@serfab/cadre-core 1.14.0 → 1.16.0

package/dist/strand-instance-manager.js

@@ -13,17 +13,25 @@ import { assertStrandScopeKey } from './storage-scope.js';
 import { StrandFirstSyncGate, StrandAwaitingFirstSyncError, strandFirstSyncComplete, DEFAULT_STRAND_FIRST_SYNC_TIMEOUT_MS } from './strand-first-sync-gate.js';
 import { DEFAULT_CONNECTION_MONITOR, resolveStrandClusterSize, strandClusterPolicy } from './types.js';
 import { strandNodeAddrs } from './strand-network-config.js';
+import { nodeTransportsOption } from './node-transports.js';
 import { resolveRelayServer } from './relay-server.js';
 import { strandCohortTopicOption } from './strand-reactivity.js';
 import { superviseRelayReservation } from './relay-reservation.js';
+import { strandRedialTimings, superviseStrandPeerRedial } from './strand-peer-redial.js';
+import { groupAddrsByPeerId } from './peer-addr-book.js';
 import { isCohortUnreachableRead } from './control-read-retry.js';
 import { declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayReservationBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 const log = debug('sereus:cadre:strand-manager');
 /**
  * How often a joining launch that could not build its database, because no seed peer had
- * answered, rebuilds its runtime (`StrandInstanceManager.deferUnreachableJoin`). Each attempt
- * starts a libp2p node and dials the seed, so it is spaced well above the first-sync gate's
- * probe cadence.
+ * answered, retries the build on its running libp2p node
+ * (`StrandInstanceManager.deferUnreachableJoin`). Each attempt composes a fresh database and
+ * re-reads the schema catalog over the network, so it is spaced well above the first-sync
+ * gate's probe cadence.
+ *
+ * NOTE: the 5 s dates from when each attempt also rebuilt the libp2p node. A joiner whose seed
+ * peer answered just after a failed attempt waits up to this long to become writable; if that
+ * wait shows up in a measured join, try a shorter first retry.
  */
 export const UNREACHABLE_JOIN_RETRY_MS = 5000;
 const timing = debug('sereus:cadre:timing');
@@ -194,6 +202,13 @@ export class StrandInstanceManager {
          * `CadreNode.reserveRelays`.
          */
         this.relaySupervisors = new Map();
+        /**
+         * The per-strand redial of the strand's other members (`strand-peer-redial.ts`), keyed by
+         * strand id. Same lifecycle as {@link relaySupervisors}: started in `buildStrandRuntime` once
+         * the libp2p node exists, stopped first in `releaseRuntime`, so a hibernating strand dials
+         * nobody and a resume redials over the new node.
+         */
+        this.peerRedials = new Map();
         /**
          * The resolved (cache-wrapped) raw storage per strand id — the instance's OWN
          * store, resolved once in `startStrand` and held until `stopStrand` disposes it.
@@ -216,10 +231,11 @@ export class StrandInstanceManager {
         this.strandStorages = new Map();
         /**
          * The runtime build in flight per strand id (`buildStrandRuntime`, from `startStrand` or
-         * `resumeStrand`), present until it settles. The instance is tracked for the whole build,
-         * with its database not yet constructed or not yet initialized, so a caller that must act
-         * on the FINISHED runtime ({@link attachSApp}, {@link whenRuntimeBuilt}) waits on this instead. A failed build's
-         * rejection belongs to the call that started it.
+         * `resumeStrand`, or a deferred join's database retry), present until it settles. The
+         * instance is tracked for the whole build, with its database not yet constructed or not yet
+         * initialized, so a caller that must act on the FINISHED runtime ({@link attachSApp},
+         * {@link whenRuntimeBuilt}) waits on this instead. A failed build's rejection belongs to the
+         * call that started it.
          */
         this.runtimeBuilds = new Map();
         /**
@@ -232,9 +248,9 @@ export class StrandInstanceManager {
          */
         this.transitions = new Map();
         /**
-         * The pending rebuild per strand id of a launch whose database could not be built
+         * The pending database retry per strand id of a launch whose database could not be built
          * because no seed peer had answered yet ({@link deferUnreachableJoin}). Cleared by
-         * {@link releaseRuntime}, so a stop, a quiesce or a resume cancels it.
