfPeerRecord(record)) {
                 if (this.committedAlone())
                     this.pendingSelfPeerWrite = true;
+                this.noteSelfRecordPublished();
                 log('registerSelf: inserted own CadrePeer record (owner-signed, updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
                 return 'inserted';
             }
@@ -1846,9 +1963,81 @@ export class CadreNode {
         await this.controlDatabase.updateSelfPeerRecord(record);
         if (this.committedAlone())
             this.pendingSelfPeerWrite = true;
+        this.noteSelfRecordPublished();
         log('registerSelf: refreshed own CadrePeer record (updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
         return 'refreshed';
     }
+    /**
+     * Record that this node's own address record just landed, and re-arm the stale-record
+     * warning. Called from BOTH publishing paths of {@link publishSelfRecord} and nowhere
+     * else — a `skipped` publish wrote nothing, so it must not refresh the stamp.
+     */
+    noteSelfRecordPublished() {
+        this.lastSelfRecordPublishAt = Date.now();
+        this.selfRecordStaleWarned = false;
+    }
+    /**
+     * Report an abandoned control write to the embedding app.
+     *
+     * Every control write funnels through `ControlDatabase.lockedWithRetry`, which now tells
+     * this node when it gives one up. Foreground writes ALSO reject to their caller; the
+     * background ones ({@link startRecordRefresh}'s republish and the two replication
+     * drains) are fired unawaited with a `debug`-only catch, so this event is the only thing
+     * that reaches an app at all.
+     *
+     * Reporting only — the one operator-visible escalation lives on the republish path
+     * ({@link escalateIfSelfRecordStale}), where the consequence is measurable.
+     */
+    noteControlWriteAbandoned(abandonment) {
+        log('Control write abandoned [%s] after %d/%d attempt(s) in %dms (%s): %o', abandonment.label ?? 'unlabelled', abandonment.attemptsMade, abandonment.attemptsAllowed, abandonment.elapsedMs, abandonment.reason, abandonment.error);
+        this.emit('control:write-abandoned', abandonment);
+    }
+    /**
+     * Escalate ONE failed self-address republish to the operator — once — when the node has
+     * not published its own record for longer than a record stays fresh.
+     *
+     * The bar is the CONSEQUENCE, not a failure count: a resolver discards a `CadrePeer`
+     * record older than {@link DEFAULT_PEER_RECORD_MAX_AGE_MS} (15 minutes) and the heartbeat
+     * re-stamps at half that, so by the time this gap opens every other machine in the party
+     * has already stopped accepting this node's address. A count would fire far too early —
+     * one failed heartbeat is already half the budget, and a single miss costs nothing.
+     *
+     * Say-once, re-armed by the next successful publish ({@link noteSelfRecordPublished}), so
+     * a node that stays broken warns once rather than every 7.5 minutes.
+     *
+     * A node that has never published in this session is skipped: it has no record out there
+     * to go stale, and the reason it has none (not a member yet, no signing key, revoked) is
+     * already logged by `registerSelf` itself.
+     *
+     * Only a FAILED republish is checked. A heartbeat whose publish reports `skipped` neither
+     * stamps nor warns, so a node that stops being able to publish without erroring — revoked,
+     * or its row removed — goes quiet here. That is the intended reading: a revoked node has
+     * nothing to publish and its unreachability is the point, not a fault to report.
+     *
+     * NOTE: the second `console.*` in this library, and the reason
+     * {@link warnIfAnnounceAddrsDiscardRelay}'s note says a third should not simply be added:
+     * both are operator warnings about a configuration/health condition an embedder cannot
+     * see otherwise, and both have an event beside them (`control:write-abandoned` carries
+     * the underlying write failure). A third such condition should surface through
+     * {@link CadreNodeEvents} alone unless it likewise degrades the whole party in silence.
+     */
+    escalateIfSelfRecordStale(reason, error) {
+        const publishedAt = this.lastSelfRecordPublishAt;
+        if (publishedAt === null || this.selfRecordStaleWarned) {
+            return;
+        }
+        const staleForMs = Date.now() - publishedAt;
+        if (staleForMs < DEFAULT_PEER_RECORD_MAX_AGE_MS) {
+            return;
+        }
+        this.selfRecordStaleWarned = true;
+        console.warn(`[sereus] this machine has not published its own address record for ${Math.round(staleForMs / 60000)} `
+            + `minutes. The latest attempt (${reason}) failed with: `
+            + `${error instanceof Error ? error.message : String(error)}. `
+            + 'Other machines in the party discard an address record older than '
+            + `${Math.round(DEFAULT_PEER_RECORD_MAX_AGE_MS / 60000)} minutes, so any of them not already `
+            + 'connected to this one can no longer reach it. Publishing keeps retrying; this is reported once.');
+    }
     /**
      * Sign this node's address record for publication, stamped strictly later than
      * `existing` (the row it is about to replace, or null for a first insert) so a
@@ -1955,7 +2144,12 @@ export class CadreNode {
             return;
         }
         const republish = (reason) => {
-            void this.registerSelf().catch((error) => log('Record refresh (%s) failed: %o', reason, error));
+            void this.registerSelf().catch((error) => {
+                log('Record refresh (%s) failed: %o', reason, error);
+                // The only failure in this file that degrades the whole party on its own, so it is
+                // the only one that escalates past `debug`. See escalateIfSelfRecordStale.
+                this.escalateIfSelfRecordStale(reason, error);
+            });
         };
         const reconcile = (reason) => {
             void this.reconcileControlCohort().catch((error) => log('Control-cohort reconcile (%s) failed: %o', reason, error));
@@ -1973,7 +2167,10 @@ export class CadreNode {
         // `CadrePeer` row, so its boot-time publish does nothing, and the two triggers
         // wired here are the only ones after that: `self:peer:update` needs an ADDRESS
         // CHANGE, and a relay-only node's addresses stop changing the moment its
-        // reservation lands — inside `start()`, before this listener exists. Harmless
+        // reservation lands — inside `start()`, before this listener exists (on the
+        // `network.requireRelay: false` posture the reservation may instead land LATER,
+        // from the retry supervisor, and then this listener is what publishes the
+        // `/p2p-circuit` address the boot-time publish could not carry). Harmless
         // where a late-authorized node's addresses keep churning (NAT/relay rotation
         // fire the event anyway), and invisible while parties authorize members before
         // they boot. If late enrollment becomes the normal path — an invited phone is
@@ -2035,10 +2232,16 @@ export class CadreNode {
         this.hasControlConnection = false;
         this.reconstructedLocalOnlyWrites = false;
         this.reissuedHeldRevocations = false;
+        this.revocationLedgerOpened = false;
         this.pendingPeerWrites.clear();
         this.pendingRevocations.clear();
         this.pendingSelfPeerWrite = false;
         this.pendingSelfDeviceWrite = false;
+        // Self-record publication history is per-session too: a restarted node re-publishes
+        // from scratch, and carrying the previous lifetime's stamp forward would either
+        // suppress the stale-record warning or fire it on a node that just came up.
+        this.lastSelfRecordPublishAt = null;
+        this.selfRecordStaleWarned = false;
     }
     /**
      * Resolve a peer's current, signed, trust-checkable multiaddrs from only its
@@ -2126,7 +2329,7 @@ export class CadreNode {
      * Applied by ALL THREE sources of control-dial candidates, so no call site
      * invents its own rule and none can produce a mixed list: the signed record
      * ({@link resolvePeerAddrs}), the libp2p address book
-     * ({@link peerStoreAddrs}), and a seed's retained owner addresses
+     * ({@link peerStoreAddrs}), and a retained out-of-band dial target
      * ({@link bootstrapDialAddrs}).
      *
      * An address naming a DIFFERENT trailing peer id is dropped: it does not reach
@@ -2153,14 +2356,14 @@ export class CadreNode {
      * way, never thrown, so every caller's list-shaping stays total.
      *
      * Used both to normalize addresses this node DIALS (a `CadrePeer` row, a
-     * seed-supplied bootstrap addr) and to normalize the ones it ANNOUNCES
+     * retained bootstrap addr) and to normalize the ones it ANNOUNCES
      * ({@link getStrandMultiaddrs}); the rule is the same either way — an address
      * that does not reach `peerId` is not an address for `peerId`.
      *
      * `withTrailingPeerId` encapsulates `/p2p/<peerId>`, which throws on a peer id
      * that does not parse. Unreachable for a `CadrePeer` row (the binding gate
      * above parsed it already) and for our own node's id, reachable for a
-     * seed-supplied one ({@link bootstrapDialAddrs}).
+     * retained one ({@link bootstrapDialAddrs}).
      */
     bindAddrToPeer(addr, peerId) {
         try {
@@ -2210,9 +2413,15 @@ export class CadreNode {
      * `self:peer:update` (all wired in {@link startRecordRefresh}).
      *
      * Concurrent triggers collapse into a single in-flight pass
-     * (see {@link reconcileControlCohortInFlight}) so two passes never double-dial.
+     * (see {@link reconcileControlCohortInFlight}) so two passes never double-dial;
+     * a call that joins an in-flight pass resolves to THAT pass's result.
      * Best-effort throughout: a failure to resolve/dial any one sibling is logged
      * and the pass continues; the whole pass is a no-op when the node is alone.
+     *
+     * Resolves to the peers the pass dialled ({@link ControlCohortReconcileResult}),
+     * so a caller can tell a link this pass opened from one something else opened —
+     * the pass skips a peer that is already connected. The timer and event triggers
+     * discard it.
      */
     async reconcileControlCohort() {
         if (this.reconcileControlCohortInFlight) {
@@ -2221,7 +2430,7 @@ export class CadreNode {
         const op = this.runReconcileControlCohort();
         this.reconcileControlCohortInFlight = op;
         try {
-            await op;
+            return await op;
         }
         finally {
             this.reconcileControlCohortInFlight = null;
@@ -2232,7 +2441,7 @@ export class CadreNode {
         // Shutdown / not-yet-started guard (mirrors publishSelfRecord). A pass that
         // fires after stop() began must early-return rather than touch a torn-down node.
         if (!this._running || !this.controlNode || !this.controlDatabase) {
-            return;
+            return { dialed: [] };
         }
         // Ride this pass's cadence to refresh the per-stream gate's materialized
         // authorized set — membership changes that ARRIVED BY REPLICATION (rather
@@ -2242,11 +2451,15 @@ export class CadreNode {
         // CadrePeer query (two reads per pass), plus a third from
         // `refreshStrandPeerAddrs` on the passes where a strand is due AND this node
         // holds a control connection (one read for the whole pass, not one per
-        // strand); if those reads ever get costly, share one row-set across all
-        // three.
