@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/cadre-node.d.ts

@@ -1,17 +1,19 @@
 import type { Libp2p, PeerId } from '@libp2p/interface';
 import type { Multiaddr } from '@multiformats/multiaddr';
-import type { CadreNodeConfig, StrandInstance, StrandRow, StrandConfig, FoundStrandConfig, FoundStrandResult, SAppConfig, CadreNodeEvents, ControlNetworkSeed, ApplySeedResult, SeedAckMessage, SeedDeliveryTarget, AddDroneOptions, DroneInitResult, OpenInvitation, FormStrandResult, StrandFormationDisclosure, StrandMembershipInvite, ResolveOpts, SelfRegistrationOutcome, ServiceWakeResult, PushPlatform, DeviceTokenRecord, CadreInviteStatus, CadreMachine, MachineRemovalPlan, MachineRemovalResult, RemoveMachineOptions, CadreRemoval, CadreInvitationReach, CreateCadreInvitationOptions, CreateCadreInvitationResult, RedeemCadreInvitationOptions, RedeemCadreInvitationResult, ResolveDeviceTokenOpts, PendingJoinStatus } from './types.js';
-import { type Ed25519KeyPair } from './ed25519-key.js';
+import type { CadreNodeConfig, StrandInstance, StrandRow, StrandConfig, FoundStrandConfig, FoundStrandResult, FoundStrandOptions, FoundStrandBackgroundResult, SAppConfig, CadreNodeEvents, ControlNetworkSeed, ApplySeedResult, SeedAckMessage, SeedDeliveryTarget, AddDroneOptions, DroneInitResult, OpenInvitation, FormStrandResult, StrandFormationDisclosure, StrandMembershipInvite, ResolveOpts, SelfRegistrationOutcome, ServiceWakeResult, PushPlatform, DeviceTokenRecord, CadreInviteStatus, CadreMachine, CadreOwnerKey, MachineRemovalPlan, MachineRemovalResult, OwnerKeyRemovalPlan, OwnerKeyRemovalResult, RemoveOwnerOptions, CadreRemoval, CadreInvitationReach, CreateCadreInvitationOptions, CreateCadreInvitationResult, RedeemCadreInvitationOptions, RedeemCadreInvitationResult, CreateOwnerGrantOptions, CreateOwnerGrantResult, OwnerGrantStatus, RedeemOwnerGrantOptions, RedeemOwnerGrantResult, JoinWithOwnerGrantResult, ResolveDeviceTokenOpts, PendingJoinStatus } from './types.js';
 import { type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
+import { type OwnerSign, type OwnerSigner } from './owner-signer.js';
 import { type BootstrapPeerStore } from './bootstrap-peer-store.js';
 import { type StrandNetworkStateStore } from './strand-network-state.js';
 import { type EnrolledMachineStore } from './enrolled-machine-store.js';
 import { type JoinedStrandRecord } from './joined-strand-store.js';
 import { type SAppIdLookup } from './strand-watcher.js';
+import type { CohortPeerRow } from './strand-cohort.js';
 import { type ControlCohortReconcileResult } from './control-cohort.js';
 import { EnrollmentService } from './enrollment.js';
 import { ControlDatabase } from './control-database.js';
 import { type CadreInvitation } from './cadre-invite-protocol.js';
+import { type OwnerGrantBundle } from './owner-grant-protocol.js';
 import { SeedBootstrapService } from './seed-bootstrap.js';
 import { type SeedTrustPolicy } from './seed-trust-policy.js';
 import { StrandSolicitationService, type StrandSolicitationServiceOptions } from './strand-solicitation.js';
@@ -26,8 +28,8 @@ import { type ConnectionPathSummary } from './diagnostics/connection-path.js';
  *
  * Ten minutes sits comfortably inside the peerStore's one-hour address expiry
  * (`MAX_ADDRESS_AGE`, see `peer-addr-book.ts`) with headroom for several missed
- * passes, and far above the 15 s reconcile cadence the refresh rides on, so the
- * strand-addr RPC fan-out stays cheap.
+ * passes, and far above the reconcile pass's 2-minute backstop the refresh rides
+ * on, so the strand-addr RPC fan-out stays cheap.
  */
 export declare const STRAND_PEER_ADDR_REFRESH_MS: number;
 /**
@@ -36,18 +38,19 @@ export declare const STRAND_PEER_ADDR_REFRESH_MS: number;
  * phone asking before its `CadrePeer` row has replicated to the sibling is refused
  * and its delegate grant goes unrecorded, and waiting the full
  * {@link STRAND_PEER_ADDR_REFRESH_MS} for the next try is the delay this bounds.
- * Four reconcile ticks, so a sibling that keeps failing costs one timed-out RPC a
- * minute rather than one a tick.
+ * A pass arms its own wake for the earliest due time it leaves behind
+ * (`nextReconcileWakeMs`), so a sibling that keeps failing costs one timed-out
+ * RPC a minute, with no pass in between.
  */
 export declare const STRAND_PEER_ADDR_RETRY_MS: number;
 /**
- * Default lifetime of an UNTARGETED, OWNER-GRANTING cadre invitation
- * ({@link CadreNode.createCadreInvitation}): whoever holds the bundle becomes an owner, so
- * it is a bearer credential for admin rights and lives only long enough to be pasted or
- * scanned by the device it was minted for.
+ * Default lifetime of an owner grant ({@link CadreNode.createOwnerGrant}): whoever holds the
+ * bundle can become an owner, so it is a bearer credential for admin rights and lives only
+ * long enough to be pasted or scanned by the device it was minted for. A backup grant is minted
+ * with no expiry, by explicit choice.
  */
-export declare const OWNER_INVITATION_DEFAULT_TTL_MS: number;
-/** Default lifetime of every other cadre invitation: targeted, or granting membership only. */
+export declare const OWNER_GRANT_DEFAULT_TTL_MS: number;
+/** Default lifetime of a cadre invitation ({@link CadreNode.createCadreInvitation}): it admits a machine and grants nothing else, so it need not be short. */
 export declare const CADRE_INVITATION_DEFAULT_TTL_MS: number;
 type EventHandler<T> = (data: T) => void;
 /**
@@ -134,6 +137,13 @@ export declare class CadreNode implements SAppIdLookup {
      * once that database is up, on every node.
      */
     private cadreInviteHandler;
+    /**
+     * Owner grant redemption handler (`/sereus/owner-grant/1.0.0`): a holder of a grant dials
+     * this machine and proves possession of the grant and of the key it seats; the handler seats
+     * the row and writes the `OwnerKey` row against this node's control database. Registered by
+     * {@link start} beside the invitation handler, on every node.
+     */
+    private ownerGrantHandler;
     /**
      * Server-side push-wake fan-out. Constructed by {@link start} only when
      * `config.push` (an injected `PushNotifier` + policy) is present — without it
@@ -231,8 +241,8 @@ export declare class CadreNode implements SAppIdLookup {
      *
      * Cleared by {@link cleanup} only, deliberately NOT by {@link detachStrand}: the watcher's
      * filter rejection stops a replica through that very method, and forgetting the id there
-     * would have the next poll find it unknown again, re-admit the strand provisionally and
-     * relaunch the replica — once every other poll, forever. A strand id's sApp never changes,
+     * would have the next watcher run find it unknown again, re-admit the strand provisionally
+     * and relaunch the replica — on every other run, forever. A strand id's sApp never changes,
      * and the map is bounded by the strands this party has published, like
      * {@link discoveredStrands}.
      */
@@ -260,19 +270,24 @@ export declare class CadreNode implements SAppIdLookup {
      * wait that ends in mutual denial (the upstream gate is fail-closed on
      * timeout, unlike the fail-open connection gater). Optimystic's predicate is
      * synchronous by contract. So the set is refreshed OUT OF BAND instead — after
-     * start, on every {@link reconcileControlCohort} pass (15s cadence), and
-     * immediately after every LOCAL membership mutation so a just-vouched peer
-     * is admitted without waiting for the timer. That last refresh is AUTOMATIC:
-     * the control database notifies {@link refreshMembershipGate} after every
+     * start, at the head of every {@link reconcileControlCohort} pass, whenever a
+     * membership table changes (the gate watch {@link start} takes through
+     * `ControlDatabase.watchMembershipTables`, which hears a local commit and a change
+     * replicated into this node's storage alike, within a 50 ms window), and immediately
+     * after every LOCAL membership mutation so a just-vouched peer is admitted
+     * before the writer's call returns. That last refresh is AUTOMATIC: the
+     * control database notifies {@link refreshMembershipGate} after every
      * committed `CadrePeer` write (see `ControlDatabase.mutateCadrePeer`), so no
-     * writer has to remember. A change that arrives by REPLICATION is picked up
-     * on the next timed refresh — bounded staleness, acceptable because this gate
-     * is defense in depth: rows an unadmitted peer manages to write are still
-     * disbelieved at read time by the voucher-anchored predicate. For cohort
-     * choice the same window means a member whose row arrived by replication is
-     * left out of this node's control-block cohorts until that refresh.
-     * Optimystic reads the predicate live on every lookup, so replacing this set
-     * is the whole re-evaluation; there is no per-peer reclassify call to make.
+     * writer has to remember. A change this node's storage never hears of — a
+     * machine outside the block's cohort on a party larger than the replication
+     * breadth — is picked up at the pass's 2-minute backstop: bounded staleness,
+     * acceptable because this gate is defense in depth: rows an unadmitted peer
+     * manages to write are still disbelieved at read time by the voucher-anchored
+     * predicate. For cohort choice the same window means a member whose row
+     * arrived by replication is left out of this node's control-block cohorts
+     * until that refresh. Optimystic reads the predicate live on every lookup, so
+     * replacing this set is the whole re-evaluation; there is no per-peer
+     * reclassify call to make.
      */
     private authorizedControlPeers;
     /**
@@ -330,22 +345,42 @@ export declare class CadreNode implements SAppIdLookup {
      * When this node last ANNOUNCED a delegate, keyed `<targetPeerId>\n<strandId>`
      * (the peer announced TO, not the delegate). Throttles
      * {@link refreshDelegateGrants} to once per `DELEGATE_GRANT_TTL_MS / 2` per
-     * (relay, strand) so the 15 s reconcile tick never becomes per-tick RPC
-     * chatter; the launch/resume announce passes record here too. Keys whose
-     * strand is no longer running are pruned on each reconcile pass.
+     * (relay, strand) so a run of change-driven reconcile passes never becomes
+     * per-pass RPC chatter; the launch/resume announce passes record here too.
+     * Keys whose strand is no longer running are pruned on each reconcile pass.