+         * {@link releaseRuntime}, so a stop or a quiesce cancels it.
          */
         this.unreachableJoinRetries = new Map();
         this.stopping = false;
@@ -353,7 +369,7 @@ export class StrandInstanceManager {
     async trackRuntimeBuild(strandId, build) {
         this.runtimeBuilds.set(strandId, build);
         try {
-            await build;
+            return await build;
         }
         finally {
             if (this.runtimeBuilds.get(strandId) === build) {
@@ -386,10 +402,13 @@ export class StrandInstanceManager {
      * cohort-derived values. Storage is the
      * one input it does NOT re-read from `config`: that belongs to the instance and
      * comes from `strandStorages`.
+     *
+     * A database that cannot be built because no seed peer has answered yet does not fail the
+     * build: the runtime comes up `'syncing'` without it and the database phase alone is
+     * retried on the same node ({@link deferUnreachableJoin}).
      */
     async buildStrandRuntime(instance, config) {
         const strandId = instance.strandId;
-        const { sAppConfig } = config;
         // Refuse a bad `linkRoundTripMs` before any strand bring-up, for the reason
         // `CadreNode.start()` does: every budget derived from it here is behind a condition
         // (backfill disabled, no relay addrs), so a zero or NaN declaration would otherwise
@@ -403,9 +422,6 @@ export class StrandInstanceManager {
         // services must derive its prefix from the SAME string the node was built
         // with — hence one binding for both, not two literals that can drift.
         const networkName = `strand-${strandId}`;
-        // Set when the database build failed only because no seed peer has answered yet; see
-        // {@link deferUnreachableJoin}.
-        let joinWaitsForSeed = false;
         const protocolPrefix = `/optimystic/${networkName}`;
         // Whether this node runs the circuit-relay server, and its init — the same
         // resolution the control node takes from the same config (`relay-server.ts`).
@@ -521,7 +537,12 @@ export class StrandInstanceManager {
                 // remembered-serving fallback); dropping `persistence` brings back the split
                 // restart.
                 ...(config.networkState && { persistence: strandNetworkStatePersistence(config.networkState, strandId) }),
-                ...(config.network?.transports && { transports: config.network.transports }),
+                // With relays configured, built with libp2p's relay discovery off (given a transport
+                // list to wrap — `node-transports.ts`), so the supervisors below are the only thing
+                // that fills the bare `/p2p-circuit` slots: otherwise a cohort seed running the relay
+                // server takes one as soon as it connects (`relay-reservation.ts`, "WHY LIBP2P'S
+                // RELAY DISCOVERY IS SWITCHED OFF").
+                ...nodeTransportsOption(config.network, addrOptions, relayDialAddrs.length > 0),
                 ...(config.network?.noiseCrypto && { noiseCrypto: config.network.noiseCrypto }),
                 // Unconditional, and the same default the control node takes: every node of
                 // every party runs the monitor over its connection to a slow phone, so the
@@ -537,13 +558,12 @@ export class StrandInstanceManager {
                 ...optimysticDialLimits(config.network?.linkRoundTripMs),
                 // Listen entries plus the WebSocket transport switch they imply — a strand node
                 // announces nothing the operator configured (`strand-network-config.ts`), and
-                // spreads AFTER `transports` above because the switch is a no-op whenever the
-                // embedder supplied its own factories. The bare `/p2p-circuit` entries (one per
-                // relay) open no connection here; each registers a pending reservation that the
-                // matching supervisor below fills, which is what gives a NAT'd strand node a
-                // reachable relay slot — and works against a party-run relay because the launch
-                // path announced this strand's derived peerId to it first (delegate admission;
-                // see cadre-node.ts).
+                // spreads AFTER `transports` above because the switch is a no-op whenever a
+                // transport list was passed. The bare `/p2p-circuit` entries (one per relay) open
+                // no connection here; each registers a pending reservation that the matching
+                // supervisor below fills. That is what gives a NAT'd strand node a reachable relay
+                // slot — and works against a party-run relay because the launch path announced
+                // this strand's derived peerId to it first (delegate admission; see cadre-node.ts).