+        // strand). Each also reads Revocation first. Before the Revocation ledger
+        // marker exists (filed below, once connected) that block is missing, so every
+        // one of those reads consults the cohort about it; once the marker exists every
+        // block they touch is held and none of them does (both states pinned in
+        // control-founding-consult-budget.spec.ts). If those reads ever get costly,
+        // share one row-set across all three.
         await this.refreshMembershipGate('reconcile');
         if (!this._running || !this.controlNode || !this.controlDatabase) {
-            return;
+            return { dialed: [] };
         }
         // Refresh relay delegate grants BEFORE the sibling enumeration below: a
         // solo cadre with a party relay has no siblings to dial but must still keep
@@ -2254,7 +2467,7 @@ export class CadreNode {
         // the reservation and faces the connection gate again).
         await this.refreshDelegateGrants();
         if (!this._running || !this.controlNode || !this.controlDatabase) {
-            return;
+            return { dialed: [] };
         }
         // Then re-warm each running strand's own address book from its siblings, on
         // its own (much longer) throttle. Same reasoning as warmSiblingAddrBook
@@ -2262,7 +2475,7 @@ export class CadreNode {
         // layer under cadre-core dials strand peers by bare peer id.
         await this.refreshStrandPeerAddrs();
         if (!this._running || !this.controlNode || !this.controlDatabase) {
-            return;
+            return { dialed: [] };
         }
         const selfPeerId = this.controlNode.peerId.toString();
         // Reap guarded rows this node still holds for incarnations an already-committed
@@ -2304,7 +2517,27 @@ export class CadreNode {
                 log('reconcileControlCohort: reap pass failed (continuing): %o', error);
             }
             if (!this._running || !this.controlNode || !this.controlDatabase) {
-                return;
+                return { dialed: [] };
+            }
+            // File the Revocation ledger marker once, so that table stops being a never-written
+            // block, which the storage layer re-checks with the cohort on every read (and every
+            // membership lookup and guarded insert reads it). Connected-only for the reap's
+            // reason above: a marker committed alone is local-only, and one filed by a
+            // disconnected owner while another machine creates the same collection is exactly
+            // that fork. Owner-only, and at most once per process — see openRevocationLedgerIfDue.
+            //
+            // NOTE: accepted tradeoff — a solo founder does not file the marker until it holds a
+            // control connection (normally its first sibling; a relay or bootstrap connection also
+            // counts — see getControlConnectionCount — and is the reap's same residual), so until
+            // then it keeps paying one local findCluster per read of
+            // the missing Revocation block (0.009 ms each, measured upstream; no network work on
+            // a cohort of one). Fork safety weighed over that and kept; revisit if findCluster
+            // ever shows up as material in a device profile, or if a solo-founding marker can be
+            // made fork-safe (e.g. filed inside the genesis transaction, before any other machine
+            // can hold the party's collections).
+            await this.openRevocationLedgerIfDue();
+            if (!this._running || !this.controlNode || !this.controlDatabase) {
+                return { dialed: [] };
             }
         }
         // 1. Enumerate known siblings. This membership read is itself a pull-on-read
@@ -2318,12 +2551,11 @@ export class CadreNode {
             // because filling this table needs a connection and getting a connection
             // needs this table. Fall back to the seed's bootstrap addresses; a solo
             // cadre has none and this is a no-op. Must not throw or busy-loop.
-            await this.dialColdStartBootstrap();
-            return;
+            return { dialed: await this.dialColdStartBootstrap() };
         }
         // Re-guard after the await: a stop() may have raced the membership read.
         if (!this._running || !this.controlNode || !this.controlDatabase) {
-            return;
+            return { dialed: [] };
         }
         // 2. Classify backbone (owner) members and select a bounded dial set.
         // NOTE: deliberately the REPLICATED table, not the node-local anchor — this
@@ -2333,7 +2565,7 @@ export class CadreNode {
         // the anchor if owner status here ever gates something trusted.
         const ownerKeys = await this.controlDatabase.getOwnerKeys();
         if (!this._running || !this.controlNode) {
-            return;
+            return { dialed: [] };
         }
         const targetDegree = this.config.network?.controlCohort?.targetDegree
             ?? DEFAULT_CONTROL_COHORT_TARGET_DEGREE;
@@ -2346,25 +2578,51 @@ export class CadreNode {
         //    keeping what resolved for the dial loop below.
         const resolved = await this.warmSiblingAddrBook(siblings);
         if (!this._running || !this.controlNode || !this.controlDatabase) {
-            return;
+            return { dialed: [] };
         }
         // 4. Skip already-connected peers (no re-dial / churn for live connections).
         const connected = new Set(this.controlNode.getConnections().map((c) => c.remotePeer.toString()));
         // 5. Dial each selected, not-yet-connected sibling, best-effort, from the
         //    addresses step 3 already resolved for it.
-        let dialed = 0;
+        const dialed = [];
         for (const sibling of dials) {
             if (!this._running || !this.controlNode) {
-                return;
+                return { dialed };
             }
             if (connected.has(sibling.peerId)) {
                 continue;
             }
             if (await this.dialControlSibling(sibling, resolved.get(sibling.peerId) ?? [])) {
-                dialed++;
+                dialed.push(sibling.peerId);
             }
         }
-        log('reconcileControlCohort: pass complete (siblings=%d, selected=%d, dialed=%d)', siblings.length, dials.length, dialed);
+        log('reconcileControlCohort: pass complete (siblings=%d, selected=%d, dialed=%d)', siblings.length, dials.length, dialed.length);
+        return { dialed };
+    }
+    /**
+     * The owner-only half of the reconcile pass's ledger-marker step: file the singleton
+     * `Revocation` marker ({@link SeedBootstrapService.openRevocationLedger}) unless this
+     * process has already seen it filed. The connectivity gate is the caller's
+     * ({@link runReconcileControlCohort}); why the marker exists is on
+     * {@link ControlDatabase.openRevocationLedger}.
+     *
+     * Sets {@link revocationLedgerOpened} on `'opened'` or `'already-open'`. A node that
+     * cannot sign as an owner does nothing: it picks the owner's marker up the first time it
+     * reads the table, like any other replicated row. Best-effort like every step of the
+     * pass — a failure is logged and leaves the flag clear, so the next connected pass retries.
+     */
+    async openRevocationLedgerIfDue() {
+        if (this.revocationLedgerOpened || !this.seedBootstrapService?.canAuthorize()) {
+            return;
+        }
+        try {
+            const outcome = await this.seedBootstrapService.openRevocationLedger();
+            this.revocationLedgerOpened = true;
+            log('reconcileControlCohort: revocation ledger marker %s', outcome);
+        }
+        catch (error) {
+            log('reconcileControlCohort: filing the revocation ledger marker failed (retrying next pass): %o', error);
+        }
     }
     /**
      * Resolve every sibling's signed address record once and merge what resolves
@@ -2385,6 +2643,9 @@ export class CadreNode {
      * resolves to nothing (revoked, stale, untrusted) is not written at all, so its
      * existing entry ages out on its own.
      *
+     * The same resolution also keeps a sibling's retained out-of-band dial target
+     * current ({@link refreshDialHint}).
+     *
      * NOTE: this resolves EVERY sibling serially before the dial loop below runs,
      * so it costs one record query per sibling per reconcile pass (~15s) and each
      * one delays the pass's first dial. A cadre is a handful of devices, so today
@@ -2394,6 +2655,9 @@ export class CadreNode {
     async warmSiblingAddrBook(siblings) {
         const resolved = new Map();
         const counts = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
+        // One copy of the store's map for the whole loop; a refresh replaces an entry
+        // rather than mutating it, so the copy stays a consistent "before" view.
+        const hints = this.bootstrapPeerStore?.all();
         for (const sibling of siblings) {
             if (!this._running || !this.controlNode) {
                 break;
@@ -2406,6 +2670,7 @@ export class CadreNode {
             if (!this._running || !controlNode) {
                 break;
             }
+            this.refreshDialHint(sibling.peerId, addrs, hints?.get(sibling.peerId)?.addrs);
             // `mergePeerAddrs` owns the whole best-effort contract — including parsing
             // a malformed `CadrePeer.PeerId` — so one bad row cannot abort the pass.
             counts[await mergePeerAddrs(controlNode, sibling.peerId, addrs)]++;
@@ -2413,6 +2678,40 @@ export class CadreNode {
         log('reconcileControlCohort: address book warmed (siblings=%d, merged=%d, restamped=%d, skipped=%d, failed=%d)', resolved.size, counts.merged, counts.restamped, counts.skipped, counts.failed);
         return resolved;
     }
+    /**
+     * Replace a sibling's retained out-of-band dial target (see
+     * {@link bootstrapPeerStore}) with the addresses its signed record just resolved
+     * to, when the two differ — so an address change this node saw while the record
+     * was fresh (a new port, a new LAN address) is what it dials after a relaunch
+     * that outlives the record's freshness window.
+     *
+     * Only a sibling that already HAS an entry (`retained`) is refreshed: the store
+     * holds peers learned out of band and must not grow into a copy of every
+     * sibling's addresses. An empty resolution leaves the entry alone — a stale or
+     * not-yet-signed record is exactly when the entry is needed. The comparison is
+     * order-insensitive and runs on the retained addresses after binding them to the
+     * peer id, so an entry recorded without `/p2p/` suffixes is not rewritten merely
+     * for lacking them.
+     *
+     * NOTE: replaces rather than merges, so the entry becomes exactly what the
+     * sibling announces. If a node's signed record ever lists fewer addresses this
+     * node can reach than it was added with (say an announce override naming only a
+     * public address, for a node added by its LAN address), a relaunch dials the
+     * worse set; merge the two lists here if that shows up.
+     */
+    refreshDialHint(peerId, resolved, retained) {
+        if (!retained || resolved.length === 0) {
+            return;
+        }
+        // Both lists are de-duplicated by `normalizeDialAddrs`, so equal size plus
+        // containment is set equality.
+        const current = resolved.map((addr) => addr.toString());
+        const previous = new Set(this.bootstrapDialAddrs(peerId, retained).map((addr) => addr.toString()));
+        if (current.length === previous.size && current.every((addr) => previous.has(addr))) {
+            return;
+        }
+        this.retainDialTarget(peerId, current, 'refreshDialHint');
+    }
     /**
      * {@link resolvePeerAddrs} for one sibling, best-effort: a control-DB read
      * failure yields `[]` (and the cold-start fallback then gets its turn) rather
@@ -2428,25 +2727,31 @@ export class CadreNode {
         }
     }
     /**
-     * Budget for ONE proactive dial of the reconcile pass — steady-state sibling
+     * Time limits for dialing ONE control-network peer from its candidate
+     * addresses ({@link dialPeerAddrs}): the reconcile pass's steady-state sibling
      * ({@link dialControlSibling}) and cold-start bootstrap peer
-     * ({@link dialBootstrapPeer}) alike, since both feed a whole address list to
-     * one `dial()` and both run in a sequential loop that the next entry waits on.