      */
     private readonly delegateAnnounceAt;
+    /**
+     * Relay peerIds whose protocol negotiation refused the delegate announcement
+     * (strand-addr outcome `unsupported`), recorded and cleared by
+     * {@link recordDelegateAnnounces} from every announce pass's outcomes. Only a
+     * party-run relay has a membership gate that needs a grant, and it serves
+     * strand-addr, so a refusal marks a dedicated relay: {@link circuitRelayTargets}
+     * leaves it out of the founding/resume and periodic announcements, which would
+     * otherwise spend a protocol negotiation on it every time (gotchoices/sereus#49). Not
+     * pruned: one entry per relay this node ever named.
+     *
+     * {@link announceDelegateToRelay} still asks every relay, remembered or not, and
+     * its reply is what clears an entry. A party-run relay registers its strand-addr
+     * handler late in its own `start()`, after its libp2p node and relay server are
+     * up, so an announcement landing in that window is refused by a relay that serves
+     * the protocol a moment later. If the re-drive hook skipped remembered relays too,
+     * that relay would stay skipped until this node restarts and its gate would deny
+     * every reservation through it.
+     */
+    private readonly relaysRefusingStrandAddr;
     /**
      * When each connected sibling is next due a strand-addr RPC for each running
      * strand, keyed `peerStrandKey(siblingControlPeerId, strandId)` → epoch ms; a
      * missing key is due. Bounds {@link refreshStrandPeerAddrs}'s fan-out per
      * (sibling, strand) rather than per strand, so a sibling that connects after a
-     * pass is asked on the next 15 s tick instead of waiting out a stamp another
-     * sibling's answer set. An answer (even an empty one) makes the sibling due again
-     * in {@link STRAND_PEER_ADDR_REFRESH_MS}; no answer, in
-     * {@link STRAND_PEER_ADDR_RETRY_MS}. Keys whose strand stopped running or whose
-     * sibling is no longer connected are pruned every pass, so a resumed strand and a
-     * reconnected sibling are both asked at once.
+     * pass is asked on the pass its connection starts instead of waiting out a stamp
+     * another sibling's answer set. An answer (even an empty one) makes the sibling
+     * due again in {@link STRAND_PEER_ADDR_REFRESH_MS}; no answer, in
+     * {@link STRAND_PEER_ADDR_RETRY_MS}, and each pass arms its own wake for the
+     * earliest due time it leaves behind (`nextReconcileWakeMs`). Keys whose strand
+     * stopped running or whose sibling is no longer connected are pruned every pass,
+     * so a resumed strand and a reconnected sibling are both asked at once.
      */
     private readonly strandAddrAskDueAt;
     /**
@@ -427,6 +462,18 @@ export declare class CadreNode implements SAppIdLookup {
      * `unpublishStrand` / `forgetJoinedStrand` as {@link formationStrandAddrs} is.
      */
     private readonly pendingMembershipInvites;
+    /**
+     * The party key {@link adoptFormationMembershipInvite} just seated or read, by strand id,
+     * so the launch that follows a join does not read the `StrandPartyKey` row again. Taken
+     * (deleted) by the {@link resolveStrandPartyKey} that uses it, so any later launch reads
+     * the row; dropped by {@link detachStrand}. The joiner's counterpart of the founder's
+     * `StrandConfig.partyMemberPrivateKey`, without the app carrying the secret.
+     *
+     * NOTE: an entry is not dropped when the row is removed, because no `CadreNode` path removes
+     * it; an embedder calling `getControlDatabase().deleteStrandPartyKey` between a join and its
+     * launch would get the deleted key. If a node-level rotation is added, drop the entry there.
+     */
+    private readonly formedPartyKeys;
     /**
      * Invite keys of the membership invitations this process has staged, by
      * {@link adoptFormationMembershipInvite} or from a `JoinSuccess` row
@@ -460,7 +507,7 @@ export declare class CadreNode implements SAppIdLookup {
     /**
      * Dial targets learned out of band, keyed by peer id, valued by the multiaddr
      * strings this node was handed (parsed lazily, at dial time). Two writers:
-     * {@link recordSeedBootstrapPeers} retains the owner-flagged peers of every seed
+     * {@link recordSeedBootstrapPeers} retains the preferred peers of every seed
      * this node applies, and {@link addDrone} retains the addresses of every node
      * this node adds. Two readers: {@link dialColdStartBootstrap} dials every entry
      * while the control database still has no siblings, and
@@ -520,7 +567,7 @@ export declare class CadreNode implements SAppIdLookup {
     private joinedStrandStore;
     /**
      * This session's joined strands: {@link joinedStrandStore} and the party-wide
-     * `JoinedStrand` table, unioned with the control rows each watcher poll, published and
+     * `JoinedStrand` table, unioned with the control rows each watcher run, published and
      * removed by the reconcile pass. Per SESSION, unlike the store — rebuilt at every
      * {@link start}, which is what ends a revoked join's "keep offering until this session
      * ends" (see `JoinedStrandSession.forgetAfterThisSession`).
@@ -551,17 +598,41 @@ export declare class CadreNode implements SAppIdLookup {
     /** Listener that re-publishes the self record when reachable addresses change. */
     private selfPeerUpdateHandler;
     /**
-     * Recurring proactive control-cohort dial cadence (see
-     * {@link reconcileControlCohort}). Wired alongside {@link recordRefreshTimer}
-     * in {@link startRecordRefresh} and torn down symmetrically in
-     * {@link stopRecordRefresh}; `.unref()`'d so it never keeps the loop alive.
-     */
-    private controlCohortReconcileTimer;
-    /**
-     * Single-flight guard for {@link reconcileControlCohort}. The eager start pass,
-     * the recurring interval, and the `self:peer:update` trigger can fire close
-     * together; collapsing concurrent passes into one in-flight run prevents two
-     * passes from double-dialing the same siblings (mirrors {@link registerSelfInFlight}).
+     * The reconcile pass's schedule (see {@link reconcileControlCohort}): single-flight
+     * runs on `table-change-watch.ts`'s rule, with no table subscription of its own — the
+     * gate watch ({@link membershipGateWatch}), the control connection listeners,
+     * `self:peer:update`, and the pass's own wake ({@link armReconcileWake}) `trigger` it,
+     * and its backstop (`network.controlCohort.reconcileMs`, default
+     * `DEFAULT_CONTROL_COHORT_RECONCILE_MS`) runs it when nothing has. Built alongside
+     * {@link recordRefreshTimer} in {@link startRecordRefresh}, about 1 s after start, and
+     * disposed in {@link stopRecordRefresh}; its timers never keep the loop alive.
+     */
+    private controlReconcileRuns;
+    /**
+     * The subscription on the membership tables (`ControlDatabase.watchMembershipTables`) that
+     * re-materializes the membership gate and triggers {@link controlReconcileRuns} on every
+     * change ({@link onMembershipGateTablesChanged}).
+     * Taken in {@link start} right after the membership listener is wired, disposed in
+     * {@link cleanup} before the control database closes.
+     */
+    private membershipGateWatch;
+    /** The second membership-view drop after a sibling connects ({@link armMembershipViewReload}); cleared in {@link stopRecordRefresh}. */
+    private membershipViewReloadTimer;
+    /**
+     * Consecutive passes whose dial of a selected sibling or a cold-start bootstrap peer
+     * failed (`ControlCohortPassOutcome.unconnected`), for the redial ladder
+     * ({@link armReconcileWake}); 0 after a pass none of whose dials did. Per session:
+     * reset in {@link stopRecordRefresh}.
+     */
+    private reconcileRedialStreak;
+    /** Peers a {@link redialClaimedNode} loop is running for, so a repeated claim starts no second one. */
+    private readonly claimRedialPeers;
+    /**
+     * Single-flight guard for {@link reconcileControlCohort}. An explicit call, the
+     * `self:peer:update` trigger and a scheduled run can fire close together; collapsing
+     * concurrent passes into one in-flight run prevents two passes from double-dialing the
+     * same siblings (mirrors {@link registerSelfInFlight}). A scheduled run waits for this
+     * pass and then starts its own rather than joining it.
      */
     private reconcileControlCohortInFlight;
     /**
@@ -584,18 +655,26 @@ export declare class CadreNode implements SAppIdLookup {
      * machine in the party is already discarding this node's address as stale.
      */
     private lastSelfRecordPublishAt;
+    /**
+     * The newest record this process signed for its own `CadrePeer` row: written by either path
+     * of {@link publishSelfRecord}, or handed to a member to write by {@link redeemCadreInvitation}.
+     * What {@link publishSelfRecordUnlessCurrent} compares the row against. Per session, cleared
+     * with {@link lastSelfRecordPublishAt}: a row carried over from an earlier process is never
+     * taken as current.
+     */
+    private lastSignedSelfRecord;
     /** Say-once latch for {@link escalateIfSelfRecordStale}; re-armed by the next publish. */
     private selfRecordStaleWarned;
     /**
      * Re-replication queue for owner `authorizePeer` writes that committed while
-     * this node was alone — `controlNode.getConnections().length === 0` at write
-     * time means the Optimystic commit was local-only (the block's cluster was ≤1)
-     * and never broadcast. Maps the affected subject peerId → 'authorize', to
+     * this node was alone ({@link committedAlone}) — the Optimystic commit was
+     * local-only (the block's cohort was this node) and never broadcast. Maps the
+     * affected subject peerId → 'authorize', to
      * re-issue once the cohort grows. Removals are NOT tracked here — a delete
      * leaves a `Revocation` tombstone, tracked by {@link pendingRevocations}; a
      * removePeer also clears any queued authorize for the same subject (the row is
-     * gone, so re-issuing the insert would be wrong). Drained on the 0→≥1
-     * control-connection transition by {@link drainPendingControlReplication}.
+     * gone, so re-issuing the insert would be wrong). Drained when a sibling becomes
+     * reachable ({@link updateControlSiblingReachability}) by {@link drainPendingControlReplication}.
      */
     private pendingPeerWrites;
     /**
@@ -619,14 +698,6 @@ export declare class CadreNode implements SAppIdLookup {
      * exactly a "removals from before this lifetime" case).
      */
     private reissuedHeldRevocations;
-    /**
-     * Whether this process has seen the singleton `Revocation` ledger marker filed — its own
-     * `'opened'` or an `'already-open'` answer, in {@link openRevocationLedgerIfDue}. A
-     * record of work done, not a cached authorization answer: the marker can never be
-     * deleted (`NoDelete`), so this can only go stale if the database itself is replaced,
-     * which is why stop() clears it with the other per-process replication state.
-     */
-    private revocationLedgerOpened;
     /** This node's own `CadrePeer` self-write committed local-only (re-touched on growth). */
     private pendingSelfPeerWrite;
     /** This node's own `DeviceToken` self-write committed local-only (re-touched on growth). */
@@ -641,14 +712,24 @@ export declare class CadreNode implements SAppIdLookup {
     /** Single-flight guard for the re-replication drain (mirrors {@link registerSelfInFlight}). */
     private drainControlReplicationInFlight;
     /**
-     * Tracks the control-connection presence edge so the drain fires only on the
-     * 0→≥1 transition (the earliest point a re-issue can broadcast), not on every
-     * subsequent `connection:open`. Re-armed to false once connections return to 0.