                 ...addrOptions,
                 // The raw configured gater (open strands), or the revocation-composed
                 // gater plus the fail-closed per-stream revoked-peer gate (closed
@@ -562,72 +582,37 @@ export class StrandInstanceManager {
             // map immediately so the failure rollback (releaseRuntime) stops them like every
             // other runtime component.
             this.relaySupervisors.set(strandId, this.startRelaySupervisors(strandId, node, relayDialAddrs, config));
-            // Create and initialize the StrandDatabase.
-            //
-            // Held by the first-sync gate (registered before initialize) rather than attached
-            // to the instance: a failed init is then cleaned up by releaseRuntime below through
-            // the gate (close() is safe on a partially-initialized db), and the app only ever
-            // sees `instance.database` once this machine is allowed to write to the strand.
-            t0 = performance.now();
-            const strandDb = new StrandDatabase({
-                strandId,
-                sAppConfig,
-                libp2pNode: node,
-                coordinatedRepo: node.coordinatedRepo,
-                // Founder bootstrap inputs: the strand's type drives which membership rows
-                // are written, and the PARTY's own key (partyMemberPrivateKey, resolved by the
-                // caller from the control-layer StrandPartyKey row) derives the founding
-                // Member/Manager key. The row's shared MemberPrivateKey rides along as the
-                // read-gating secret only — it derives nobody's identity.
-                strandType: config.strandRow.Type,
-                memberPrivateKey: config.strandRow.MemberPrivateKey ?? undefined,
-                partyMemberPrivateKey: config.partyMemberPrivateKey,
-                founder: config.founder
-            });
-            const gate = new StrandFirstSyncGate({
+            // Redials the strand's other members whenever none is connected, on the budget the
+            // declared link gives a relayed dial — what reconnects two restarted phones on a slow
+            // link, where FRET's own redial cannot (`strand-peer-redial.ts`). The relays are
+            // excluded by peer id: the node is connected to them throughout, and they are no member.
+            this.peerRedials.set(strandId, superviseStrandPeerRedial({
                 label: strandId,
-                database: strandDb,
-                onHeaderHeld: () => this.publishDatabase(instance, strandDb)
-            }, config.firstSync);
-            this.firstSyncGates.set(strandId, gate);
-            try {
-                await strandDb.initialize();
-            }
-            catch (error) {
-                joinWaitsForSeed = isCohortUnreachableRead(error);
-                throw error;
-            }
-            timing('[buildStrandRuntime:%s] strandDatabase.initialize: %dms', strandId, Math.round(performance.now() - t0));
-            // The first-sync write gate. A founder just wrote the Header in its bootstrap; any
-            // other machine may commit only once it holds the Header — which it can only have
-            // received from a peer (now, or on an earlier run over the same store) — and has read
-            // each App table once, so their collections are fetched too. Publishing the database
-            // is what makes the strand writable to the app; until then the instance stays
-            // `'syncing'` and the gate re-probes on its cadence. Everything armed below reads
-            // `instance.database` lazily, so the reconciler and enforcer wait with it — and
-            // `publishDatabase` kicks the reconciler when the wait ends, so a joiner's membership
-            // rows land with the strand rather than one retry later.
-            t0 = performance.now();
-            if (config.founder === true || await strandFirstSyncComplete(strandDb.getDatabase(), strandId)) {
-                this.publishDatabase(instance, strandDb);
-            }
-            else {
-                gate.start();
+                node,
+                seed: config.bootstrapNodes ?? [],
+                excluded: new Set(groupAddrsByPeerId([...relayDialAddrs]).keys()),
+                ...(revocationEnforcer && { isRevoked: (peerId) => revocationEnforcer.isRevoked(peerId) })
+            }, strandRedialTimings(config.network?.linkRoundTripMs)));
+            const databaseBuild = await this.buildStrandDatabase(instance, config, node);
+            if (!this.isCurrentRuntime(instance, node)) {
+                // A stop released this runtime during the database phase (`stopStrand` does not
+                // wait for builds); arming the loops below would restart them on a stopped node.