+     * ({@link dialBootstrapPeer}) dials, and — handed to every
+     * {@link SeedBootstrapService} this node builds — `applySeed`'s owner dials and
+     * `dialInvite`.
      *
-     * See {@link DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS} for why the pass bounds
-     * this itself rather than inheriting each address's libp2p attempt timeout.
+     * See {@link DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS} for why a peer's dial is
+     * bounded as a whole, and {@link DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS}
+     * for why each address is bounded as well.
      */
-    controlDialTimeoutMs() {
-        return this.config.network?.controlCohort?.dialTimeoutMs
-            ?? DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS;
+    controlDialBudget() {
+        const cohort = this.config.network?.controlCohort;
+        return {
+            perAddressMs: cohort?.perAddressDialTimeoutMs ?? DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS,
+            totalMs: cohort?.dialTimeoutMs ?? DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS,
+        };
     }
     /**
      * Dial one sibling from its already-resolved addresses, best-effort. Returns
-     * whether a dial was attempted (false when no address resolves).
+     * whether the dial resolved (false when no address resolves or the dial fails).
      *
      * A per-peer failure (NAT, offline, relay down, connection-gater denial, or
-     * the {@link controlDialTimeoutMs} budget expiring) is logged and swallowed so
-     * one unreachable sibling never aborts the pass — exactly like
+     * the {@link controlDialBudget} expiring) is logged and swallowed so one
+     * unreachable sibling never aborts the pass — exactly like
      * {@link SeedBootstrapService.applySeed}'s owner-dial loop. A failed dial is
      * simply retried on the next pass.
      */
@@ -2462,7 +2767,7 @@ export class CadreNode {
         }
         try {
             log('reconcileControlCohort: dialing sibling %s (%d addr(s))', sibling.peerId, addrs.length);
-            await withDeadline(this.controlDialTimeoutMs(), `reconcileControlCohort dial of sibling ${sibling.peerId}`, (signal) => controlNode.dial(addrs, { signal }));
+            await dialPeerAddrs(controlNode, addrs, this.controlDialBudget(), `reconcileControlCohort dial of sibling ${sibling.peerId}`);
             return true;
         }
         catch (error) {
@@ -2471,20 +2776,65 @@ export class CadreNode {
         }
     }
     /**
-     * A sibling's control-network dial addresses for the reconcile pass.
+     * A sibling's control-network dial addresses for the reconcile pass, from the
+     * first of three sources that yields any:
+     *
+     *  1. the signed, fresh, trust-gated control addresses `resolved` for it by
+     *     {@link warmSiblingAddrBook} — passed in rather than re-resolved, so the
+     *     pass makes one record query per sibling;
+     *  2. the libp2p address book ({@link peerStoreAddrs}) — the entries `applySeed`
+     *     and identify put there, until they age out;
+     *  3. the sibling's retained out-of-band dial target ({@link retainedDialAddrs}).
+     *     For a node that cannot listen, this is the only source for a sibling it
+     *     added but has not yet connected to: the added node's row stays unsigned
+     *     until it self-publishes, which needs the connection this dial opens. It is
+     *     also what a relaunch that outlived the record's freshness window uses.
+     *
+     * Returns `[]` (never throws) when none yields an address — that sibling is
+     * skipped this pass.
      *
-     * Primary (steady state): the signed, fresh, trust-gated control addresses
-     * `resolved` for it by {@link warmSiblingAddrBook} — passed in rather than
-     * re-resolved, so the pass makes one record query per sibling. Fallback (cold
-     * start): the libp2p peerStore entries `applySeed` populated, used only while
-     * the record is not yet resolvable. Returns `[]` (never throws) when neither
-     * yields an address — that sibling is skipped this pass.
+     * The list may name transports this node cannot dial (a lent node reports TCP
+     * and `/ws` addresses to a phone that dials WebSockets only). That needs no
+     * filtering here: libp2p's dial queue (`calculateMultiaddrs`, libp2p 3.1.3)
+     * rejects an address no transport can dial before touching the network, so
+     * such an address costs a log line.
+     *
+     * The list is NOT handed to one `dial()`. libp2p tries a multi-address dial's
+     * addresses one after another under a single deadline, with no limit per
+     * address, and sorts loopback addresses last — so one or two addresses that
+     * never answer used up the whole deadline before the address that worked was
+     * tried. {@link dialPeerAddrs} dials each address on its own time limit instead.
      */
     async resolveControlDialAddrs(peerId, resolved) {
         if (resolved.length > 0) {
             return resolved;
         }
-        return this.peerStoreAddrs(peerId);
+        const booked = await this.peerStoreAddrs(peerId);
+        if (booked.length > 0) {
+            return booked;
+        }
+        return this.retainedDialAddrs(peerId);
+    }
+    /**
+     * A sibling's retained out-of-band dial target (see {@link bootstrapPeerStore}),
+     * bound to its peer id through {@link bootstrapDialAddrs}; `[]` when it has none.
+     *
+     * These addresses are never merged into the libp2p address book: they are
+     * unverified, and the address book takes only verified ones (see
+     * `mergePeerAddrs`). Layers that dial by bare peer id use the connection this
+     * dial opens, and after it drops the next reconcile pass dials again.
+     *
+     * NOTE: an entry is consulted here only for a current sibling, so a peer revoked
+     * by another owner is not dialed from it, even though the entry stays (only this
+     * node's own {@link removePeer} forgets one). The cold-start branch
+     * ({@link dialColdStartBootstrap}) still dials every entry while there are no
+     * siblings at all; if entries for revoked peers ever cause dial churn there,
+     * prune entries whose peer has a retired `CadrePeer` row during the membership
+     * refresh.
+     */
+    retainedDialAddrs(peerId) {
+        const entry = this.bootstrapPeerStore?.all().get(peerId);
+        return entry ? this.bootstrapDialAddrs(peerId, entry.addrs) : [];
     }
     /**
      * Cold-start fallback: the libp2p peerStore multiaddrs for `peerId` (seeded by
@@ -2532,37 +2882,55 @@ export class CadreNode {
      * signature-checked against a trust-anchored signer before this runs, and the
      * flag only *selects a dial target*; a dial grants no authority.
      *
-     * Self is excluded. `createSeed` projects EVERY `CadrePeer` row, so an owner
-     * that applies a seed minted after it joined finds itself in the owner list;
-     * retaining that would make the cold-start pass dial this node forever (the
-     * steady-state pass filters self out of its sibling list for the same reason).
+     * Addressless peers and self are skipped by {@link retainDialTarget}.
      */
     recordSeedBootstrapPeers(seed) {
+        for (const peer of seed.peers) {
+            if (peer.isOwner) {
+                this.retainDialTarget(peer.peerId, peer.multiaddrs, 'recordSeedBootstrapPeers');
+            }
+        }
+    }
+    /**
+     * Retain (or replace) one peer's out-of-band dial target in
+     * {@link bootstrapPeerStore}. Shared by every writer: seed intake, {@link addDrone}
+     * and {@link refreshDialHint}.
+     *
+     * Fire-and-log: the entry is visible synchronously by the store's contract, and
+     * the promise tracks durability only. A persist failure costs restart survival,
+     * never this session's dial set — the same trade
+     * `SeedBootstrapService.anchorAcceptedSigner` makes — so it is logged rather than
+     * failing a seed or an add that has already been accepted.
+     *
+     * Two peers are never retained. One with no address: there is nothing to dial.
+     * And self: `createSeed` projects EVERY `CadrePeer` row, so an owner that applies
+     * a seed minted after it joined finds itself in the owner list, and `addDrone`
+     * could be handed this node's own id. Retaining self would make the cold-start
+     * pass dial this node forever (the steady-state pass filters self out of its
+     * sibling list for the same reason).
+     */
+    retainDialTarget(peerId, addrs, caller) {
         const store = this.bootstrapPeerStore;
         if (!store) {
             // Unreachable in production: start() builds the store before any network
-            // bring-up, and both intake paths need a started node (an uninitialized
-            // SeedBootstrapService rejects the seed, so noteAppliedSeed returns early).
-            log('recordSeedBootstrapPeers: no bootstrap-peer store yet; retaining nothing');
+            // bring-up, and every caller needs a started node (an uninitialized
+            // SeedBootstrapService rejects a seed or an add, and the reconcile pass
+            // needs a running one).
+            log('%s: no bootstrap-peer store yet; not retaining %s', caller, peerId);
             return;
         }
-        const selfPeerId = this.controlNode?.peerId.toString();
-        for (const peer of seed.peers) {
-            if (!peer.isOwner || peer.multiaddrs.length === 0 || peer.peerId === selfPeerId) {
-                continue;
-            }
-            // Sync-visible by contract; the promise tracks durability only. A persist
-            // failure costs restart survival, never this session's retry set — the same
-            // trade `SeedBootstrapService.anchorAcceptedSigner` makes — so log and carry
-            // on rather than failing the seed that was already accepted.
-            void store.record(peer.peerId, peer.multiaddrs).catch((error) => {
-                log('recordSeedBootstrapPeers: persisting bootstrap peer %s failed (retained in memory): %o', peer.peerId, error);
-            });
+        if (addrs.length === 0 || peerId === this.controlNode?.peerId.toString()) {
+            return;
         }
+        void store.record(peerId, addrs).catch((error) => {
+            log('%s: persisting dial target %s failed (retained in memory): %o', caller, peerId, error);
+        });
     }
     /**
-     * Cold-start branch of the reconcile pass: re-dial the seed's owner peers
-     * while the control database still has no siblings to dial.
+     * Cold-start branch of the reconcile pass: re-dial every retained out-of-band
+     * dial target (see {@link bootstrapPeerStore}) — in practice the owner peers of
+     * the seeds this node applied — while the control database still has no
+     * siblings to dial.
      *
      * `SeedBootstrapService.applySeed` dials those owners exactly ONCE, best-effort.
      * When that single dial fails — owner momentarily down, relay reservation not
@@ -2589,14 +2957,14 @@ export class CadreNode {
         // cannot mutate what we are iterating.
         const targets = this.bootstrapPeerStore?.all();
         if (!controlNode || !targets || targets.size === 0) {
-            return;
+            return [];
         }
         // Same skip rule as step 3 of the steady-state pass: no churn on live links.
         const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
-        let dialed = 0;
+        const dialed = [];
         for (const [peerId, entry] of targets) {
             if (!this._running || !this.controlNode) {
-                return;
+                return dialed;
             }
             // NOTE: a connection this node still holds in `status: 'open'` after the remote
             // has already aborted it counts as connected here, so the cold-start retry stays
@@ -2609,19 +2977,21 @@ export class CadreNode {
                 continue;
             }
             if (await this.dialBootstrapPeer(peerId, entry.addrs)) {
-                dialed++;
+                dialed.push(peerId);
             }
         }
-        log('reconcileControlCohort: cold-start pass complete (bootstrap=%d, connected=%d, dialed=%d)', targets.size, connected.size, dialed);
+        log('reconcileControlCohort: cold-start pass complete (bootstrap=%d, connected=%d, dialed=%d)', targets.size, connected.size, dialed.length);
+        return dialed;
     }
     /**
-     * Bind a bootstrap peer's seed addresses to its peer id, so the dial
-     * authenticates the peer it is aiming at rather than trusting whoever answers.