+     * Connected control peers whose identify says they serve the control database
+     * ({@link onControlPeerIdentified}): the peers Optimystic can count into a control block's
+     * cohort, before its membership check. A peer joins on its first `peer:identify` of a
+     * connected period, not on `connection:open`: until it identifies, every control block's
+     * cohort is this node alone. It leaves when its last connection closes. Read through
+     * {@link hasReachableControlSibling}, which applies the membership check.
      */
-    private hasControlConnection;
-    /** `connection:open` listener driving the growth-triggered drain (teardown in {@link stopRecordRefresh}). */
-    private controlConnectionOpenHandler;
-    /** `connection:close` listener re-arming the growth edge (teardown in {@link stopRecordRefresh}). */
+    private readonly identifiedControlPeers;
+    /**
+     * {@link hasReachableControlSibling} at its last evaluation, so the drain fires on the
+     * false→true edge only (the earliest point a re-issue reaches the cohort), not on every later
+     * identify. Re-armed to false when no reachable sibling remains
+     * ({@link updateControlSiblingReachability}).
+     */
+    private controlSiblingReachable;
+    /** `peer:identify` listener: {@link onControlPeerIdentified} (teardown in {@link stopRecordRefresh}). */
+    private controlPeerIdentifyHandler;
+    /** `connection:close` listener: {@link onControlConnectionClosed} (teardown in {@link stopRecordRefresh}). */
     private controlConnectionCloseHandler;
     constructor(config: CadreNodeConfig);
     /**
@@ -777,7 +858,7 @@ export declare class CadreNode implements SAppIdLookup {
     /**
      * Construct (or adopt) the node-local trusted-owner anchor and seed the
      * out-of-band pinned keys from `config.trustedOwners`. The anchor's BASE comes
-     * only from out of band — genesis self-trust ({@link initializeSeedBootstrap}),
+     * only from out of band — genesis self-trust ({@link useOwnerSigner}),
      * config pins (here), runtime enrollment pins ({@link trustOwnerKeys}) and a
      * claim; everything else in it is derived from that base along verifiable
      * chains through the replicated `OwnerKey` table ({@link syncOwnerAnchor}),
@@ -943,12 +1024,13 @@ export declare class CadreNode implements SAppIdLookup {
     getTrustedOwnerStore(): TrustedOwnerStore | null;
     /**
      * Persist out-of-band-established owner keys into the node-local anchor —
-     * the runtime enrollment seam: {@link redeemCadreInvitation} calls it with the
-     * cadre invitation's `ownerKeys` BEFORE dialing a member (so the anchor already
-     * holds the pins when the reply and the rows that follow are judged), and an
+     * the runtime enrollment seam: {@link redeemCadreInvitation} and
+     * {@link redeemOwnerGrant} call it with their bundle's `ownerKeys` BEFORE dialing
+     * a member (so the anchor already holds the pins when the reply and the rows
+     * that follow are judged), and an
      * embedder calls it with an operator-supplied pin. Idempotent. ('genesis'
      * provenance is reserved for the node's own founding key, seeded internally by
-     * {@link initializeSeedBootstrap}; 'chain' is written only by {@link syncOwnerAnchor}.)
+     * {@link useOwnerSigner}; 'chain' is written only by {@link syncOwnerAnchor}.)
      *
      * Validates every key's shape before trusting any of them (all-or-nothing):
      * a malformed entry anywhere in `keys` rejects the whole call before a
@@ -973,8 +1055,8 @@ export declare class CadreNode implements SAppIdLookup {
     private controlNetworkName;
     /**
      * Arm the CONTROL network's peer-join block catch-up: push every block in the
-     * control database's own raw store to each newly connected AUTHORIZED member
-     * this runtime has not yet caught up. This is what physically replicates
+     * control database's own raw store to each AUTHORIZED member on each
+     * (re)connection, skipping what it is known to hold. This is what physically replicates
      * control blocks committed while the writer was alone — the named
      * collection-header blocks written once at genesis above all, whose revision
      * never moves again, so no later commit ever carries them to a member that
@@ -983,7 +1065,9 @@ export declare class CadreNode implements SAppIdLookup {
      * for peers it knew about before the restart).
      *
      * Unlike the per-strand instances (see `strand-instance-manager.ts`), pushes
-     * are gated on {@link isAuthorizedMember}, judged at push time: the control
+     * are gated on the authorized-member snapshot ({@link authorizedControlPeers},
+     * which {@link refreshAuthorizedControlPeers} materializes from the same rows and
+     * rule {@link isAuthorizedMember} queries), judged at push time: the control
      * network's inbound connection gate deliberately admits non-members in
      * several states (seed delivery to an un-enrolled node, an open enrollment
      * window, an outstanding invitation, configured bootstrap/relay peers), and
@@ -999,9 +1083,9 @@ export declare class CadreNode implements SAppIdLookup {
      * The one non-member the gate admits is a device whose invitation
      * redemption this member is admitting ({@link admitRedeemingDevice}).
      *
-     * No-ops (logged) when the embedder configured no control storage or the
-     * node exposes no key network — the backfill would have nothing to read or
-     * no way to dial.
+     * No-ops (logged) when {@link controlBackfillStorage} answers nothing (disabled,
+     * or no control storage configured) or the node exposes no key network — the
+     * backfill would have nothing to read or no way to dial.
      */
     private startControlBackfill;
     /**
@@ -1041,6 +1125,17 @@ export declare class CadreNode implements SAppIdLookup {
      * operation count.
      */
     private resolveControlStorage;
+    /**
+     * The store the control network's peer-join block catch-up reads, or `undefined` when this
+     * runtime does not arm it: `controlBackfill.enabled: false`, or no control storage. Both of
+     * its readers ask here so they cannot disagree: {@link startControlBackfill} arms on it, and
+     * {@link buildControlNodeOptions} turns Optimystic's rebalance reaction off on it.
+     *
+     * Through the resolver, not the {@link controlStorage} memo field: the resolver is
+     * idempotent, so the catch-up cannot be silently disarmed by a future reordering that moves
+     * a read ahead of the one that populated the field.
+     */
+    private controlBackfillStorage;
     /**
      * Warn the operator when `network.announceAddrs` will silently cost this node the
      * relay reachability it also configured.
@@ -1095,10 +1190,18 @@ export declare class CadreNode implements SAppIdLookup {
      *     own strand node, so a NAT'd member's strand node can hold a
      *     circuit-relay reservation here (see `delegate-admission.ts`).
      *     Connection only: the per-stream gate below never honors a grant;
-     *  3. the authorized-member set is empty — cold start: the rows that would
+     *  3. the peer is a device whose invitation or owner-grant redemption this
+     *     node has verified and is writing ({@link admittingDevices}): its
+     *     connection carries the exchange, which must not be cut at the
+     *     provisional deadline. A LIVE OWNER GRANT does not count as expecting a
+     *     stranger the way check 7's invitation does: a backup grant has no
+     *     expiry, and counting it would admit every stranger outright for the
+     *     party's life, so the holder rides the provisional admission until its
+     *     redemption verifies, then this;
+     *  4. the authorized-member set is empty — cold start: the rows that would
      *     authorize anyone arrive by replication over these very connections;
-     *  4. the peer IS an authorized member; or
-     *  5. an open invitation is OUTSTANDING — at least one unexpired,
+     *  5. the peer IS an authorized member; or
+     *  6. an open invitation is OUTSTANDING — at least one unexpired,
      *     not-fully-consumed invitation this node minted or persisted (see
      *     `StrandSolicitationService.hasOutstandingInvitation`). A formation
      *     initiator is another party's peer by design and its token is only
@@ -1106,19 +1209,19 @@ export declare class CadreNode implements SAppIdLookup {
      *     "does this node expect a stranger at all?". REGISTERING the responder
      *     does not count: every node registers one at {@link start}, and
      *     registering mints no invitation; or
-     *  6. a LIVE cadre invitation exists — a `CadreInvite` row this node holds
+     *  7. a LIVE cadre invitation exists — a `CadreInvite` row this node holds
      *     that is not withdrawn, unexpired, has uses left and whose issuer is
      *     still an owner (`ControlDatabase.hasLiveCadreInvite`). The device that
      *     redeems it is a stranger until the redemption writes its row, and its
      *     proof of possession is only checkable inside `/sereus/cadre-invite/1.0.0`;
-     *     same reasoning as check 5, and the same expectation-of-a-stranger key.
+     *     same reasoning as check 6, and the same expectation-of-a-stranger key.
      *
      * Ordering is semantically free (the checks are OR'd) but decides who pays:
-     * checks 1-2 are in-memory, 3/4 share one control-DB read, and only a peer
-     * that is otherwise headed for a provisional admission reaches check 5's and
-     * 6's invitation lookups.
+     * checks 1-3 are in-memory, 4/5 share one control-DB read, and only a peer
+     * that is otherwise headed for a provisional admission reaches check 6's and
+     * 7's invitation lookups.
      *
-     * Caveats of check 5:
+     * Caveats of check 6:
      *  - the in-memory mint registry dies with the process, so after a restart
      *    only invitations persisted as `FormationInvite` rows still hold the
      *    window open (re-mint otherwise);
@@ -1129,21 +1232,21 @@ export declare class CadreNode implements SAppIdLookup {
      * When every check falls through: `'admit-provisionally'`, on every node,
      * relay server or not. The gate sees only a peer id, so it cannot tell an
      * outsider from a device whose invitation row this node has not received yet
-     * (it redeems here by seating the row from its bundle, after which check 6
-     * admits) or from a sibling whose membership row is still replicating (check 4
+     * (it redeems here by seating the row from its bundle, after which check 7
+     * admits) or from a sibling whose membership row is still replicating (check 5
      * admits once it lands; if it has not landed by the deadline, the connection
-     * is closed and either side's next reconcile dial re-forms it, since outbound
-     * dials are never gated). The protocol guard refuses all of them every
+     * is closed and the reconcile pass the close starts on either side re-forms it,
+     * since outbound dials are never gated). The protocol guard refuses all of them every
      * members-only protocol meanwhile. A circuit-relay reservation admitted by
      * {@link admitControlRelayReservation} disarms the deadline (see
      * `membership-connection-gater.ts` → "The relay-reservation seam").
      *
-     * NOTE: check 3/4 runs a control-DB read per inbound connection
+     * NOTE: check 4/5 runs a control-DB read per inbound connection
      * (`listAuthorizedMembers`); connections are rare and cadres small, and this
      * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
      * read is safe here — unlike the per-stream gate, which must consult the
      * materialized {@link authorizedControlPeers} snapshot instead.