+                log('Strand %s was stopped while its runtime was being built', strandId);
+                return;
             }
-            timing('[buildStrandRuntime:%s] first-sync probe: %dms', strandId, Math.round(performance.now() - t0));
             // The membership reconciler: finish this party's join on every machine —
             // redeem a staged formation invitation if one is pending, then write the
             // durable machine→party binding (Strand.MemberPeer). Armed here, the one
-            // seam where the strand's transport peer id and a live Database both exist
-            // for launch AND hibernation resume, for closed strands that carry the
+            // seam where the strand's transport peer id exists and its database has been
+            // attempted, for launch AND hibernation resume, for closed strands that carry the
             // party's own membership key. start() kicks an immediate pass WITHOUT
             // awaiting it — a joiner at this instant has not synced the founder's rows
             // and may lack write quorum, so bring-up is never blocked; an unfinished join
             // then retries on a short doubling ladder capped at the configured
             // pollIntervalMs (which is also the flat cadence while nobody has admitted this
             // party yet), and the loop stops once the member row and this machine's own
-            // binding are both in place. Armed AFTER the gate above, so a gated launch
-            // always has a reconciler registered by the time the gate can publish.
+            // binding are both in place. Armed AFTER the database phase above, so a gated or
+            // deferred launch always has a reconciler registered by the time it can publish.
             if (config.strandRow.Type === 'c' && config.partyMemberPrivateKey
                 && config.membershipReconciliation?.enabled !== false) {
                 const reconciler = new StrandMembershipReconciler({
@@ -721,7 +706,12 @@ export class StrandInstanceManager {
             // No `lastActivity` stamp: bringing a runtime up is not activity. A check-in marks
             // activity before its resume and must see only what landed while the strand was up.
             instance.status = liveStrandStatus(instance);
-            if (instance.status === 'syncing') {
+            if (databaseBuild === 'awaiting-seed') {
+                // Armed only now that the build is over: a retry firing mid-build would find the
+                // build in flight.
+                this.deferUnreachableJoin(instance);
+            }
+            else if (instance.status === 'syncing') {
                 log('Strand %s launched as a joiner with no Strand.Header held yet — writes are withheld until ' +
                     'a member of the strand is reached', strandId);
             }
@@ -734,16 +724,105 @@ export class StrandInstanceManager {
             await this.releaseRuntime(instance).catch((cleanupErr) => {
                 log('buildStrandRuntime cleanup for strand %s also failed: %o', strandId, cleanupErr);
             });
-            if (joinWaitsForSeed) {
-                this.deferUnreachableJoin(instance, error);
-                return;
-            }
             throw error;
         }
     }
+    /**
+     * The database phase of a runtime build, on the libp2p node already attached: create the
+     * StrandDatabase, initialize it, then publish it or arm its first-sync gate. Run by
+     * {@link buildStrandRuntime} and again by each {@link retryUnreachableJoin}, with a new
+     * StrandDatabase per attempt.
+     *
+     * Returns `'awaiting-seed'` when initialize failed only because no seed peer has answered
+     * (`cohort-unreachable`): that attempt's database is closed and the node keeps running. Any
+     * other failure throws, with the attempt's database left with its gate for
+     * {@link releaseRuntime} to close.
+     */
+    async buildStrandDatabase(instance, config, node) {
+        const strandId = instance.strandId;
+        // Held by the first-sync gate (registered before initialize) rather than attached
+        // to the instance: a failed init is then cleaned up through the gate (close() is safe on
+        // a partially-initialized db), and the app only ever sees `instance.database` once this
+        // machine is allowed to write to the strand.
+        let t0 = performance.now();
+        const strandDb = new StrandDatabase({
+            strandId,
+            sAppConfig: config.sAppConfig,
+            libp2pNode: node,
+            coordinatedRepo: node.coordinatedRepo,
+            // Founder bootstrap inputs: the strand's type drives which membership rows
+            // are written, and the PARTY's own key (partyMemberPrivateKey, resolved by the
+            // caller from the control-layer StrandPartyKey row) derives the founding
+            // Member/Manager key. The row's shared MemberPrivateKey rides along as the
+            // read-gating secret only — it derives nobody's identity.