+     * Bind a retained dial target's addresses (see {@link bootstrapPeerStore}) to
+     * its peer id, so the dial authenticates the peer it is aiming at rather than
+     * trusting whoever answers.
      *
      * The same {@link normalizeDialAddrs} rule the resolved and address-book paths
      * use, on the third and last source of control-dial candidates: an address that
      * already terminates in `/p2p/<id>` must carry THIS peer's id or it is dropped
-     * (a seed that disagrees with itself is not a dial target); one that does not —
+     * (an entry that disagrees with itself is not a dial target); one that does not —
      * a bare listen addr, or a relay hop with the destination missing — gets the id
      * encapsulated; an unencapsulatable one is dropped rather than dialed bare.
      */
@@ -2641,7 +3011,7 @@ export class CadreNode {
         }
         try {
             log('reconcileControlCohort(cold-start): dialing bootstrap peer %s (%d addr(s))', peerId, parsed.length);
-            await withDeadline(this.controlDialTimeoutMs(), `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`, (signal) => controlNode.dial(parsed, { signal }));
+            await dialPeerAddrs(controlNode, parsed, this.controlDialBudget(), `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`);
             return true;
         }
         catch (error) {
@@ -3308,6 +3678,13 @@ export class CadreNode {
             // (register a config + addStrand); the strand-agnostic seam keeps this
             // class free of any app's join policy. A self-configured strand (config
             // already present) keeps auto-starting below, unchanged.
+            //
+            // Recorded BEFORE the emit so a handler that synchronously drains
+            // `getDiscoveredStrands()` sees this strand too. The watcher never offers
+            // the same strand twice (its `knownStrands` retains the id for the life of
+            // the process), so this map — not the event — is what a late subscriber
+            // reads. See the `strand:discovered` doc in types.ts.
+            this.discoveredStrands.set(strand.Id, strand);
             this.emit('strand:discovered', { strandId: strand.Id, strand });
             return;
         }
@@ -3413,8 +3790,10 @@ export class CadreNode {
         }
         // Stop all strand instances
         await this.strandManager.stopAll();
-        // Clear sApp configs
+        // Clear sApp configs, recorded launch refusals and the unclaimed-strand backlog
         this.sAppConfigs.clear();
+        this.strandLaunchRefusals.clear();
+        this.discoveredStrands.clear();
         // Drop delegate-admission state: the grants are scoped to the session that
         // recorded them, so a stop()/start() cycle on this object must not keep
         // admitting delegates announced under the previous one, nor carry stale
@@ -3435,6 +3814,7 @@ export class CadreNode {
         if (this.controlDatabase) {
             this.controlDatabase.setMembershipChangeListener(null);
             this.controlDatabase.setGuardedDeleteListener(null);
+            this.controlDatabase.setControlWriteAbandonedListener(null);
             await this.controlDatabase.close();
             this.controlDatabase = null;
         }
@@ -3461,6 +3841,21 @@ export class CadreNode {
         // healthy and make the embedder's retry a no-op ("already running").
         this._running = false;
     }
+    /**
+     * A gated joiner's database was just published (`StartStrandConfig.onWritable`): the
+     * instance is `'active'` now, so re-arm its idle timer as any activity would. Nothing
+     * records activity on a gated joiner, so its idle timer may already have fired — the
+     * instance read `'idle'` with a hibernate timer pending — and without this the flip
+     * back to `'active'` would leave that timer to quiesce a strand the app just started
+     * using. Emits `strand:writable` after the timers are settled.
+     */
+    handleStrandWritable(strandId) {
+        const instance = this.strandManager.getInstance(strandId);
+        if (instance) {
+            this.hibernationManager.recordActivity(instance);
+        }
+        this.emit('strand:writable', { strandId });
+    }
     // Hibernation callbacks
     async handleStrandIdle(strandId) {
         const instance = this.strandManager.getInstance(strandId);
@@ -3510,9 +3905,10 @@ export class CadreNode {
             log('handleStrandWake: strand %s not found', strandId);
             return;
         }
-        // Still live (idle wake, or defensive double-wake): no rebuild needed.
+        // Still live (idle wake, or defensive double-wake): no rebuild needed. A joiner
+        // still behind its first-sync gate wakes back to `'syncing'`, not `'active'`.
         if (instance.libp2pNode || instance.database) {
-            instance.status = 'active';
+            instance.status = liveStrandStatus(instance);
             instance.lastActivity = new Date();
             log('Strand %s woke (already live)', strandId);
             this.emit('strand:waking', { strandId });
@@ -3630,7 +4026,7 @@ export class CadreNode {
         await this.holdWakeWindow(instance, windowMs);
         const sawActivity = instance.lastActivity !== activityMark;
         if (sawActivity) {
-            instance.status = 'active';
+            instance.status = liveStrandStatus(instance);
             this.emit('strand:waking', { strandId });
             log('Wake window: strand %s saw activity during the window; staying active', strandId);
             return true;
@@ -3687,25 +4083,72 @@ export class CadreNode {
      *
      * A rejected call leaves nothing running but DOES leave the sApp config
      * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
-     * automatic relaunch need it. So once the strand's row is visible on the control
-     * network (via {@link publishStrand} or another member), a failed launch keeps
-     * being re-attempted in the background — each failure re-emitting `strand:error`
-     * — until it succeeds. {@link detachStrand} (reached via {@link stopStrand}) is
-     * what abandons a strand for good.
+     * automatic relaunch need it. That background relaunch covers only a strand the
+     * WATCHER launched: it forgets a row whose `onStrandAdded` threw and re-attempts it
+     * on a later poll (each failure re-emitting `strand:error`) until it succeeds. A
+     * strand claimed here after it was DISCOVERED gets no such retry — the watcher
+     * already recorded it in its `knownStrands` when it offered it as
+     * `strand:discovered`, and no later poll re-offers a strand it knows. This call has
+     * also already dropped it from {@link getDiscoveredStrands}, so a failed claim
+     * leaves the strand dormant until the caller retries or the node restarts (see
+     * `backlog/bug-discovered-strand-lost-when-claim-fails`).
+     * {@link detachStrand} (reached via {@link stopStrand}) is what abandons a strand
+     * for good.
      */
     async addStrand(config) {
         if (!this._running) {
             throw new Error('CadreNode not running');
         }
-        const { strandRow, sAppConfig, founder } = config;
-        // Store sApp config for this strand
+        const { strandRow, sAppConfig, founder, partyMemberPrivateKey } = config;
+        if (partyMemberPrivateKey !== undefined && strandRow.Type !== 'c') {
+            // Only a closed strand seats a Member/Manager, so an open launch would drop this
+            // key silently. Refuse instead: the caller has confused the party identity key
+            // with something an open strand uses, and a silent drop hides that.
+            throw new Error(`addStrand(${strandRow.Id}): partyMemberPrivateKey belongs to a CLOSED strand ` +
+                `(Type 'c'), but this row is Type '${strandRow.Type}' — an open strand seats no ` +
+                'Member/Manager, so the key would be ignored.');
+        }
+        // Store sApp config for this strand. The strand is claimed now, so it leaves the
+        // unclaimed backlog — a later `getDiscoveredStrands()` drain must not re-offer it.
         this.sAppConfigs.set(strandRow.Id, sAppConfig);
+        this.discoveredStrands.delete(strandRow.Id);
         log('Registered sAppConfig for strand %s (sApp: %s, founder: %s)', strandRow.Id, sAppConfig.id, founder ?? 'derived');
         // An unset `founder` is DERIVED from the row inside launchStrand (this node founds
         // iff the row's FounderOwnerKey is its own owner key); an explicit flag wins — the
         // formation/responder flows pass one deliberately, since their consent-seated rows
-        // carry a null column. See StrandConfig.founder.
-        return await this.launchStrand(strandRow, sAppConfig, founder);
+        // carry a null column. See StrandConfig.founder. Same rule for the explicit
+        // partyMemberPrivateKey: it wins over the StrandPartyKey control-row read.
+        const instance = await this.launchStrand(strandRow, sAppConfig, founder, partyMemberPrivateKey);
+        // The first-sync write gate: a JOINING machine's database is withheld until it has
+        // received the strand's Header from another member, because a write before that
+        // forks every table it touches (see strand-first-sync-gate.ts). Waiting here is what
+        // lets an app write straight after `addStrand` resolves — the reference chat apps
+        // do — so the default is to wait, bounded by `strandFirstSync.timeoutMs`. A timeout
+        // rejects with the retryable `StrandAwaitingFirstSyncError` and leaves the launch
+        // up: this same call, made again once a member is reachable, completes the attach
+        // (the tracked-instance path above returns the still-syncing instance, and this
+        // wait picks it up). Founders and machines that already hold the Header resolve at
+        // once. Only a LIVE gated instance is waited on — a hibernating one is returned as
+        // it always was (no database either; a wake publishes it).
+        if (config.awaitFirstSync !== false && this.strandManager.isAwaitingFirstSync(strandRow.Id)) {
+            await this.strandManager.whenWritable(strandRow.Id, { timeoutMs: this.config.strandFirstSync?.timeoutMs });
+        }
+        return instance;
+    }
+    /**
+     * Resolve once a launched strand is writable — its database published to the app and
+     * its status `'active'` — or reject with the retryable `StrandAwaitingFirstSyncError`
+     * after `timeoutMs` (default `strandFirstSync.timeoutMs`, else
+     * `DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS`). The promise form of the `strand:writable`
+     * event, for a caller that attached without waiting ({@link StrandConfig.awaitFirstSync}
+     * `false`) or that holds a strand the watcher launched. Resolves immediately for a
+     * strand that is already writable; rejects immediately for one this node does not run.
+     * A hibernating strand is not woken — wake it first if that is what is wanted.
+     */
+    async whenStrandWritable(strandId, options) {
+        return await this.strandManager.whenWritable(strandId, {
+            timeoutMs: options?.timeoutMs ?? this.config.strandFirstSync?.timeoutMs
+        });
     }
     /**
      * Publish a strand row to the shared control database under this node's own
@@ -3751,10 +4194,16 @@ export class CadreNode {
      * Failing loudly here is intentional: a silently-unpublished strand would run
      * as a local-only island that no peer could ever discover or join.