-     * NOTE: checks 5 and 6 add two more control reads (`hasOutstandingFormationInvite`,
+     * NOTE: checks 6 and 7 add two more control reads (`hasOutstandingFormationInvite`,
      * `hasLiveCadreInvite`) for a stranger with no locally minted invitation in play, on
      * every node, and a provisional connection's deadline runs the whole decision once
      * more. If stranger connections ever arrive fast enough for those reads — on arrival
@@ -1281,6 +1384,15 @@ export declare class CadreNode implements SAppIdLookup {
      * needs a key-based admission.
      */
     private isControlNetworkMember;
+    /**
+     * Whether this node sends control writes to `remotePeerId`: Optimystic's `isNetworkMember`
+     * for the control node (cohort and coordinator choice), and the membership half of
+     * {@link hasReachableControlSibling}. The stream gate's rule ({@link isControlNetworkMember}),
+     * unlogged, because Optimystic asks several times per peer per cohort assembly and counts
+     * refusals on its own debug line; plus a device whose verified redemption is being written
+     * ({@link admittingDevices}), which must hold the rows that admit it.
+     */
+    private isControlCohortMember;
     /**
      * Per-stream authorization for the protocol guard's `members-snapshot` class
      * (`control-protocol-guard.ts`): the four Optimystic control-DB protocols
@@ -1308,13 +1420,14 @@ export declare class CadreNode implements SAppIdLookup {
      * this listener with its write lock HELD (`notifyMembershipChanged`), so a retrying
      * read here would sleep its backoff holding the lock and stall every other local
      * writer. Nothing is lost — this refresh already keeps the previous snapshot on
-     * failure and is re-driven by the next membership write and by the timed reconcile.
+     * failure and is re-driven by the next membership change (local or replicated, through
+     * the gate watch) and by the reconcile pass's backstop.
      *
      * The trusted-owner anchor sync ({@link syncOwnerAnchor}) runs FIRST, so the snapshot
      * built here judges `CadrePeer` rows against the anchor as the `OwnerKey` table now
-     * has it. The invitation chain both reads may need, and the tombstone list the sync and
-     * the two end-of-refresh checks ({@link hangUpRevokedControlPeers}, then
-     * {@link noteOwnRemoval}) read, are each loaded at most once per refresh.
+     * has it. The tombstone list the sync and the two end-of-refresh checks
+     * ({@link hangUpRevokedControlPeers}, then {@link noteOwnRemoval}) read is loaded at most
+     * once per refresh, as is the invitation chain the membership read may need.
      */
     private refreshAuthorizedControlPeers;
     /**
@@ -1370,9 +1483,10 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private getBootstrapPeerIds;
     /**
-     * What the strand watcher polls: this party's control rows plus a row per cross-party
+     * What the strand watcher reads: this party's control rows plus a row per cross-party
      * join (see {@link joinedStrands}), so a joined strand is offered and relaunched on
-     * the same path as the party's own.
+     * the same path as the party's own. It runs on a change to either table; the
+     * machine-local joins wake it through {@link JoinedStrandSession}'s change callback.
      */
     private createStrandQueryable;
     /**
@@ -1381,30 +1495,40 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private createPartyJoinedStrandLedger;
     /**
-     * This machine's owner signing key when it can make owner-gated control writes: its seed
-     * bootstrap holds an owner key (`SeedBootstrapService.canAuthorize`) and the party's
-     * `OwnerKey` table enrolls it. A phone that ran self-genesis after another machine
-     * founded the party passes the first test and not the second (`runOwnerGenesis` in the
-     * reference apps), and a write it signed would only be refused.
+     * This machine's owner signer when it can make owner-gated control writes: one is wired
+     * ({@link useOwnerSigner}) and the party's `OwnerKey` table enrolls its key. A phone that
+     * ran self-genesis after another machine founded the party passes the first test and not
+     * the second (`runOwnerGenesis` in the reference apps), and a write it signed would only
+     * be refused.
      */
-    private enrolledOwnerSigningKey;
+    private enrolledOwnerSigner;
     /**
-     * Whether this node can act as an owner of its cadre: its identity key is wired as its
-     * owner signing key ({@link initializeSeedBootstrap}) and enrolled in the live `OwnerKey`
-     * set ({@link enrolledOwnerSigningKey}). What the owner-only flows (`createCadreInvitation`,
-     * `claimNode`, `rentNode`) need; false before `start()`, and on a machine that joined as a
-     * member. The reference apps' "is this device an owner" check.
+     * Whether this node can act as an owner of its cadre: an owner signer is wired
+     * ({@link useOwnerSigner}) and its key is in the live `OwnerKey` set. What the owner-only
+     * flows (`createCadreInvitation`, `claimNode`, `rentNode`) need; false before `start()`,
+     * and on a machine that joined as a member. The reference apps' "is this device an owner"
+     * check.
      */
     isOwner(): Promise<boolean>;
-    /** {@link enrolledOwnerSigningKey} judged against an owner set the caller has already read. */
-    private ownerSigningKeyEnrolledIn;
-    /** This machine's identity key as an owner signing key, when its seed bootstrap is wired to sign; enrollment not yet checked. */
-    private ownerSigningKeyCandidate;
+    /** {@link enrolledOwnerSigner} judged against an owner set the caller has already read. */
+    private ownerSignerEnrolledIn;
+    /**
+     * The owner signer {@link useOwnerSigner} wired, or null: every owner signature this node
+     * makes goes through it. Enrollment is not checked ({@link isOwner} does). A caller that
+     * makes several owner writes as one action opens one `approve` on it and hands the
+     * resulting `sign` to the methods that take one (`publishStrand`, `ensureStrandPartyKey`,
+     * `publishFormationInvite`), as `adoptStrandBundle` does.
+     */
+    getOwnerSigner(): OwnerSigner | null;
     /**
      * Schedule the node's initial self-record publish + ongoing refresh shortly
      * after start (non-blocking). {@link registerSelf} is idempotent and safely
      * no-ops when it cannot yet sign/insert (e.g. owner key not installed),
      * so the timer is harmless even when registration only becomes possible later.
+     * A record this process already put in place that is still current (a founding owner's
+     * explicit publish, a redeemed invitation's admission, a restart's first-growth re-touch) is
+     * not written again ({@link publishSelfRecordUnlessCurrent}). Whether the node is connected
+     * yet does not matter: a device that redeems within a second of starting is.
      */
     private scheduleSelfRegistration;
     /**
@@ -1436,11 +1560,42 @@ export declare class CadreNode implements SAppIdLookup {
     /** The body of {@link registerSelf}; serialised by its single-flight guard. */
     private publishSelfRecord;
     /**
-     * Record that this node's own address record just landed, and re-arm the stale-record
-     * warning. Called from BOTH publishing paths of {@link publishSelfRecord} and nowhere
-     * else — a `skipped` publish wrote nothing, so it must not refresh the stamp.
+     * Bookkeeping for a committed write of this node's own `CadrePeer` row by {@link publishSelfRecord}:
+     * `record` is the one the row holds (for the update path, the one its body signed on the
+     * attempt that committed, not the first it signed). Queued for the drain's re-touch
+     * ({@link pendingSelfPeerWrite}) when no sibling was reachable when the write started or when
+     * it ended: a sibling that identifies while the write is out may do so after the write's cohort
+     * was chosen, and the first-growth drain skips a row holding {@link lastSignedSelfRecord} unless
+     * this flag is set. Both fields are set here together so no write can leave the record without
+     * the flag.
+     */
+    private noteSelfPeerWritten;
+    /**
+     * Record that this node's own address record is in place as of `at`, and re-arm the
+     * stale-record warning. Called for BOTH publishing paths of {@link publishSelfRecord}
+     * ({@link noteSelfPeerWritten}), and by {@link publishSelfRecordUnlessCurrent} with the stamp
+     * of a record already in place — a `skipped` publish wrote nothing and found nothing, so it
+     * must not refresh the stamp.
      */
     private noteSelfRecordPublished;
+    /**
+     * {@link registerSelf}, unless the own row already holds the record this process last signed
+     * ({@link lastSignedSelfRecord}) and that record is current ({@link isCurrentSelfRecord});
+     * then nothing is written and the record counts as published at its own stamp. For a publish
+     * that puts a record in place (the boot timer, the reconcile pass's first publish, the
+     * first-growth drain), never the heartbeat, which exists to re-stamp freshness. `'current'`
+     * is this method's own answer; {@link registerSelf} always writes.
+     */
+    private publishSelfRecordUnlessCurrent;
+    /**
+     * Is `record` still the one to publish: signed less than half a heartbeat ago, with this
+     * node's profile, over the addresses it would publish now, and the signature the own row
+     * holds? The age bound keeps a record that is not re-written fresh for resolvers: at most half
+     * a heartbeat old here and re-stamped by the heartbeat within one more, so never older than
+     * 1.5 heartbeats (11.25 min) against {@link DEFAULT_PEER_RECORD_MAX_AGE_MS}. Cheap checks
+     * first: the row comes from the membership view, the addresses from the app's resolver.
+     */
+    private isCurrentSelfRecord;
     /**
      * Report an abandoned control write to the embedding app.
      *
@@ -1501,41 +1656,15 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private getSelfSigningKey;
     /**
-     * Does the `Strand` row name THIS machine as its founder — i.e. is its
-     * `FounderOwnerKey` this node's own owner key (the key behind its PeerId)?
-     * A null/absent column (a consent-seated strand, or a hand-built row) and a
-     * node with no owner key both derive `false`: without a positive match this
-     * machine must attach, never bootstrap. Pure key derivation, no I/O — cheap
-     * enough for {@link launchStrand}'s tracked-instance early return.
-     *
-     * NOTE: reads "one owner key per machine" — the reference model, where the owner
-     * key IS the key behind the PeerId. Two machines running the SAME identity key
-     * would both derive `true` and each bootstrap on its own replica, which is the
-     * double-`Header` hazard this derivation exists to avoid. Unreachable today: that
-     * configuration also gives both machines one PeerId, which already breaks control
-     * networking well before any strand launches. Revisit if machines ever share an
-     * owner key while holding distinct transport identities — the derivation would
-     * then need a per-machine discriminator (the `CadrePeer` PeerId) on the row.
+     * Does the `Strand` row name THIS machine as its founder — is its `FounderPeerId` this
+     * node's peer id? A null column (a consent-seated strand, or a hand-built row) derives
+     * `false`: without a positive match this machine must attach, never bootstrap. A peer id
+     * rather than an owner key, so two machines holding one owner key never both bootstrap
+     * (the double-`Header` hazard), and a node derives it before any owner signer is wired.
+     * Pure comparison, no I/O — cheap enough for {@link launchStrand}'s tracked-instance
+     * early return.