+            strandType: config.strandRow.Type,
+            memberPrivateKey: config.strandRow.MemberPrivateKey ?? undefined,
+            partyMemberPrivateKey: config.partyMemberPrivateKey,
+            founder: config.founder,
+            onCommitDurability: config.onCommitDurability,
+            onCommitHeld: config.onCommitHeld
+        });
+        const gate = new StrandFirstSyncGate({
+            label: strandId,
+            database: strandDb,
+            onHeaderHeld: () => this.publishDatabase(instance, strandDb)
+        }, config.firstSync);
+        this.firstSyncGates.set(strandId, gate);
+        try {
+            await strandDb.initialize();
+        }
+        catch (error) {
+            if (!isCohortUnreachableRead(error)) {
+                throw error;
+            }
+            await this.discardDatabaseAttempt(strandId, gate);
+            log('Strand %s: no seed peer has answered yet, so this joiner cannot build its database (%s); ' +
+                'its runtime stays up and the build is retried every %dms', strandId, error instanceof Error ? error.message : String(error), UNREACHABLE_JOIN_RETRY_MS);
+            return 'awaiting-seed';
+        }
+        timing('[buildStrandRuntime:%s] strandDatabase.initialize: %dms', strandId, Math.round(performance.now() - t0));
+        if (this.firstSyncGates.get(strandId) !== gate) {
+            // A stop released the runtime while initialize ran, closing this database through its
+            // gate part-way; close what initialize finished after that.
+            await strandDb.close();
+            return 'released';
+        }
+        // The first-sync write gate. A founder just wrote the Header in its bootstrap; any
+        // other machine may commit only once it holds the Header — which it can only have
+        // received from a peer (now, or on an earlier run over the same store) — and has read
+        // each App table once, so their collections are fetched too. Publishing the database
+        // is what makes the strand writable to the app; until then the instance stays
+        // `'syncing'` and the gate re-probes on its cadence. Everything armed after the database
+        // phase reads `instance.database` lazily, so the reconciler and enforcer wait with it —
+        // and `publishDatabase` kicks the reconciler when the wait ends, so a joiner's membership
+        // rows land with the strand rather than one retry later.
+        t0 = performance.now();
+        const synced = config.founder === true || await strandFirstSyncComplete(strandDb.getDatabase(), strandId);
+        timing('[buildStrandRuntime:%s] first-sync probe: %dms', strandId, Math.round(performance.now() - t0));
+        if (this.firstSyncGates.get(strandId) !== gate) {
+            // A stop released the runtime during the probe and closed this database through its gate.
+            return 'released';
+        }
+        if (synced) {
+            this.publishDatabase(instance, strandDb);
+        }
+        else {
+            gate.start();
+        }
+        return 'built';
+    }
+    /** Close a database attempt that failed to initialize, and drop its gate if it is still the registered one. */
+    async discardDatabaseAttempt(strandId, gate) {
+        gate.stop();
+        if (this.firstSyncGates.get(strandId) === gate) {
+            this.firstSyncGates.delete(strandId);
+        }
+        await gate.database.close();
+    }
     /**
      * Keep a launch `'syncing'` when its database could not be built because no seed peer has
-     * answered yet, and rebuild the runtime every {@link UNREACHABLE_JOIN_RETRY_MS}.
+     * answered yet, and retry the database build every {@link UNREACHABLE_JOIN_RETRY_MS} on the
+     * runtime already up.
      *
      * Optimystic (since 1.11.0) will not rule a block never-created while any of a node's
      * `bootstrapNodes` is unheard, so a joiner alone with an unreachable seed cannot build even
@@ -753,14 +832,15 @@ export class StrandInstanceManager {
      * strand until the watcher relaunched it, and `addStrand` would reject with a raw Optimystic
      * error. Deferring gives a joiner the same contract the first-sync gate gives one that did
      * build: the strand stays tracked, {@link whenWritable} waits and rejects with the retryable
-     * `StrandAwaitingFirstSyncError`, and the launch proceeds once a seed peer answers. A failed
-     * composition stops the injected libp2p node, so each retry rebuilds the whole runtime.