      *
+     * A CLOSED strand's publish also seats this party's own membership identity key —
+     * the `StrandPartyKey` row {@link ensureStrandPartyKey} documents — which is what the
+     * founder bootstrap derives `Member.Key`/`Manager.MemberKey` from. The
+     * `memberPrivateKey` ARGUMENT stays the strand-wide read secret formation hands to
+     * joiners; it derives nobody's identity.
+     *
      * @param strandId - Unique strand identifier (typically the same id passed to
      *   {@link addStrand}).
      * @param type - `'o'` for open (default) or `'c'` for closed.
-     * @param memberPrivateKey - Optional membership key for a closed strand.
+     * @param memberPrivateKey - Optional shared membership (read) key for a closed strand.
      * @returns The live `Strand` row — the one just inserted, or the matching one already
      *   there. A closed strand's caller should carry THIS row's `MemberPrivateKey` forward:
      *   on a repeat it is the stored key, not the argument.
@@ -3792,6 +4241,13 @@ export class CadreNode {
             // so a re-seat is not mistaken for a repeat.
             const matched = requireMatchingStrandRow(existing, desired, 'is already published');
             log('publishStrand(%s): already published (type %s) with identical content — no-op', trimmed, type);
+            // A closed strand THIS machine published must hold a party key (its own membership
+            // identity — see ensureStrandPartyKey). Insert-if-absent, so the ordinary repeat
+            // is a read-only no-op and a publish interrupted between the row insert and the
+            // mint heals here. A row another machine published is that machine's to mint for.
+            if (type === 'c' && this.isSelfFoundedRow(matched)) {
+                await this.ensureStrandPartyKey(trimmed);
+            }
             return matched;
         }
         try {
@@ -3814,6 +4270,14 @@ export class CadreNode {
             return requireMatchingStrandRow(landed, desired, 'landed concurrently from another founder');
         }
         log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signingKey.publicKeyB64);
+        // A closed strand's publish also mints this party's own membership identity key
+        // (StrandPartyKey) — the key the founder bootstrap derives Member/Manager from,
+        // deliberately distinct from the shared memberPrivateKey argument above. A failure
+        // here surfaces (the strand row has already committed, so a retried publish takes
+        // the idempotent branch and heals the mint; so does the next founder launch).
+        if (type === 'c') {
+            await this.ensureStrandPartyKey(trimmed);
+        }
         return desired;
     }
     /**
@@ -3856,15 +4320,18 @@ export class CadreNode {
      *   a different `Type`, or either half rejects.
      */
     async foundStrand(config) {
-        const { strandId, type = 'o', memberPrivateKey, sAppConfig } = config;
+        const { strandId, type = 'o', memberPrivateKey, sAppConfig, awaitFirstSync } = config;
         if (!this._running || !this.controlDatabase) {
             throw new Error(`CadreNode must be started before attempting to found strand ${strandId}`);
         }
+        const controlDatabase = this.controlDatabase;
         const trimmed = requireNonBlank(strandId, 'strand id');
-        const published = await this.controlDatabase.queryStrand(trimmed);
+        const timed = (step, op) => timedStep('foundStrand', trimmed, step, op);
+        const tTotal = performance.now();
+        const published = await timed('queryStrand', () => controlDatabase.queryStrand(trimmed));
         const strandRow = published
             ? this.adoptPublishedStrand(published, type, memberPrivateKey)
-            : await this.publishStrand(trimmed, type, memberPrivateKey);
+            : await timed('publishStrand', () => this.publishStrand(trimmed, type, memberPrivateKey));
         // Derived, not hardcoded `true`: adopting a row another machine published means that
         // machine runs the bootstrap — this one must attach or it would write a second Header.
         const founded = this.isSelfFoundedRow(strandRow);
@@ -3873,7 +4340,8 @@ export class CadreNode {
                 '(FounderOwnerKey is not this node\'s owner key) — attaching as a joiner; ' +
                 'the founder bootstrap runs on the publishing machine', trimmed);
         }
-        const instance = await this.addStrand({ strandRow, sAppConfig, founder: founded });
+        const instance = await timed('addStrand', () => this.addStrand({ strandRow, sAppConfig, founder: founded, awaitFirstSync }));
+        timing(`[foundStrand:${trimmed}] total: ${Math.round(performance.now() - tTotal)}ms`);
         return { instance, strandRow, founded };
     }
     /**
@@ -3911,10 +4379,12 @@ export class CadreNode {
      * is an owner-signed control-plane write like every other, not "destroy the network".
      *
      * Irreversible for a closed strand (`Type='c'`): the row carries `MemberPrivateKey`,
-     * this party's membership secret for that network, and it is stored nowhere else.
-     * With it gone the party can never again admit a member to that closed strand, and a
-     * re-published row would carry a DIFFERENT key that does not match the membership
-     * already written into the strand's RBAC layer. The strand id itself is NOT
+     * this party's read secret for that network, and the strand's `StrandPartyKey` row —
+     * this party's own membership identity, removed (and tombstoned) in the SAME
+     * transaction — is stored nowhere else either. With both gone the party can never
+     * again sign as its seated member/manager there, and a re-published row mints a fresh
+     * identity that does not match the membership already written into the strand's RBAC
+     * layer. The strand id itself is NOT
      * blacklisted: a fresh owner-signed {@link publishStrand} re-seats it under a new
      * stamp — only the unsigned consent re-seat is permanently foreclosed (the removal's
      * `Revocation` tombstone names the id, which the consent branch of
@@ -3965,6 +4435,26 @@ export class CadreNode {
                 'row deletion itself cannot be replayed, so other nodes may keep running the strand ' +
                 'until the collection converges.', trimmed);
         }
+        // A refused pre-split launch left no tracked instance, so the stop below never
+        // reaches detachStrand for it — clear the refusal here so a re-founded id starts clean.
+        this.strandLaunchRefusals.delete(trimmed);
+        // Clear THIS machine's own MemberPeer binding while the strand runtime — and the
+        // retained party key — is still live: the delete above already destroyed the
+        // party's StrandPartyKey row, so once this process forgets the key nothing can
+        // ever sign the removal again. Runs AFTER the control delete so a rejected
+        // unpublish (unauthorized signer) never strips a binding the party still needs;
+        // best-effort by contract (never throws) — a hibernating or unreachable strand
+        // keeps the stale binding, which grants nothing today. Sibling machines observing
+        // this removal via their watchers do NOT clear their own bindings (see the NOTE on
+        // StrandInstanceManager.clearOwnMemberPeerBinding).
+        //
+        // NOTE: this makes unpublishStrand await a STRAND-NETWORK write it never used to —
+        // however long that write takes to reject or commit is now added to unpublish's
+        // wall-clock. Fine while strand writes fail fast on an unreachable quorum; if
+        // unpublish ever starts hanging on an isolated strand, give this call its own
+        // deadline rather than dropping it (a binding cleared late is still worth more than
+        // one never cleared).
+        await this.strandManager.clearOwnMemberPeerBinding(trimmed);
         // Converge locally now rather than waiting up to a poll interval. The watcher fires
         // onStrandRemoved for a strand it tracked; the explicit stop below covers a node whose
         // strandFilter never admitted this strand (the watcher never knew it, so it will never
@@ -3976,6 +4466,101 @@ export class CadreNode {
         }
         log('Unpublished strand %s from control DB under owner %s', trimmed, signingKey.publicKeyB64);
     }
+    /**
+     * Seat this party's own strand membership identity key — the `StrandPartyKey` row —
+     * for `strandId`, minting a fresh one when none is given, and adopting the stored one
+     * when a row already exists. Insert-if-absent and stable thereafter: the founding
+     * `Member.Key` must not change across restarts, or the bootstrap's insert-if-absent
+     * guards stop matching.
+     *
+     * This is the identity half of the closed-strand key split: the row's `PrivateKey` —
+     * NOT the strand row's shared `MemberPrivateKey`, which formation hands to every
+     * joining party — is what the founder bootstrap derives `Member.Key`/`Manager.MemberKey`
+     * from. It replicates to every machine this party owns (same plaintext-at-rest stance
+     * as `MemberPrivateKey`; docs/strands.md → "Closed-Strand Member Key Handling") and is
+     * never put on the formation wire.
+     *
+     * Called internally by {@link publishStrand} (closed strands mint at publish) and by a
+     * founder launch that finds no row (a publish interrupted before its mint); public so a
+     * test harness — or a joiner flow that persists a formation-issued identity — can seat
+     * a specific key deliberately.
+     *
+     * @param strandId - The strand the key is this party's identity for.
+     * @param partyMemberPrivateKey - Optional specific key (base64 protobuf, as
+     *   `generateStrandMemberKey` mints). When a row already holds a DIFFERENT key this
+     *   throws — a party has one identity per strand; rotation is a deliberate
+     *   remove-then-insert, not a silent swap.
+     * @returns The live party key: the one just seated, or the stored one.
+     */
+    async ensureStrandPartyKey(strandId, partyMemberPrivateKey) {
+        const trimmed = requireNonBlank(strandId, 'strand id');
+        const signingKey = this.requireOwnerSigningKey(`seat a party key for strand ${trimmed}`);
+        const existing = await this.controlDatabase.queryStrandPartyKey(trimmed);
+        if (existing !== null) {
+            if (partyMemberPrivateKey !== undefined && partyMemberPrivateKey !== existing) {
+                // Neither key is included: the party key is this party's membership identity secret.
+                throw new Error(`Strand ${trimmed} already has a party key and the supplied one differs. The stored ` +
+                    'key is the identity the strand membership was seated under; to rotate it, remove ' +
+                    'the row deliberately (deleteStrandPartyKey) rather than overwriting it.');
+            }
+            return existing;
+        }
+        const key = partyMemberPrivateKey ?? await generateStrandMemberKey();
+        try {
+            await this.controlDatabase.insertStrandPartyKey(trimmed, key, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+        }
+        catch (error) {
+            // The read and the insert are not atomic; a concurrent seat of the same strand's
+            // key can land in between. Adopt the landed row when it satisfies this request —
+            // the same resolution publishStrand applies to its own read-then-insert window —
+            // and rethrow every other rejection (unauthorized signer, retired stamp).
+            const landed = await this.controlDatabase.queryStrandPartyKey(trimmed);
+            if (landed === null || (partyMemberPrivateKey !== undefined && partyMemberPrivateKey !== landed)) {
+                throw error;
+            }
+            log('ensureStrandPartyKey(%s): lost a concurrent seat race; adopting the landed key', trimmed);
+            return landed;
+        }
+        log('Seated strand party key for %s under owner %s', trimmed, signingKey.publicKeyB64);
+        return key;
+    }
+    /**
+     * Resolve the party membership key a closed strand's launch threads into the founder
+     * bootstrap: the explicit attach-time key when given, else the party's persisted
+     * `StrandPartyKey` row, else — on the one machine whose owner key the row names as
+     * founder — a freshly minted-and-persisted key, which seats the identity for a publish
+     * that was interrupted before its mint. Everyone else resolves undefined: non-founding
+     * machines never mint (no mint race between a party's machines), and only a founder
+     * bootstrap needs the key at all.