      */
     private isSelfFoundedRow;
-    /**
-     * The owner keypair (base64url Ed25519) derived from this node's resolved
-     * identity key. In the single-key reference model the owner signing key is
-     * *derived from* the node identity (see {@link ed25519KeyPairFromLibp2p}), so the
-     * same key material protected in a secure enclave backs both.
-     *
-     * Exposed so the hosting app retains control of owner genesis: cadre-core
-     * resolves + protects the identity, then the app sources this pair to drive
-     * `ensureOwnerKey(pub)` + `initializeSeedBootstrap(priv)` itself — cadre-core
-     * never silently runs genesis. A future separate-owner slot would return a
-     * distinct key here instead of the identity-derived one.
-     *
-     * @returns The base64url seed/public-key owner pair.
-     * @throws If called before {@link start} has resolved the identity, or when the
-     *   node runs on an ephemeral libp2p key (no `keyStore`/`privateKey` configured),
-     *   since that key is internal to libp2p and not exposed.
-     */
-    getIdentityOwnerKey(): Ed25519KeyPair;
     /**
      * Publish this node's own address record from the reconcile pass until its first publish of
      * this session lands. A node with no owner key — seeded (`addDrone`, `cadre enroll add`),
@@ -1553,12 +1682,17 @@ export declare class CadreNode implements SAppIdLookup {
      * process does not learn it was removed ({@link noteOwnRemoval}), and pays that read on every
      * pass.
      *
-     * Connected-only: a row written elsewhere arrives over a connection, and an owner's publish
-     * committed alone is local-only and forks its own history — a restarted owner whose embedder
-     * runs a pass before it reconnects would write its row on the stale side of the fork, and
-     * then never see rows written while it was down (`cadre-invite-any-member` runs that pass and
-     * fails every time without this condition). The boot-time publish and the first-growth drain already try at the node's lone and
-     * first-connection moments; this retries on the passes after.
+     * Only while a sibling is reachable ({@link hasReachableControlSibling}): a row written
+     * elsewhere arrives from a sibling, and an owner's publish committed alone is local-only and
+     * forks its own history — a restarted owner whose embedder runs a pass before it reconnects
+     * would write its row on the stale side of the fork, and then never see rows written while it
+     * was down (`cadre-invite-any-member` runs that pass and fails every time without this
+     * condition). A connection is not enough: until the sibling identifies, the write's cohort is
+     * this node alone. The boot-time publish and the first-growth drain already try at the
+     * node's lone and first-sibling moments; this retries on the passes after.
+     *
+     * A machine admitted by invitation finds its row already holding the record its redemption
+     * carried, and writes nothing ({@link publishSelfRecordUnlessCurrent}).
      */
     private publishFirstSelfRecord;
     /**
@@ -1575,7 +1709,21 @@ export declare class CadreNode implements SAppIdLookup {
      * stack listeners/timers.
      */
     private startRecordRefresh;
-    /** Tear down the self-record refresh timers + listener (see {@link cleanup}). */
+    /** The reconcile schedule's backstop: `network.controlCohort.reconcileMs`, default `DEFAULT_CONTROL_COHORT_RECONCILE_MS`. */
+    private controlReconcileBackstopMs;
+    /**
+     * The gate watch's run ({@link membershipGateWatch}): re-materialize the gate, so a
+     * replicated revocation hangs up the removed machine now (`hangUpRevokedControlPeers`
+     * ends every refresh), then start a reconcile pass for whatever else the change means
+     * (a new sibling to dial, a tombstoned row to reap). A local membership write refreshes
+     * the gate twice — once from the awaited membership listener, so the writer sees its
+     * change before returning, and once here, 50 ms later. The listener's refresh runs under
+     * the write lock, so its reads take the committed-read path and the view keeps nothing
+     * from them; this refresh is the read that refills the view after the write, which some
+     * later caller would otherwise pay. Accepted: one reload per change, not two.
+     */
+    private onMembershipGateTablesChanged;
+    /** Tear down the self-record refresh timers, the reconcile schedule and the listeners (see {@link cleanup}). */
     private stopRecordRefresh;
     /**
      * Resolve a peer's current, signed, trust-checkable multiaddrs from only its
@@ -1649,37 +1797,49 @@ export declare class CadreNode implements SAppIdLookup {
      * Run one proactive control-cohort dial pass to keep this node connected to its
      * cadre siblings (so the `CadreControl` collections form a replicating cohort).
      * Public so the cohort-growth-driven re-replication path
-     * (`control-write-ensure-replicated`) and tests can trigger a pass on demand;
-     * normally driven by the eager start pass, the recurring interval, and
-     * `self:peer:update` (all wired in {@link startRecordRefresh}).
+     * (`control-write-ensure-replicated`), `addDrone`'s callers, `claimNode`,
+     * `redeemCadreInvitation` and tests can run a pass on demand. On its own a pass
+     * runs when something it acts on changes, and otherwise at a backstop
+     * ({@link controlReconcileRuns}): once after start; on `self:peer:update`; when a
+     * membership table changes, local commit or replicated ({@link membershipGateWatch});
+     * when a control connection to an authorized sibling opens or closes
+     * ({@link onControlSiblingConnectionChange}); on the redial and strand-address wakes
+     * a pass arms for itself ({@link armReconcileWake}); and at the backstop,
+     * `network.controlCohort.reconcileMs` (default `DEFAULT_CONTROL_COHORT_RECONCILE_MS`,
+     * 2 minutes) after the last pass settled. A connection to a relay, a bootstrap node or
+     * another party's machine starts no pass: the pass acts on none of them, beyond
+     * counting them as "connected" for its write steps, which therefore run at the next
+     * membership change or backstop on a one-machine party whose only connection is a
+     * relay.
      *
      * Concurrent triggers collapse into a single in-flight pass
      * (see {@link reconcileControlCohortInFlight}) so two passes never double-dial;
-     * a call that joins an in-flight pass resolves to THAT pass's result.
+     * a call that joins an in-flight pass resolves to THAT pass's result (a scheduled
+     * run waits for it instead, so the change that woke the run is seen).
      * Best-effort throughout: a failure to resolve/dial any one sibling is logged
      * and the pass continues; the whole pass is a no-op when the node is alone.
      *
      * Resolves to the peers the pass dialled ({@link ControlCohortReconcileResult}),
      * so a caller can tell a link this pass opened from one something else opened —
-     * the pass skips a peer that is already connected. The timer and event triggers
-     * discard it.
+     * the pass skips a peer that is already connected. The scheduled runs discard it.
      */
     reconcileControlCohort(): Promise<ControlCohortReconcileResult>;
+    /** One pass, then the wake it earns ({@link armReconcileWake}); the public result is the pass's `dialed`. */
+    private runReconcileControlCohortAndArmWake;
+    /**
+     * After every pass, explicit or scheduled: advance or reset the redial streak and
+     * `trigger` the schedule for the earliest of the pass's own reasons to run again
+     * (`nextReconcileWakeMs`): a redial for a sibling or bootstrap peer it left
+     * unconnected, or a strand-address ask falling due before the backstop. Nothing else
+     * the pass does needs a wake sooner than the backstop: delegate grants re-announce
+     * every 15 minutes inside a 30-minute TTL, the FRET and formation address re-merges
+     * guard a one-hour expiry, and the self record has its own heartbeat. A pass that
+     * runs before the schedule exists (an explicit call during the first second after
+     * start) still counts for the streak.
+     */
+    private armReconcileWake;
     /** Body of {@link reconcileControlCohort}; serialised by its single-flight guard. */
     private runReconcileControlCohort;
-    /**
-     * The owner-only half of the reconcile pass's ledger-marker step: file the singleton
-     * `Revocation` marker ({@link SeedBootstrapService.openRevocationLedger}) unless this
-     * process has already seen it filed. The connectivity gate is the caller's
-     * ({@link runReconcileControlCohort}); why the marker exists is on
-     * {@link ControlDatabase.openRevocationLedger}.
-     *
-     * Sets {@link revocationLedgerOpened} on `'opened'` or `'already-open'`. A node that
-     * cannot sign as an owner does nothing: it picks the owner's marker up the first time it
-     * reads the table, like any other replicated row. Best-effort like every step of the
-     * pass — a failure is logged and leaves the flag clear, so the next connected pass retries.
-     */
-    private openRevocationLedgerIfDue;
     /**
      * Resolve every sibling's signed address record once and merge what resolves
      * into the control node's libp2p **address book** (peerStore). Returns the
@@ -1703,8 +1863,9 @@ export declare class CadreNode implements SAppIdLookup {
      * current ({@link refreshDialHint}).
      *
      * NOTE: this resolves EVERY sibling serially before the dial loop below runs,
-     * so it costs one record query per sibling per reconcile pass (~15s) and each
-     * one delays the pass's first dial. A cadre is a handful of devices, so today
+     * so it costs one record query per sibling per reconcile pass (served from the
+     * membership rows view while it is current) and each one delays the pass's first
+     * dial. A cadre is a handful of devices, so today
      * that is a few extra local reads; if cadres ever grow large, batch the records
      * into one query, merge only on change, or move the warm pass after the dials.
      */
@@ -1766,16 +1927,18 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private collectSiblingStrandAddrs;
     /**
-     * Dial one sibling from its already-resolved addresses, best-effort. Returns
-     * whether the dial resolved (false when no address resolves or the dial fails).
+     * Dial one sibling from its already-resolved addresses, best-effort.
      *
      * A per-peer failure (NAT, offline, relay down, connection-gater denial, or
      * the {@link controlDialBudget} expiring) is logged and swallowed so one
      * unreachable sibling never aborts the pass — exactly like
      * {@link SeedBootstrapService.applySeed}'s owner-dial loop. A failed dial is
-     * simply retried on the next pass. A sibling whose every address relays
-     * through this node ({@link SelfRelayOnlyError}) is not dialed at all and gets
-     * a one-line log instead: only the sibling can reconnect.
+     * retried on the pass's redial ladder ({@link armReconcileWake}: 15 s, 30 s, 60 s,
+     * then every backstop) and on any pass a change starts sooner. A sibling with no
+     * dialable address, or whose every address relays through this node
+     * ({@link SelfRelayOnlyError}), is not dialed at all and is `undialable`: it gets a
+     * one-line log and no redial, since only a change — its record replicating in, or
+     * the sibling connecting — can make it dialable, and each of those starts a pass.
      */
     private dialControlSibling;
     /**
@@ -1819,7 +1982,7 @@ export declare class CadreNode implements SAppIdLookup {
      * These addresses are never merged into the libp2p address book: they are
      * unverified, and the address book takes only verified ones (see
      * `mergePeerAddrs`). Layers that dial by bare peer id use the connection this
-     * dial opens, and after it drops the next reconcile pass dials again.
+     * dial opens, and after it drops the reconcile pass the close starts dials again.