+     * `StrandAwaitingFirstSyncError`, and the launch proceeds once a seed peer answers.
+     *
+     * The libp2p node, its connections and the background loops stay up meanwhile. A seed peer
+     * can answer just after the schema read gave up on it — on a slow link it connects and its
+     * peer-join backfill delivers the whole store — and the retry then builds the database, and
+     * runs the first-sync probe, while that peer is still connected.
      */
-    deferUnreachableJoin(instance, error) {
+    deferUnreachableJoin(instance) {
         const strandId = instance.strandId;
-        instance.status = 'syncing';
-        log('Strand %s: no seed peer has answered yet, so this joiner cannot build its database (%s); ' +
-            'retrying in %dms', strandId, error instanceof Error ? error.message : String(error), UNREACHABLE_JOIN_RETRY_MS);
         const timer = setTimeout(() => {
             this.unreachableJoinRetries.delete(strandId);
             void this.retryUnreachableJoin(instance);
@@ -768,22 +848,48 @@ export class StrandInstanceManager {
         timer.unref?.();
         this.unreachableJoinRetries.set(strandId, timer);
     }
-    /** One retry scheduled by {@link deferUnreachableJoin}, unless the strand was stopped or rebuilt since. */
+    /**
+     * One retry scheduled by {@link deferUnreachableJoin}: the database phase again, on the
+     * runtime still attached. Skipped when the strand was stopped or released since — a quiesce
+     * releases it and the resume after rebuilds the whole runtime — or already has a database.
+     * A failure other than an unanswered seed releases the runtime and marks the strand
+     * `'error'`, as a failed resume does.
+     */
     async retryUnreachableJoin(instance) {
         const strandId = instance.strandId;
         const config = this.launchConfigs.get(strandId);
-        if (this.stopping || this.instances.get(strandId) !== instance || !config
-            || instance.libp2pNode || this.runtimeBuilds.has(strandId) || this.transitions.has(strandId)) {
+        // Every strand node is built by `buildStrandRuntime`, as a node with its coordinated repo.
+        const node = instance.libp2pNode;
+        if (!config || !node || !this.isCurrentRuntime(instance, node) || instance.database
+            || this.firstSyncGates.has(strandId) || this.isQuiescing(strandId)) {
             return;
         }
+        let build;
         try {
-            await this.trackRuntimeBuild(strandId, this.buildStrandRuntime(instance, config));
+            // Tracked like any runtime build, so a wake, a quiesce or an sApp attach waits for it
+            // rather than acting on a database that is still initializing.
+            build = await this.trackRuntimeBuild(strandId, this.buildStrandDatabase(instance, config, node));
         }
         catch (error) {
+            if (!this.isCurrentRuntime(instance, node)) {
+                log('Strand %s: a database retry failed after its runtime was released: %o', strandId, error);
+                return;
+            }
+            await this.releaseRuntime(instance).catch((cleanupErr) => {
+                log('Strand %s: releasing the runtime after a failed database retry also failed: %o', strandId, cleanupErr);
+            });
             instance.status = 'error';
             instance.error = error instanceof Error ? error.message : String(error);
-            log('Strand %s: rebuilding a joiner that was waiting for a seed peer failed: %s', strandId, instance.error);
+            log('Strand %s: building the database of a joiner that was waiting for a seed peer failed: %s', strandId, instance.error);
+            return;
         }
+        if (build === 'awaiting-seed' && this.isCurrentRuntime(instance, node) && !this.isQuiescing(strandId)) {
+            this.deferUnreachableJoin(instance);
+        }
+    }
+    /** Whether `instance` is still tracked, with `node` still its runtime's libp2p node. */
+    isCurrentRuntime(instance, node) {
+        return !this.stopping && this.instances.get(instance.strandId) === instance && instance.libp2pNode === node;
     }
     /**
      * Release an instance's strand-network runtime: stop the relay supervisors and
@@ -813,6 +919,8 @@ export class StrandInstanceManager {
             relaySupervisors.forEach((supervisor) => supervisor.stop());
             this.relaySupervisors.delete(instance.strandId);
         }
+        this.peerRedials.get(instance.strandId)?.stop();
+        this.peerRedials.delete(instance.strandId);
         // Backfill next — before the database closes and the libp2p node stops — so
         // no NEW catch-up push is issued against a torn-down transport. A push already
         // in flight is not awaited; it fails into the module's own per-chunk catch.