+     *
+     * Minting does NOT repair a strand founded before the key split: its founding
+     * membership was seated under the shared `MemberPrivateKey`, and nothing re-seats it —
+     * the founder bootstrap refuses such a strand (`PreSplitStrandIdentityError`) instead.
+     *
+     * NOTE: "founding machine" here is the ROW's provenance, not the launch's resolved
+     * `founder` flag — so an explicit `founder: false` over a row this machine published
+     * still mints, an owner-signed write a caller that said "I am not founding" did not ask
+     * for. Harmless (the party needs that identity for the strand either way, and the mint
+     * is insert-if-absent) and unreachable today: the one explicit `founder: false` caller
+     * passes a row with a null `FounderOwnerKey`. If a caller ever pairs `founder: false`
+     * with its own published row, gate the mint on the resolved flag too.
+     */
+    async resolveStrandPartyKey(strand, explicitKey) {
+        if (explicitKey !== undefined) {
+            return explicitKey;
+        }
+        if (!this.controlDatabase) {
+            return undefined;
+        }
+        const stored = await this.controlDatabase.queryStrandPartyKey(strand.Id);
+        if (stored !== null) {
+            return stored;
+        }
+        if (!this.isSelfFoundedRow(strand)) {
+            return undefined;
+        }
+        return await this.ensureStrandPartyKey(strand.Id);
+    }
     /**
      * Publish an owner-signed `FormationInvite` (open-invitation token) to the
      * shared control database, so a later {@link formStrand} redemption can be
@@ -4120,24 +4705,61 @@ export class CadreNode {
      * now the tracked instance is founded in place
      * ({@link StrandInstanceManager.foundExistingStrand}), waking it first if quiesced
      * so the bootstrap actually runs before this resolves.
+     *
+     * A founder launch refused as pre-split (`PreSplitStrandIdentityError`) is recorded in
+     * {@link strandLaunchRefusals} for the formation arm, then rethrown; a founder launch
+     * that succeeds clears the record (it ran the bootstrap's pre-split check and passed).
      */
-    async launchStrand(strand, sAppConfig, founder) {
+    async launchStrand(strand, sAppConfig, founder, explicitPartyKey) {
         const resolvedFounder = founder ?? this.isSelfFoundedRow(strand);
+        try {
+            const instance = await this.startOrFoundStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey);
+            if (resolvedFounder) {
+                this.strandLaunchRefusals.delete(strand.Id);
+            }
+            return instance;
+        }
+        catch (error) {
+            if (error instanceof PreSplitStrandIdentityError) {
+                this.strandLaunchRefusals.set(strand.Id, error);
+            }
+            throw error;
+        }
+    }
+    /**
+     * The launch itself, for {@link launchStrand} (which documents the behaviour): found a
+     * tracked instance in place, or start a fresh one.
+     */
+    async startOrFoundStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey) {
+        const timed = (step, op) => timedStep('startOrFoundStrand', strand.Id, step, op);
         const existing = this.strandManager.getInstance(strand.Id);
         if (existing) {
             if (resolvedFounder) {
-                const outcome = await this.strandManager.foundExistingStrand(strand.Id);
+                // The resolver runs only when the retained config lacks a party key for a
+                // closed strand (see foundExistingStrand), so the common watcher re-entry
+                // ('already-founder') still costs no control read.
+                const outcome = await timed('foundExistingStrand', () => this.strandManager.foundExistingStrand(strand.Id, () => this.resolveStrandPartyKey(strand, explicitPartyKey)));
                 if (outcome === 'needs-resume') {
-                    // Quiesced instance: the retained config now founds, but founding promises
-                    // the bootstrap has RUN by the time the caller resolves — wake through the
-                    // hibernation manager (coalesced with any in-flight wake, timer-aware) so
-                    // the rebuild executes it now rather than at some eventual wake.
-                    await this.wakeStrand(strand.Id);
-                    // The wake's rebuild founds — UNLESS a wake was already in flight when the
-                    // config flipped, in which case it had already read the pre-flip config and
-                    // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
-                    // (insert-if-absent) bootstrap so founding never resolves headerless.
-                    await this.strandManager.ensureFounderBootstrap(strand.Id);
+                    try {
+                        // Quiesced instance: the retained config now founds, but founding promises
+                        // the bootstrap has RUN by the time the caller resolves — wake through the
+                        // hibernation manager (coalesced with any in-flight wake, timer-aware) so
+                        // the rebuild executes it now rather than at some eventual wake.
+                        await timed('wakeStrand', () => this.wakeStrand(strand.Id));
+                        // The wake's rebuild founds — UNLESS a wake was already in flight when the
+                        // config flipped, in which case it had already read the pre-flip config and
+                        // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
+                        // (insert-if-absent) bootstrap so founding never resolves headerless.
+                        await timed('ensureFounderBootstrap', () => this.strandManager.ensureFounderBootstrap(strand.Id));
+                    }
+                    catch (error) {
+                        // The founding did not happen (e.g. the rebuild refused a pre-split strand and
+                        // rolled back, leaving the instance tracked with no runtime): withdraw the flip
+                        // so the next attempt re-runs the founding instead of resolving
+                        // 'already-founder' over an instance that never founded.
+                        this.strandManager.withdrawFounderRequest(strand.Id);
+                        throw error;
+                    }
                 }
                 log('launchStrand: strand %s already tracked — founder request honored (%s)', strand.Id, outcome);
             }
@@ -4146,6 +4768,15 @@ export class CadreNode {
             }
             return existing;
         }
+        // A closed strand's launch carries the party's OWN membership identity key: the
+        // explicit attach-time key, else the control-layer StrandPartyKey row — minted here
+        // when this machine is the row-derived founder and no row exists yet (a publish
+        // interrupted before its mint). A joiner with no persisted key threads undefined;
+        // only a FOUNDER bootstrap needs the key, and that path throws loudly without one
+        // (StrandDatabase).
+        const partyMemberPrivateKey = strand.Type === 'c'
+            ? await timed('resolveStrandPartyKey', () => this.resolveStrandPartyKey(strand, explicitPartyKey))
+            : undefined;
         // Each strand node gets its own transport identity, derived from the cadre
         // identity key + strandId (see strand-transport-key.ts). Sharing the
         // control node's key here gave every node one peerId, which collides at a
@@ -4161,16 +4792,17 @@ export class CadreNode {
         // identity is ever supported, fall back to `undefined` here — libp2p then
         // generates a random per-strand key, which still avoids the collision but
         // gives up peerId stability across restarts.
-        const transportKey = this.identityKey
-            ? await strandTransportKey(this.identityKey, strand.Id)
+        const identityKey = this.identityKey;
+        const transportKey = identityKey
+            ? await timed('strandTransportKey', () => strandTransportKey(identityKey, strand.Id))
             : undefined;
         // Derived BEFORE seed resolution so the seed pass doubles as the delegate
         // announcement and every grant is recorded before `startStrand` runs
         // `libp2p.start()` (the responder records the grant before replying; the
         // client awaits the replies).
         const delegatePeerId = transportKey ? peerIdFromPrivateKey(transportKey).toString() : undefined;
-        const bootstrapNodes = await this.resolveCohortSeed(strand.Id, delegatePeerId);
-        const instance = await this.strandManager.startStrand({
+        const bootstrapNodes = await timed('resolveCohortSeed', () => this.resolveCohortSeed(strand.Id, delegatePeerId));
+        const instance = await timed('strandManager.startStrand', () => this.strandManager.startStrand({
             strandRow: strand,
             sAppConfig,
             storage: this.config.storage,
@@ -4190,16 +4822,36 @@ export class CadreNode {
             // are on `StartStrandConfig.servingMachines`.
             backfill: this.config.strandBackfill,
             revocationEnforcement: this.config.strandRevocationEnforcement,
+            membershipReconciliation: this.config.strandMembershipReconciliation,
             onSelfRevoked: (revokedStrandId) => this.emit('strand:revoked', { strandId: revokedStrandId }),
+            // The joiner's first-sync write gate (strand-first-sync-gate.ts): a launch that
+            // comes up `'syncing'` announces the moment its database is published.
+            firstSync: this.config.strandFirstSync,
+            onWritable: (writableStrandId) => this.handleStrandWritable(writableStrandId),
+            // Re-announce the delegate to ONE relay before the strand node's reservation
+            // supervisor re-drives it (see announceDelegateToRelay). Retained with the
+            // launch config, so a hibernation wake's rebuilt supervisors get it too.
+            announceDelegateToRelay: (announcedStrandId, relayAddr, announcedDelegatePeerId) => this.announceDelegateToRelay(announcedStrandId, relayAddr, announcedDelegatePeerId),
+            // The staged formation invitation seam for the bring-up membership
+            // reconciler: read lazily per pass (a re-formation replaces the entry) and
+            // cleared once spent, burned, or dead — see pendingMembershipInvites.
+            pendingMembershipInvite: {
+                get: () => this.pendingMembershipInvites.get(strand.Id),
+                clear: () => { this.pendingMembershipInvites.delete(strand.Id); }
+            },
             // The RESOLVED flag, never the raw argument — see the doc comment above.
-            founder: resolvedFounder
-        });
+            founder: resolvedFounder,
+            // Retained with the launch config, so a hibernation wake rebuilds under the
+            // same identity without re-reading the control DB.
+            partyMemberPrivateKey
+        }));
         // The seed reached the node as `bootstrapNodes`, which only enters the
         // address book via @libp2p/bootstrap discovery. Merge it directly too, so a
         // sibling is dialable by bare peer id from the first moment (see
         // mergeStrandPeerAddrs; refreshStrandPeerAddrs keeps it warm from here on).
-        if (instance.libp2pNode) {
-            await this.mergeStrandPeerAddrs(instance.libp2pNode, bootstrapNodes, strand.Id);
+        const strandNode = instance.libp2pNode;
+        if (strandNode) {
+            await timed('mergeStrandPeerAddrs', () => this.mergeStrandPeerAddrs(strandNode, bootstrapNodes, strand.Id));
         }
         this.hibernationManager.trackStrand(instance);
         this.emit('strand:started', { strandId: strand.Id });
@@ -4345,10 +4997,10 @@ export class CadreNode {
      * Recorded OPTIMISTICALLY at announce time: `collectStrandAddrs` folds
      * per-peer failure to `[]` and reports no per-peer success, and threading
      * success out would change its API for little gain. A failed INITIAL announce
-     * is fatal-at-start anyway (the relay denies the reservation,
-     * `libp2p.start()` throws, and wake/check-in re-resume retries with a fresh
-     * announce); a failed REFRESH retries within `DELEGATE_GRANT_TTL_MS / 2`
-     * (15 min), still inside the 30 min TTL.