      *
      * NOTE: an entry is consulted here only for a current sibling, so a peer revoked
      * by another owner is not dialed from it, even though the entry stays (only this
@@ -1847,22 +2010,22 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private peerStoreAddrs;
     /**
-     * Retain a just-applied seed's owner-flagged peers as cold-start bootstrap
-     * dial targets (see {@link bootstrapPeerStore}).
+     * Retain a just-applied seed's preferred peers (`SeedPeer.preferred`) as cold-start
+     * bootstrap dial targets (see {@link bootstrapPeerStore}).
      *
      * Called for every seed this node accepts, on BOTH intake paths — the
      * {@link applySeed} wrapper (which may run on a throwaway service, so the
      * service itself is the wrong place to keep this) and the inbound
-     * `/sereus/seed/1.0.0` handler via `onSeedApplied`. Peers with no address are
-     * skipped: there is nothing to dial.
+     * `/sereus/seed/1.0.0` handler via `onSeedApplied`.
      *
-     * `isOwner` is the seed's own claim about its peers, exactly as
+     * `preferred` is the seed's own claim about its peers, exactly as
      * `SeedBootstrapService.applySeed` uses it to choose its dial targets. That is
      * sound here for the same reason it is sound there — the whole seed is
      * signature-checked against a trust-anchored signer before this runs, and the
      * flag only *selects a dial target*; a dial grants no authority.
      *
-     * Addressless peers and self are skipped by {@link retainDialTarget}.
+     * The peers retained are `seedDialTargets` (addressless peers and self dropped), the same
+     * ones the service dials; they are returned for the `seed:applied` payload.
      */
     private recordSeedBootstrapPeers;
     /**
@@ -1877,34 +2040,35 @@ export declare class CadreNode implements SAppIdLookup {
      * failing a seed or an add that has already been accepted.
      *
      * Two peers are never retained. One with no address: there is nothing to dial.
-     * And self: `createSeed` projects EVERY `CadrePeer` row, so an owner that applies
-     * a seed minted after it joined finds itself in the owner list, and `addDrone`
-     * could be handed this node's own id. Retaining self would make the cold-start
+     * And self: `addDrone` could be handed this node's own id (seed intake arrives
+     * already filtered by `seedDialTargets`). Retaining self would make the cold-start
      * pass dial this node forever (the steady-state pass filters self out of its
      * sibling list for the same reason).
      */
     private retainDialTarget;
     /**
      * Cold-start branch of the reconcile pass: re-dial every retained out-of-band
-     * dial target (see {@link bootstrapPeerStore}) — in practice the owner peers of
-     * the seeds this node applied — while the control database still has no
+     * dial target (see {@link bootstrapPeerStore}) — in practice the preferred peers
+     * of the seeds this node applied — while the control database still has no
      * siblings to dial.
      *
-     * `SeedBootstrapService.applySeed` dials those owners exactly ONCE, best-effort.
-     * When that single dial fails — owner momentarily down, relay reservation not
+     * `SeedBootstrapService.applySeed` dials those peers exactly ONCE, best-effort.
+     * When that single dial fails — peer momentarily down, relay reservation not
      * up yet, NAT traversal lost the race — the joining node has an empty
      * `CadrePeer` table and no connection, and the steady-state pass above cannot
      * help: it dials only siblings enumerated from that very table. Retrying here
      * is the only way back in.
      *
-     * Unbounded, at the reconcile cadence, with no backoff: the branch is already
-     * gated by "the control database has no siblings", so it stops the moment the
-     * node is actually in the party, and a node that is stranded MUST keep trying —
-     * a give-up rule would turn a transient outage into a permanent one. The steady
-     * cost is one dial per bootstrap peer per pass (seeds nominate one or a few
-     * owners), each failing fast against an unreachable address.
-     * NOTE: if seeds ever carry many owner peers, or the reconcile cadence tightens
-     * well below its 15 s default, add per-peer backoff here.
+     * Unbounded: the branch is already gated by "the control database has no
+     * siblings", so it stops the moment the node is actually in the party, and a node
+     * that is stranded MUST keep trying — a give-up rule would turn a transient outage
+     * into a permanent one. A failed dial earns the pass a redial wake on the ladder
+     * {@link armReconcileWake} runs (15 s, 30 s, 60 s, then every backstop, 2 minutes
+     * by default), so the steady cost is one dial per bootstrap peer per backstop (a
+     * seed prefers its minter and the party's always-on machines, a few at most), each
+     * failing fast against an unreachable address.
+     * NOTE: the ladder is per pass, not per peer; if seeds ever carry many preferred
+     * peers, add per-peer backoff here.
      *
      * Best-effort per peer, exactly like {@link dialControlSibling}: one dead
      * address never aborts the pass.
@@ -1923,20 +2087,26 @@ export declare class CadreNode implements SAppIdLookup {
      * encapsulated; an unencapsulatable one is dropped rather than dialed bare.
      */
     private bootstrapDialAddrs;
-    /** Dial one cold-start bootstrap peer, best-effort. Returns whether it connected. */
+    /**
+     * Dial one peer from its retained dial target's addresses, best-effort: a cold-start bootstrap
+     * peer, or a just-claimed node ({@link redialClaimedNode}), which `context` names in the logs.
+     * Returns whether it connected.
+     */
     private dialBootstrapPeer;
     /**
-     * Whether a control write happening now would commit local-only. A sound lower
-     * bound is "no connected control peers": 0 connections ⇒ the block's cluster is
-     * ≤1 ⇒ Optimystic commits without broadcasting. This is the pragmatic proxy for
-     * the precise signal (the block's `getClusterSize`); it over-approximates safely
-     * — a connected-but-not-in-this-block's-cluster write may still be local-only and
-     * is caught by the cohort's periodic pull-on-read instead. Re-issuing an already-
-     * replicated row is harmless (an idempotent monotonic bump), so the coarse proxy
-     * is acceptable as the agreed first cut.
+     * Whether a control write happening now would commit local-only: no sibling is reachable
+     * ({@link hasReachableControlSibling}, the public form, so the two cannot drift). A relay, a
+     * bootstrap node or a peer that has not identified yet holds a connection without being in the
+     * write's cohort, so a write made with only those connected is queued too. One made alone at
+     * the revision the cohort reached meanwhile is a fork no later consult sees, because a consult
+     * compares revision numbers only; the re-issue on the growth edge is what conflicts with the
+     * cohort's copy and pulls it in.
      *
-     * Reads {@link getControlConnectionCount} — the public, embedder-facing form of
-     * the same sample — so the two cannot drift.
+     * Still a proxy for the precise signal (the block's own cohort): a reachable sibling outside
+     * this block's cohort leaves the write local-only, caught by the cohort's pull-on-read. On the
+     * control network every block's cohort is the whole party, so that gap is a party larger than
+     * `CONTROL_REPLICATION_BREADTH`. Re-issuing a replicated row is harmless (an idempotent
+     * monotonic bump).
      */
     private committedAlone;
     /**
@@ -1966,7 +2136,7 @@ export declare class CadreNode implements SAppIdLookup {
     /**
      * Drain the write-while-alone re-replication queue: re-issue the writes that
      * committed local-only now that the cohort can broadcast them. Public so the
-     * 0→≥1 growth trigger ({@link handleControlConnectionChange}) and tests can drive
+     * growth trigger ({@link updateControlSiblingReachability}) and tests can drive
      * it; concurrent calls collapse into one in-flight drain
      * ({@link drainControlReplicationInFlight}) so two growth signals never
      * double-issue. Best-effort throughout — a per-row failure leaves that entry
@@ -2035,8 +2205,11 @@ export declare class CadreNode implements SAppIdLookup {
     private reconstructAuthoredMembership;
     /**
      * Body of {@link reconstructAuthoredMembership}'s sweep: re-issue each candidate
-     * owner-authored row, returning how many were re-touched. A per-row failure is
-     * logged and skipped; a teardown mid-sweep stops it.
+     * owner-authored row, returning how many were re-touched. A row the sweep already holds as
+     * self-published is skipped without a call; the re-touch itself decides again over the row
+     * it reads under the lock, so a row that vanished or was self-published since the sweep's
+     * read is reported, not written. A per-row failure is logged and skipped; a teardown
+     * mid-sweep stops it.
      */
     private reissueAuthoredMembershipRows;
     /**
@@ -2052,9 +2225,10 @@ export declare class CadreNode implements SAppIdLookup {
      */
     private drainPendingPeerWrites;
     /**
-     * Body of {@link drainPendingPeerWrites}' loop. An entry is cleared only on
-     * success (or when there is nothing left to re-issue); a failure is logged and
-     * the entry stays queued for the next cohort growth.
+     * Body of {@link drainPendingPeerWrites}' loop. An entry is cleared on every outcome the
+     * re-touch reports — re-touched, or nothing left to re-issue because the row was removed
+     * since or the peer self-published; the re-touch decides which over the row it reads under
+     * the lock. A failure is logged and the entry stays queued for the next cohort growth.
      */
     private reissuePendingPeerWrites;
     /**
@@ -2062,23 +2236,84 @@ export declare class CadreNode implements SAppIdLookup {
      * `UpdatedAt` strictly above the stored value (and the wall clock) and re-sign via
      * the owner branch of `CadrePeer.AuthorizedUpdate`. The row already exists
      * locally (it committed there, just local-only), so this is an UPDATE, not the
-     * original INSERT.
+     * original INSERT. The bump, and whether the row is still the owner's to re-issue, are
+     * decided over the row as read inside the write ({@link SeedBootstrapService.reauthorizePeer}'s
+     * re-broadcast mode).
      */
     private reissuePeerAuthorize;
     /**
-     * On a control connection opening, detect the 0→≥1 transition and drain the
-     * write-while-alone re-replication queue (single-flight; fires only on the edge,
-     * not on every subsequent `connection:open`). Best-effort — a drain failure is
-     * logged, not thrown.
-     */
-    private handleControlConnectionChange;
-    /** Re-arm the growth edge once all control connections drop, so a later reconnect re-drains. */
-    private handleControlConnectionClose;
-    /**
-     * Wire the control-connection growth listeners that drive write-while-alone
-     * re-replication. Wired in {@link start} (not the delayed refresh path) so no
-     * early `connection:open` is missed; torn down in {@link stopRecordRefresh}.
-     * Idempotent.
+     * Re-evaluate {@link hasReachableControlSibling} and act on its edges: on false→true, drain
+     * the write-while-alone re-replication queue (single-flight; best-effort, a drain failure is
+     * logged, not thrown); on true→false, re-arm, so the next reachable sibling drains again.
+     * Called when a peer identifies, when a connection closes, and after every membership refresh,
+     * where a sibling that connected before this node authorized it (the production join order)
+     * becomes reachable. A device counted in for its admission ({@link admittingDevices}) is not
+     * a trigger: the admission's own writes are in flight, and its row landing refreshes
+     * membership.