@@ -857,7 +965,9 @@ export class StrandInstanceManager {
     /**
      * One {@link superviseRelayReservation} per relay dial addr, each over exactly
      * that relay so "held" is judged per relay (`circuitMultiaddrsVia`) and losing
-     * one relay re-drives only that one. Default retry timings — the control node's (2 s
+     * one relay re-drives only that one. They are the only thing that fills the node's
+     * search slots once the node is built with libp2p's relay discovery off
+     * (`nodeTransportsOption`). Default retry timings — the control node's (2 s
      * doubling to 60 s between failed attempts, a 5 s liveness check while held). Each DRIVE's
      * own deadline is counted in link round trips at this host's declared
      * `network.linkRoundTripMs` (`link-budget.ts`), so the same declaration that lengthens the
@@ -1244,8 +1354,9 @@ export class StrandInstanceManager {
      * schema signature is checked before anything changes; the retained launch config takes
      * the sApp, so every later rebuild applies it through `composeStrand`; the live database —
      * published, or still held by the first-sync gate — gets the schema; and only then does
-     * the instance record `sAppInfo` and the sApp's latency hint. A quiesced instance gets the
-     * config alone, and its next resume applies the schema.
+     * the instance record `sAppInfo` and the sApp's latency hint. An instance with no live
+     * database gets the config alone: a quiesced one applies the schema at its next resume, a
+     * launch waiting for a seed peer at its next database retry.
      *
      * @returns `'already-attached'` when the instance already runs an sApp — a DIFFERENT one
      *   is logged and left as it is, as a second claim of a claimed strand always has been —
@@ -1283,7 +1394,7 @@ export class StrandInstanceManager {
             await database.attachAppSchema(sAppConfig);
         }
         else {
-            log('attachSApp: strand %s is quiesced — its next resume applies the sApp schema', strandId);
+            log('attachSApp: strand %s has no live database — its next build applies the sApp schema', strandId);
         }
         instance.sAppInfo = sAppInfo;
         if (sAppConfig.latencyHint) {
@@ -1298,14 +1409,13 @@ export class StrandInstanceManager {
     /**
      * Whether `strandId` is launched but still waiting for its first sync — a joiner whose
      * runtime is up while its database is withheld (status `'syncing'`, or `'idle'` after
-     * the hibernation manager's idle timer fired on it), or one waiting to rebuild because no
-     * seed peer had answered ({@link deferUnreachableJoin}). `false` for a writable, quiesced,
-     * or untracked strand. The predicate {@link whenWritable}'s callers gate on.
+     * the hibernation manager's idle timer fired on it), including one whose database build
+     * waits for a seed peer to answer ({@link deferUnreachableJoin}). `false` for a writable,
+     * quiesced, or untracked strand. The predicate {@link whenWritable}'s callers gate on.
      */
     isAwaitingFirstSync(strandId) {
         const instance = this.instances.get(strandId);
-        return instance !== undefined
-            && (isAwaitingFirstSync(instance) || this.unreachableJoinRetries.has(strandId));
+        return instance !== undefined && isAwaitingFirstSync(instance);
     }
     /**
      * Resolve once the strand's database is published to the app — immediately for a
@@ -1459,8 +1569,9 @@ export class StrandInstanceManager {
         const gate = this.firstSyncGates.get(strandId);
         const database = instance.database ?? gate?.database;
         if (!database) {
-            throw new Error(`Cannot run the founder bootstrap for strand ${strandId}: it is quiesced, so there ` +
-                'is no live database to write to — resume it first.');
+            throw new Error(`Cannot run the founder bootstrap for strand ${strandId}: it has no live database to ` +
+                'write to — it is quiesced (resume it first), or its database build is waiting for a ' +
+                'seed peer to answer.');
         }
         // Forward the RETAINED config's party key: a foundExistingStrand that flipped a
         // joiner launch to founder may have resolved a key the live database's captured