+     * costs the strand supervisor its first attempt only (the relay denies the
+     * reservation; every re-drive re-announces first through
+     * {@link announceDelegateToRelay}); a failed REFRESH retries within
+     * `DELEGATE_GRANT_TTL_MS / 2` (15 min), still inside the 30 min TTL.
      */
     recordDelegateAnnounces(relayPeerIds, strandId, now = Date.now()) {
         for (const relayPeerId of relayPeerIds) {
@@ -4390,6 +5042,49 @@ export class CadreNode {
         }
         await Promise.all([...running].map(([strandId, delegatePeerId]) => this.announceDelegateToDueRelays(strandId, delegatePeerId, relays, now)));
     }
+    /**
+     * Announce ONE strand's delegate peerId to ONE relay, UNTHROTTLED — the
+     * `beforeRedrive` hook of that strand node's per-relay reservation supervisor
+     * (`strand-instance-manager.ts` → `buildStrandRuntime`), run before every
+     * re-drive after the first attempt.
+     *
+     * Why a re-drive must re-announce first: a party control node running the relay
+     * server admits the strand node's derived peerId on an in-memory delegate grant
+     * (`delegate-admission.ts`), and a relay restart drops every grant it held
+     * without telling the announcer. {@link refreshDelegateGrants} would re-announce
+     * on its own at most every `DELEGATE_GRANT_TTL_MS / 2` (15 min) per (relay,
+     * strand) — far slower than the supervisor's backoff — so without this the first
+     * re-drives after a relay restart would be denied at the relay's connection gate.
+     * The throttle map is updated afterwards, so the periodic pass does not announce
+     * again right away.
+     *
+     * Against a dedicated ops relay (no strand-addr RPC) the request fails per-peer
+     * and `collectStrandAddrs` folds it to `[]`: one wasted protocol negotiation per
+     * re-drive attempt, bounded by the supervisor's backoff. Never throws on that
+     * path; a relay addr that names no peer id is logged and skipped (the hook's
+     * caller runs the drive regardless).
+     *
+     * NOTE: against a relay that is DOWN this hook costs up to two strand-addr
+     * timeouts (10 s each: dial by peer id, then by addr) before the 10 s drive even
+     * starts, so one failed re-drive can hold the supervisor `driving` for ~30 s.
+     * Bounded and harmless while the relay is unreachable anyway; if recovery
+     * latency after a relay comes back ever matters, skip the announce when the
+     * control node holds no connection to the relay (the drive's own dial fails
+     * faster) rather than shortening the strand-addr timeout.
+     */
+    async announceDelegateToRelay(strandId, relayAddr, delegatePeerId) {
+        const controlNode = this.controlNode;
+        if (!controlNode) {
+            return;
+        }
+        const relayPeerId = trailingPeerId(multiaddr(relayAddr));
+        if (relayPeerId === null) {
+            log('announceDelegateToRelay: relay addr %s names no peer id; strand %s not announced', relayAddr, strandId);
+            return;
+        }
+        await collectStrandAddrs(controlNode, [{ peerId: relayPeerId, addrs: [multiaddr(relayAddr)] }], strandId, { delegatePeerId });
+        this.recordDelegateAnnounces([relayPeerId], strandId);
+    }
     /** One strand's share of {@link refreshDelegateGrants}: announce to the relays whose grant is due. */
     async announceDelegateToDueRelays(strandId, delegatePeerId, relays, now) {
         const controlNode = this.controlNode;
@@ -4616,8 +5311,12 @@ export class CadreNode {
     /**
      * Stop a strand on THIS node only: untrack it from hibernation, drop its sApp config,
      * stop the local instance, and emit `strand:stopped`. The shared `Strand` row is left
-     * intact, so on the next node restart (or watcher poll) the strand is rediscovered and
-     * surfaces as `strand:discovered` again. Party-wide removal is {@link unpublishStrand}.
+     * intact, so on the next node RESTART the strand is rediscovered and surfaces as
+     * `strand:discovered` again — not on the next watcher poll, which never re-offers a
+     * strand it has already seen (`StrandWatcher.knownStrands` retains the id for the life
+     * of the process). The stop also drops the strand from {@link getDiscoveredStrands},
+     * so a drain cannot undo a deliberate stop. Party-wide removal is
+     * {@link unpublishStrand}.
      */
     async stopStrand(strandId) {
         if (!this._running) {
@@ -4627,20 +5326,28 @@ export class CadreNode {
     }
     /**
      * Local teardown for one strand, shared by the caller-driven {@link stopStrand} and the
-     * watcher-driven `handleStrandRemoved`: untrack hibernation, drop the sApp config, stop
-     * the instance, emit `strand:stopped`. Touches no control-plane row — which side of the
-     * removal the node is on is the caller's concern, not this method's.
+     * watcher-driven `handleStrandRemoved`: untrack hibernation, drop the sApp config and any
+     * recorded launch refusal, stop the instance, emit `strand:stopped`. Touches no
+     * control-plane row — which side of the removal the node is on is the caller's concern,
+     * not this method's.
      *
      * The stop + emit are skipped when the strand manager holds no instance for `strandId` —
      * e.g. a party owner that published a strand's row but never ran it locally, or an
      * explicit {@link stopStrand} for an id this node never started. `hibernationManager`
-     * untrack and the `sAppConfigs` delete stay unconditional (both are no-ops when there is
-     * nothing to remove), so a launch that failed before an instance was ever tracked still
-     * gets its stray sApp config cleared.
+     * untrack and the `sAppConfigs` / {@link strandLaunchRefusals} / {@link discoveredStrands}
+     * deletes stay unconditional (all no-ops when there is nothing to remove), so a launch
+     * that failed before an instance was ever tracked still gets its stray entries cleared.
+     *
+     * Dropping the {@link discoveredStrands} entry here covers both callers, and both
+     * readings are the intended one: `handleStrandRemoved` arrives because the control row
+     * is gone, and an explicit {@link stopStrand} is a deliberate abandonment — neither
+     * strand may be re-offered to a later `getDiscoveredStrands()` drain.
      */
     async detachStrand(strandId) {
         this.hibernationManager.untrackStrand(strandId);
         this.sAppConfigs.delete(strandId);
+        this.strandLaunchRefusals.delete(strandId);
+        this.discoveredStrands.delete(strandId);
         if (!this.strandManager.hasStrand(strandId)) {
             log('detachStrand: strand %s not tracked locally — no-op (no stop, no strand:stopped)', strandId);
             return;
@@ -4856,6 +5563,11 @@ export class CadreNode {
      * relay indistinguishable from a hung start, and much shorter would fail nodes
      * on links that were merely slow. The retries carry on in the background after
      * this resolves, exactly as they do for a {@link reserveRelays} caller.
+     *
+     * `network.requireRelay === false` softens only the outcome below: a first
+     * attempt that lands no `/p2p-circuit` address is logged instead of thrown, and
+     * `start()` carries on with the retry supervisor already running in the
+     * background (the same supervisor {@link reserveRelays} always starts).
      */
     async driveControlRelayReservation() {
         const relayAddrs = this.config.network?.relayAddrs ?? [];
@@ -4866,6 +5578,11 @@ export class CadreNode {
         const state = await this.reserveRelays([...relayAddrs]);
         timing('[start] reserveRelays: %dms', Math.round(performance.now() - t0));
         if (state.status !== 'reserved') {
+            if (this.config.network?.requireRelay === false) {
+                log('Relay reservation did not land on the first attempt (status: %s); ' +
+                    'continuing without it because network.requireRelay is false: %o', state.status, state);
+                return;
+            }
             throw new RelayReservationFailedError(relayAddrs, state);
         }
         log('Reserved a relay slot: %o', state.circuitAddrs);
@@ -5001,6 +5718,7 @@ export class CadreNode {
             partyId: this.config.controlNetwork.partyId,
             ownerPrivateKey,
             inviteAddressResolver: () => this.resolveInviteAddresses(),
+            dialBudget: this.controlDialBudget(),
             trustPolicy: this.config.seedTrustPolicy,
             // Seed trust anchors on the node-local store (seeded just above with this
             // node's own genesis key), never on the replicated OwnerKey table.
@@ -5240,6 +5958,7 @@ export class CadreNode {
             partyId: this.config.controlNetwork.partyId,
             // No owner key - this node only receives seeds
             inviteAddressResolver: () => this.resolveInviteAddresses(),
+            dialBudget: this.controlDialBudget(),
             trustPolicy: this.config.seedTrustPolicy,
             // A listener-only node accepts a wire-delivered seed solely against this
             // anchor (there is no per-call override on the inbound handler): with no
@@ -5407,6 +6126,10 @@ export class CadreNode {
         await this.seedBootstrapService.authorizePeer({ peerId, multiaddrs });
         // Queue for re-replication if this committed local-only (no connected cohort).
         this.noteControlWrite(peerId, 'authorize');
+        // NOTE: unlike addDrone, `multiaddrs` is not retained as a dial target: the
+        // flows that vouch through here have the new peer reach this node (it applies a
+        // seed naming the owners, or it dialed in with an invite). If one ever vouches a
+        // peer that cannot reach this node, retain its addresses as addDrone does.
     }
     /**
      * Remove a previously-authorized peer from the cadre.
@@ -5423,6 +6146,13 @@ export class CadreNode {
         await this.seedBootstrapService.removePeer(peerId);
         // Track + loudly flag a delete that committed local-only (security-relevant).
         this.noteControlWrite(peerId, 'remove');
+        // A removed peer is no longer a dial target, however this node learned its
+        // address. Gone from the store synchronously; a persist failure only lets the
+        // entry reappear after a restart, so it is logged rather than failing a
+        // removal that has already committed.
+        void this.bootstrapPeerStore?.forget(peerId).catch((error) => {
+            log('removePeer: persisting the removal of dial target %s failed (forgotten in memory): %o', peerId, error);
+        });
     }
     /**
      * Create a seed from the current control network state.
@@ -5459,6 +6189,7 @@ export class CadreNode {
             const tempService = new SeedBootstrapService({
                 partyId: seed.partyId,
                 trustPolicy: this.config.seedTrustPolicy,
+                dialBudget: this.controlDialBudget(),
                 // The anchor is node-scoped, not service-scoped: a throwaway service
                 // must consult (and persist an accepted signer into) the SAME store the
                 // persistent one would, or a cold-start enrollment via this path would
@@ -5539,6 +6270,20 @@ export class CadreNode {
     /**
      * Add a drone to the cadre (for phone/server adding provider-hosted node).
      * Creates authorization and seed for drone initialization.
+     *
+     * Also retains the drone's handed-over addresses as a durable dial target (see
+     * {@link bootstrapPeerStore}). The drone cannot dial an owner that does not
+     * listen (a phone), and its `CadrePeer` row stays unsigned — so unresolvable —
+     * until it self-publishes over a connection; this node therefore has to open
+     * that connection from the addresses it was handed, on this launch or a later
+     * one.