+     */
+    private updateControlSiblingReachability;
+    /**
+     * A connected peer identified as serving the control database: count it
+     * ({@link identifiedControlPeers}), re-evaluate the growth edge, and run the sibling-open
+     * reactions, once per connected period. libp2p re-emits `peer:identify` on every
+     * identify-push from a connected peer, and those repeats start nothing.
+     */
+    private onControlPeerIdentified;
+    /**
+     * A control connection closed: `remotePeer` stops counting once it has none left, and the
+     * growth edge re-arms if no reachable sibling remains. The sibling-close reaction runs on every
+     * close. libp2p's connection manager drops the closed connection from `getConnections` before
+     * this listener runs: libp2p dispatches each event on its internal bus, where the connection
+     * manager listens, before re-dispatching it to the node's own listeners.
+     */
+    private onControlConnectionClosed;
+    /**
+     * Count the peers that identified before {@link wireControlConnectionListeners} ran, whose
+     * `peer:identify` has already fired, from their peer-store records. Updates the growth edge
+     * but runs no sibling-open reaction, as a connection that predates the listeners never did. A
+     * peer not yet in the peer store is still identifying, and its own event counts it.
+     */
+    private noteIdentifiedControlPeers;
+    /**
+     * An AUTHORIZED sibling became reachable (its identify, once per connected period:
+     * {@link onControlPeerIdentified}) or one of its connections closed: start a reconcile
+     * pass. On open the pass asks the new sibling for strand addresses and re-arms the
+     * delegate grants; on close it re-dials. First, on open, drop the membership rows
+     * views: a machine that was offline while a sibling committed learns of the commit
+     * only when it next reads the block from storage, and dropping the views makes the
+     * pass's reads do that now rather than after the views' maximum age. Those reads can
+     * fall inside the read-repair window, so the open also arms a second drop past it
+     * ({@link armMembershipViewReload}). Any other
+     * peer — a relay, a bootstrap node, another party's machine — starts nothing.
+     *
+     * On identify rather than `connection:open` because, until the sibling identifies,
+     * Optimystic's cohort for every control block is this node alone: a pass started at the
+     * open writes (the first self-record publish) and reads on a cohort of one.
+     */
+    private onControlSiblingConnectionChange;
+    /**
+     * Drop the membership views again {@link MEMBERSHIP_VIEW_RECONNECT_RELOAD_MS} after a
+     * sibling connects, and start a pass whose reads reload them. This node's reads before
+     * the connection stamped Optimystic's read-repair window on the control blocks, so the
+     * reload the open itself starts is served from the local copy with no cohort consult,
+     * and the view would keep rows that predate the sibling's commits until its maximum age.
+     * The reload past the window starts the consults; one that brings a newer revision
+     * raises the table change that drops the view and refreshes the gate. Re-armed by every
+     * open, so it runs one window after the latest.
+     *
+     * NOTE: a consult Optimystic defers (16 already in flight) starts nothing and leaves the block
+     * unstamped, so the view keeps its rows until the first read past its maximum age, which on an
+     * idle node is the reconcile backstop. If `cluster-tx:read-repair-deferred` lines show at a
+     * reconnect, re-arm this reload once more instead of waiting for the backstop.
+     */
+    private armMembershipViewReload;
+    /**
+     * Wire the control-connection listeners, which keep {@link identifiedControlPeers}: the
+     * growth edge that drives write-while-alone re-replication, and the sibling reconcile
+     * trigger ({@link onControlSiblingConnectionChange}). Wired in {@link start} (not the
+     * delayed refresh path) so no early identify is missed, and reads back the peers that
+     * identified before it ran ({@link noteIdentifiedControlPeers}); torn down in
+     * {@link stopRecordRefresh}. Idempotent.
      */
     private wireControlConnectionListeners;
     /**
@@ -2322,7 +2557,7 @@ export declare class CadreNode implements SAppIdLookup {
      * `Strand` row. A joiner (the row arrived over the control network) wants exactly this; a
      * FOUNDER wants {@link foundStrand}, which publishes and attaches in one resumable call.
      * With no explicit `founder` flag, founder-ness is derived from the row's
-     * `FounderOwnerKey` (see {@link StrandConfig.founder}) — so attaching a row THIS machine
+     * `FounderPeerId` (see {@link StrandConfig.founder}) — so attaching a row THIS machine
      * published (e.g. re-attaching its own orphan after a restart) founds it, and attaching
      * anyone else's row joins, without the caller needing to know which it is.
      *
@@ -2335,8 +2570,9 @@ export declare class CadreNode implements SAppIdLookup {
      * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
      * automatic relaunch need it. A failed launch here hands the strand back to that
      * relaunch — `StrandWatcher.forgetStrand` drops the id from the watcher's
-     * `knownStrands` and records the backoff, so a later poll re-attempts it on the same
-     * `pollInterval * 2^(failures-1)` ladder a watcher-driven failure gets. Because the
+     * `knownStrands`, records the backoff and wakes the watcher when it expires, so the
+     * strand is re-attempted on the same ladder a watcher-driven failure gets
+     * (`min(strandWatchInterval, 5 s) * 2^(failures-1)`, capped at 5 minutes). Because the
      * config stays registered, the retry takes `handleStrandAdded`'s auto-launch branch:
      * what the app sees is `strand:error` per failed retry and `strand:started` when one
      * succeeds, never a second `strand:discovered`. {@link detachStrand} (reached via
@@ -2393,11 +2629,12 @@ export declare class CadreNode implements SAppIdLookup {
      * fresh publish also clears it for an OPEN strand, but is destructive for a closed one
      * (the key exists nowhere else). No app-data wipe is needed for either.
      *
-     * The insert is signed with the ed25519 key behind this node's PeerId — which
-     * {@link ed25519KeyPairFromLibp2p} also exposes as the node's owner keypair,
-     * so peer identity and owner key are one and the same. That key is also persisted on the
-     * row as `FounderOwnerKey` (the schema pins the column to the verified signer), which is
-     * what later lets any launch derive "this machine is the founder" from the row alone.
+     * The insert is signed through this node's owner signer ({@link getOwnerSigner}), in one
+     * approval and one control transaction with a closed strand's party key
+     * ({@link ControlDatabase.insertFoundingRows}). The signer's key is persisted on the row
+     * as `FounderOwnerKey` (the schema pins the column to the verified signer), and this node's
+     * peer id as `FounderPeerId` (bound into the signature), which is what later lets any
+     * launch derive "this machine is the founder" from the row alone.
      * The key must be enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
      * at genesis) or the schema's `Strand.AuthorizedInsert` constraint rejects the write.
      * Failing loudly here is intentional: a silently-unpublished strand would run
@@ -2405,7 +2642,8 @@ export declare class CadreNode implements SAppIdLookup {
      *
      * A CLOSED strand's publish also seats this party's own membership identity key —
      * the `StrandPartyKey` row {@link ensureStrandPartyKey} documents — which is what the
-     * founder bootstrap derives `Member.Key`/`Manager.MemberKey` from. The
+     * founder bootstrap derives `Member.Key`/`Manager.MemberKey` from; a key the party already
+     * holds for the id is kept. The
      * `memberPrivateKey` ARGUMENT stays the strand-wide read secret formation hands to
      * joiners; it derives nobody's identity.
      *
@@ -2413,20 +2651,67 @@ export declare class CadreNode implements SAppIdLookup {
      *   {@link addStrand}).
      * @param type - `'o'` for open (default) or `'c'` for closed.
      * @param memberPrivateKey - Optional shared membership (read) key for a closed strand.
+     * @param sign - The `sign` of an owner approval the caller already holds
+     *   ({@link getOwnerSigner}), so a larger action asks once; omitted, this asks for its own.
      * @returns The live `Strand` row — the one just inserted, or the matching one already
      *   there. A closed strand's caller should carry THIS row's `MemberPrivateKey` forward:
      *   on a repeat it is the stored key, not the argument.
-     * @throws if the node is not started, exposes no owner signing key, the id is blank or
+     * @throws if the node is not started, has no owner signer wired, the id is blank or
      *   unusable as a storage scope key (`InvalidStrandIdError` — see `storage-scope.ts`), a
      *   row with the same id holds different content, or the control DB rejects the
      *   (unauthorized) insert.
      */
-    publishStrand(strandId: string, type?: 'o' | 'c', memberPrivateKey?: string): Promise<StrandRow>;
+    publishStrand(strandId: string, type?: 'o' | 'c', memberPrivateKey?: string, sign?: OwnerSign): Promise<StrandRow>;
+    /**
+     * The `Strand` row this machine publishes for `strandId`, as {@link publishStrand} and
+     * {@link foundStrand} write it: the id trimmed and checked, this node's owner key and peer id
+     * as its founder.
+     */
+    private founderStrandRow;
+    /**
+     * The write half of {@link publishStrand} and {@link foundStrand}: under one owner approval,
+     * insert `desired`, a closed strand's party key and the requested invitation in one control
+     * transaction ({@link ControlDatabase.insertFoundingRows}), adopting a matching row a
+     * concurrent founder landed first. Reads nothing first: the caller has just read the
+     * `Strand` row, and a stored key or row is resolved from the insert's own rejection.
+     */
+    private writeFoundingRows;
+    /** {@link writeFoundingRows} inside its approval. */
+    private insertOrAdoptFounding;
+    /**
+     * Insert `desired`'s founding rows, minting a closed strand's party key — this party's own
+     * membership identity, which the founder bootstrap derives `Member`/`Manager` from, distinct
+     * from the row's shared `MemberPrivateKey` read secret. A key already stored for the id with
+     * no strand row (one {@link ensureStrandPartyKey} seated, which it would adopt too) refuses
+     * that transaction whole; the rows are then written again without a key.
+     *
+     * @returns The party key this seated; undefined when it seated none, so the launch reads the stored one.
+     */
+    private seatFoundingRows;
+    /**
+     * Resolve a founding refused on `Strand.Id`: re-read the row that landed and adopt it when it
+     * matches `desired` — a concurrent founder, such as two machines of one party on one id —
+     * or throw naming the columns that differ.
+     */
+    private adoptConcurrentFounding;
+    /**
+     * Publish a founding's invitation on its own, bound to `strandId`, for a founding that adopted
+     * a stored row rather than writing its own — unless the invitation is already stored, bound to
+     * this strand, as a repeat of a founding whose transaction committed leaves it.
+     *
+     * @param sign - The open approval's `sign`; omitted, the publish asks for its own.
+     */
+    private publishFoundingInviteIfAbsent;
     /**
      * Found a strand — publish its row cadre-wide AND start the local instance as its
      * founder — in one resumable call. The single entry point for creating a strand; a
      * caller joining one someone else founded uses {@link addStrand} alone.
      *
+     * The publish is one control transaction under one owner approval: the `Strand` row, a
+     * closed strand's `StrandPartyKey` row, and the invitation in
+     * {@link FoundStrandConfig.formationInvite} when one is given. The start then uses the party
+     * key the publish seated rather than reading it back.