+     *
+     * Nothing is dialed here: the drone has not received the seed yet. After
+     * delivering it, call {@link reconcileControlCohort} to dial straight away;
+     * otherwise the next timed reconcile pass does. A pass already in flight is
+     * joined rather than restarted, and one that listed siblings before this add
+     * does not dial the drone, so a caller waiting for the connection should allow
+     * for one more timed pass.
      */
     async addDrone(options) {
         if (!this.seedBootstrapService) {
@@ -5546,7 +6291,12 @@ export class CadreNode {
         }
         // The drone's `CadrePeer` insert notifies the membership hub on the way to the
         // seed, so the per-stream gate already admits it here.
-        return await this.seedBootstrapService.addDrone(options);
+        const result = await this.seedBootstrapService.addDrone(options);
+        // Same queueing as authorizePeer: a phone adding its first always-on node has
+        // no control connection, so the insert usually committed local-only.
+        this.noteControlWrite(options.dronePeerId, 'authorize');
+        this.retainDialTarget(options.dronePeerId, options.droneMultiaddrs, 'addDrone');
+        return result;
     }
     /**
      * Create an invite for a phone to join the cadre.
@@ -5619,6 +6369,7 @@ export class CadreNode {
             const tempService = new SeedBootstrapService({
                 partyId: invite.partyId,
                 trustPolicy: this.config.seedTrustPolicy,
+                dialBudget: this.controlDialBudget(),
             });
             if (this.controlNode && this.controlDatabase) {
                 tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
@@ -5648,7 +6399,11 @@ export class CadreNode {
             // Overrides any caller-supplied hook, exactly like partyId/cadrePeerAddrs: only
             // this node can say which strand-network addresses it is actually listening on,
             // and a wrong answer here seeds a joiner's mesh with addresses that reach nobody.
-            resolveStrandAddrs: (strandId) => this.getStrandMultiaddrs(strandId)
+            resolveStrandAddrs: (strandId) => this.getStrandMultiaddrs(strandId),
+            // Overridden on the same grounds: only this node holds the running strand
+            // instance's database and this party's `StrandPartyKey` identity, and a wrong
+            // issuer here would admit joiners under someone else's authority.
+            issueMembershipInvite: (strandId) => this.issueStrandMembershipInvite(strandId)
         });
         // Register as responder on the control node
         this.strandSolicitationService.registerResponder(this.controlNode);
@@ -5695,8 +6450,143 @@ export class CadreNode {
         }
         const result = await this.strandSolicitationService.formStrand(invitation, disclosure, this.controlNode);
         this.recordCrossPartyStrandAddrs(result.strandId, result.strandAddrs);
+        // A closed host strand's approval carries the joiner's own membership invitation —
+        // persist this party's identity key and stage the invitation for bring-up to redeem.
+        // Runs AFTER the addr recording so a persistence failure (which throws — see the
+        // method) still leaves the cross-party seed in place for a manual recovery.
+        if (result.membershipInvite) {
+            await this.adoptFormationMembershipInvite(result.strandId, result.membershipInvite);
+        }
         return result;
     }
+    /**
+     * Adopt an approved closed-strand formation's membership half on the JOINER:
+     *
+     * 1. Mint-or-reuse this party's own strand identity — {@link ensureStrandPartyKey}
+     *    with no explicit key returns the stored `StrandPartyKey` row when one exists (a
+     *    re-formation by an existing member party: lost addresses, an app reinstall with
+     *    an intact control DB) and mints + persists a fresh one otherwise. The invitation
+     *    will admit THIS key's public half as the `Strand.Member`.
+     * 2. Stage the invitation in {@link pendingMembershipInvites} for the strand
+     *    bring-up flow (`strand-node-binds-member-peer`) to redeem via `consumeInvite`.
+     *
+     * Throws — failing the whole {@link formStrand} — when the identity cannot be
+     * persisted: a joiner "joined" without a persistable identity could never become a
+     * member, and failing loudly beats a silent half-member. The formation itself has
+     * already succeeded by then and its one-time token is SPENT, so the error says so:
+     * recovery is fixing the underlying cause (no owner signing key / control DB write
+     * rejected) and redeeming a FRESH invitation.
+     */
+    async adoptFormationMembershipInvite(strandId, invite) {
+        try {
+            await this.ensureStrandPartyKey(strandId);
+        }
+        catch (error) {
+            throw new Error(`Formation for strand ${strandId} was approved (its one-time token is spent), but ` +
+                'persisting this party\'s membership identity (StrandPartyKey) failed — the joiner ' +
+                'cannot become a member without it. Fix the underlying cause, then redeem a fresh ' +
+                'invitation (the delivered one dies with this error).', { cause: error });
+        }
+        // NOTE: staging alone is not enough on a node whose reconciler for this strand has
+        // already finished. `StrandMembershipReconciler` latches a terminal stopped state on
+        // its `done` path and is rebuilt only by a strand relaunch, so a RE-formation against
+        // an already-launched strand stages an invitation no loop will ever look at. Harmless
+        // for a party that is still a member (the invitation would only be burned), and the
+        // live defect for one that has been REMOVED — which is exactly when an app re-forms.
+        // Tracked as `backlog/bug-removed-party-cannot-redeem-its-way-back`; pinned by
+        // `strand-party-removal-via-formation-e2e.integration.ts` (test 2).
+        this.pendingMembershipInvites.set(strandId, invite);
+        log('formStrand: staged membership invitation for strand %s (party key persisted)', strandId);
+    }
+    /**
+     * The pending single-use membership invitation a closed-strand formation carried back
+     * for `strandId`, or `undefined` when none is staged — the seam the strand bring-up
+     * membership reconciler (`strand-membership-reconciler.ts`) reads to redeem the
+     * joiner's `Strand.Member` seat. `undefined` therefore also means "already redeemed,
+     * burned, or found dead": the reconciler clears the entry as soon as it settles the
+     * invitation, so a caller polling this sees it disappear on its own. In-memory only;
+     * see {@link pendingMembershipInvites} for lifetime and re-formation semantics.
+     */
+    getPendingMembershipInvite(strandId) {
+        return this.pendingMembershipInvites.get(strandId);
+    }
+    /**
+     * Responder-side issuer behind the formation manager's `issueMembershipInvite` seam
+     * (see `StrandFormationManagerOptions.issueMembershipInvite` for the contract this
+     * implements): mint a single-use `Strand.Invite` against the LIVE host strand so a
+     * validated joiner can seat its own `Strand.Member` row.
+     *
+     * - Open host strand → `null` (no members, nothing to invite into).
+     * - Closed host strand whose founder launch was refused as pre-split
+     *   ({@link strandLaunchRefusals}) → rethrow the recorded `PreSplitStrandIdentityError`;
+     *   the manager maps it to the NON-retryable `HOST_STRAND_MUST_BE_RECREATED_REASON`.
+     * - Closed host strand with no `StrandPartyKey` row → throw: this party's identity is
+     *   the invite's issuing manager, and without it nothing can sign the issuance. (The
+     *   founder's publish/launch paths mint it, so this is a not-yet-converged sibling.)
+     *   The manager maps the throw to a clean retryable rejection BEFORE the formation
+     *   token is spent.
+     * - Closed host strand with no running local instance/database → throw, same mapping:
+     *   a joiner admitted without an invitation would look joined and never become a
+     *   member, and a responder not running the strand cannot serve its sync anyway.
+     * - Closed host strand whose LIVE rows carry the pre-split fingerprint
+     *   (`assertNotPreSplitStrand`) → throw `PreSplitStrandIdentityError`, same mapping as
+     *   the recorded refusal. Covers the responders that never ran a refused founder launch:
+     *   a sibling machine of the founding party, or a node restarted since the refusal.
+     *
+     * The recorded refusal is checked first: it is an in-memory read and the only
+     * permanent diagnosis. Identity is checked BEFORE the runtime: it is the cheaper read
+     * and the more actionable diagnosis when both are missing (a missing runtime is
+     * transient, a missing identity is not), and it keeps the branch reachable without
+     * standing a strand runtime up.
+     *
+     * The invitation expires `MEMBERSHIP_INVITE_TTL_MS` from now — see that constant for
+     * the slow-joiner / lost-result tradeoff.
+     *
+     * NOTE: the issuing identity must be a `Strand.Manager` (the schema's `InviteValid`
+     * gate), and only the FOUNDING party's key is seated as one. Today only the founder
+     * party can host a bound formation at all — a joining party never gets the host
+     * strand's control `Strand` row, so `resolveStrand` reports `missing` on it — so this
+     * never bites. If a joined party is ever able to host formations into a strand it
+     * joined (re-invite / multi-hop join), issuance here fails the manager gate and every
+     * such redemption rejects with the retryable-sounding
+     * `MEMBERSHIP_INVITE_UNAVAILABLE_REASON` forever; that flow needs manager delegation,
+     * not a retry.
+     */
+    async issueStrandMembershipInvite(strandId) {
+        if (!this.controlDatabase) {
+            throw new Error(`Cannot issue a membership invitation for strand ${strandId}: control database unavailable`);
+        }
+        const row = await this.controlDatabase.queryStrand(strandId);
+        if (!row) {
+            // The bound resolution saw this row moments ago; a vanished row is a concurrent
+            // unpublish — reject rather than invite into a strand this party just removed.
+            throw new Error(`Cannot issue a membership invitation for strand ${strandId}: its Strand row is gone`);
+        }
+        if (row.Type !== 'c') {
+            return null;
+        }
+        const refusal = this.strandLaunchRefusals.get(strandId);
+        if (refusal) {
+            throw refusal;
+        }
+        const partyKey = await this.controlDatabase.queryStrandPartyKey(strandId);
+        if (partyKey === null) {
+            throw new Error(`Cannot issue a membership invitation for closed strand ${strandId}: this party holds ` +
+                'no StrandPartyKey row for it (identity not yet converged from the machine that published it)');
+        }
+        const db = this.strandManager.getInstance(strandId)?.database?.getDatabase();
+        if (!db) {
+            throw new Error(`Cannot issue a membership invitation for closed strand ${strandId}: its runtime is ` +
+                'not live on this responder (not launched, hibernating, or quiescing)');
+        }
+        if (row.MemberPrivateKey) {
+            await assertNotPreSplitStrand(db, strandId, strandMemberKeyPair(row.MemberPrivateKey).publicKeyB64);
+        }
+        return await issueInvite(db, {
+            managerKeyPair: strandMemberKeyPair(partyKey),
+            expiration: Date.now() + MEMBERSHIP_INVITE_TTL_MS
+        });
+    }
     /**
      * Remember the responder's strand-network addresses for a strand this node just
      * formed, so the strand's discovery seed has something to work with when the app