+     *
      * Safe to re-run from any point of interruption, which hand-rolling
      * {@link publishStrand} + {@link addStrand} is not. Either half can already have
      * happened:
@@ -2438,7 +2723,7 @@ export declare class CadreNode implements SAppIdLookup {
      *   attempt (as the reference apps do) would otherwise present a key that does not match
      *   the membership already seated in the strand.
      * - **instance already running** → the tracked instance is returned, and — because the
-     *   `Strand` row records its publishing machine (`FounderOwnerKey`) — a founder request
+     *   `Strand` row records its founding machine (`FounderPeerId`) — a founder request
      *   against an instance that was first launched as a joiner now runs the (idempotent,
      *   insert-if-absent) founder bootstrap on it rather than silently skipping it
      *   ({@link StrandInstanceManager.foundExistingStrand}). So a strand that something else
@@ -2447,7 +2732,7 @@ export declare class CadreNode implements SAppIdLookup {
      *   `resolveCohortSeed` window — still ends up with its `Strand.Header` written.
      *
      * Founder-ness is resolved FROM THE ROW, not assumed: this machine founds iff the
-     * resolved row's `FounderOwnerKey` is its own owner key. A fresh publish records this
+     * resolved row's `FounderPeerId` is its own peer id. A fresh publish records this
      * machine, so the common path founds; a machine that lost a concurrent founding race to
      * a sibling adopts the sibling's row and ATTACHES instead — deliberately, since two
      * machines bootstrapping the same strand on separate replicas is the double-`Header`
@@ -2456,12 +2741,51 @@ export declare class CadreNode implements SAppIdLookup {
      * `Type` is compared, not adopted: a stored row of the other type means the caller and
      * the control plane disagree about what this strand IS, so it throws.
      *
+     * **Returning after the publish.** `foundStrand(config, { background: true })` resolves
+     * once the row is published and continues the local start in
+     * {@link FoundStrandBackgroundResult.ready}, for a caller that needs only the row (an
+     * invitation reads just its id and membership key). Publish errors still reject the call
+     * itself. A joiner that redeems an invitation to a closed strand before its start finishes
+     * is refused with the retryable `host-strand-unavailable` and the token stays unspent:
+     * {@link requestJoin} retries that on its backoff, while {@link formStrand} throws it to its
+     * caller once every machine the invitation names has refused.
+     *
      * @returns The instance AND the row the strand actually runs under — read the membership
      *   key from the returned row, not from a freshly minted one ({@link FoundStrandResult}).
      * @throws if the node is not started, the id is blank, a published row of the same id has
      *   a different `Type`, or either half rejects.
      */
     foundStrand(config: FoundStrandConfig): Promise<FoundStrandResult>;
+    /**
+     * Publish the strand's row as {@link foundStrand} does, and resolve once it is published;
+     * the local start continues in {@link FoundStrandBackgroundResult.ready}.
+     *
+     * @throws as the default form does for the publish half; the start's own failure rejects
+     *   `ready` instead.
+     */
+    foundStrand(config: FoundStrandConfig, options: FoundStrandOptions): Promise<FoundStrandBackgroundResult>;
+    /**
+     * The publish half of {@link foundStrand}: adopt the stored row or publish a new one, and
+     * derive whether this machine founds it. Every check that can refuse the founding is here,
+     * so both forms of `foundStrand` reject on it before returning.
+     */
+    private publishFoundingRow;
+    /** {@link publishFoundingRow} when no row is stored: write the founding rows under this node's owner. */
+    private publishFoundingStrand;
+    /**
+     * {@link publishFoundingRow} over a stored row: adopt it ({@link adoptPublishedStrand}), then
+     * publish the requested invitation on its own, under its own approval.
+     */
+    private resumeFounding;
+    /**
+     * The start half of {@link foundStrand}. Its timing lines (`addStrand: start`, then the
+     * duration or `failed after`) are logged when the start settles, also in the background
+     * form, so a start that hangs still shows as a start line with no end line.
+     *
+     * A party key the publish half just seated is handed to the launch, which would otherwise
+     * read back the row the same founding wrote.
+     */
+    private attachFoundingRow;
     /**
      * Resume onto an already-published `Strand` row: keep its stored content, reject a type
      * disagreement. The stored `MemberPrivateKey` is authoritative — see {@link foundStrand}
@@ -2475,9 +2799,10 @@ export declare class CadreNode implements SAppIdLookup {
      * inverse of {@link publishStrand}.
      *
      * Party-wide, unlike {@link stopStrand}, which only stops the strand on THIS node: every
-     * cadre node watching the table sees the row vanish on its next poll (default 5 s) and
-     * stops its own instance. This node converges immediately — the method forces a watcher
-     * poll and stops any still-running local instance before resolving. Removing the row
+     * cadre node watching the table hears the row's removal and stops its own instance (a
+     * machine outside the `Strand` block's cohort, on a cadre larger than 16, only at its
+     * watcher's backstop read, default 5 minutes). This node converges immediately — the
+     * method forces a watcher run and stops any still-running local instance before resolving. Removing the row
      * removes OUR party's participation only: other parties in the strand keep their own
      * rows and the strand network carries on, so no cross-party sign-off is involved — this
      * is an owner-signed control-plane write like every other, not "destroy the network".
@@ -2521,7 +2846,7 @@ export declare class CadreNode implements SAppIdLookup {
      * step, not a widening of this method.
      *
      * @param strandId - The `Strand` row id to remove (as passed to {@link publishStrand}).
-     * @throws if the node is not started, exposes no owner signing key, the id is blank, or
+     * @throws if the node is not started, has no owner signer wired, the id is blank, or
      *   the signer is not an enrolled owner (the schema's `Strand.AuthorizedDelete` rejects
      *   the write and the row survives). A rejection does NOT imply the row survived: the
      *   local stop runs after the control-plane delete has already committed, so a failure
@@ -2542,9 +2867,11 @@ export declare class CadreNode implements SAppIdLookup {
      * as `MemberPrivateKey`; docs/strands.md → "Closed-Strand Member Key Handling") and is
      * never put on the formation wire.
      *
-     * Called internally by {@link publishStrand} (closed strands mint at publish) and by a
-     * founder launch that finds no row (a publish interrupted before its mint); public so a
-     * test harness — or a joiner flow that persists a formation-issued identity — can seat
+     * A founding seats the key in the same transaction as the strand row, not through here.
+     * Called internally by {@link publishStrand}'s repeat of a published closed strand and by a
+     * founder launch that finds no row, which heal a closed strand row stored without its key
+     * (one seated by `ControlDatabase.insertStrand` directly, or whose key was removed); public
+     * so a test harness — or a joiner flow that persists a formation-issued identity — can seat
      * a specific key deliberately.
      *
      * @param strandId - The strand the key is this party's identity for.
@@ -2552,15 +2879,17 @@ export declare class CadreNode implements SAppIdLookup {
      *   `generateStrandMemberKey` mints). When a row already holds a DIFFERENT key this
      *   throws — a party has one identity per strand; rotation is a deliberate
      *   remove-then-insert, not a silent swap.
+     * @param sign - The `sign` of an owner approval the caller already holds; omitted, a
+     *   mint asks for its own (a stored key asks for none).
      * @returns The live party key: the one just seated, or the stored one.
      */
-    ensureStrandPartyKey(strandId: string, partyMemberPrivateKey?: string): Promise<string>;
+    ensureStrandPartyKey(strandId: string, partyMemberPrivateKey?: string, sign?: OwnerSign): Promise<string>;
     /**
      * Resolve the party membership key a closed strand's launch threads into the founder
      * bootstrap: the explicit attach-time key when given, else the party's persisted
-     * `StrandPartyKey` row, else — on the one machine whose owner key the row names as
-     * founder — a freshly minted-and-persisted key, which seats the identity for a publish
-     * that was interrupted before its mint. Everyone else resolves undefined: non-founding
+     * `StrandPartyKey` row, else — on the one machine the row names as founder (`FounderPeerId`)
+     * — a freshly minted-and-persisted key, which seats the identity for a closed row stored
+     * without one (see {@link ensureStrandPartyKey}). Everyone else resolves undefined: non-founding
      * machines never mint (no mint race between a party's machines), and only a founder
      * bootstrap needs the key at all.
      *
@@ -2585,26 +2914,35 @@ export declare class CadreNode implements SAppIdLookup {
      * Counterpart to {@link createOpenInvitation}, which only mints the
      * out-of-band {@link OpenInvitation} envelope: persisting the matching
      * `FormationInvite` row is what makes the token *redeemable* — the host's
-     * {@link ControlFormationUsageRecorder} answers `isTokenValid`/`isTokenUsed`
-     * from this row. A host minting a closed-strand invite does both (mint +
+     * {@link ControlFormationUsageRecorder} reads it (`readToken`) to check a
+     * redemption. A host minting a closed-strand invite does both (mint +
      * publish), exactly as the integration harness's `createInvitation` does.
      *
-     * Signs with the same self-owner key as {@link publishStrand} (the ed25519
-     * key behind this node's PeerId, which must be an enrolled `OwnerKey`).
-     * Throws loudly if the node isn't started or exposes no signing key.
+     * Signs through the same owner signer as {@link publishStrand}, whose key must be an
+     * enrolled `OwnerKey`. Throws loudly if the node isn't started or has no owner signer wired.
      *
      * @param token - Invitation token (the `FormationInvite` primary key); use the
      *   `token` of the {@link OpenInvitation} from {@link createOpenInvitation}.
      * @param sAppId - The sApp a redeemed strand will use.
      * @param options - Optional `expiresAtMs` (epoch ms), `totalUses`, `validationUrl`,
      *   `strandId` (bind a closed/pre-existing host strand for provision-then-record).
+     * @param sign - The `sign` of an owner approval the caller already holds; omitted, this
+     *   asks for its own.
      */
     publishFormationInvite(token: string, sAppId: string, options?: {
         expiresAtMs?: number;
         totalUses?: number;
         validationUrl?: string;
         strandId?: string;
-    }): Promise<void>;
+    }, sign?: OwnerSign): Promise<void>;
+    /**
+     * Register an invitation this node just published with the strand solicitation service. A
+     * host may publish one whose token was minted elsewhere; registering it locally opens the
+     * connection gate's formation exemption immediately rather than waiting for the durable row
+     * to become readable. A token {@link createOpenInvitation} minted here is already registered,
+     * and this records the same expiry again.
+     */
+    private registerPublishedInvitation;
     /**
      * Enroll an approver public key allowed to sign off on `ValidationUrl` redemptions.
      *
@@ -2613,10 +2951,10 @@ export declare class CadreNode implements SAppIdLookup {
      * — this is how a party says which outside approver it trusts. Without an enrollment,
      * every such invitation is unredeemable.
      *
-     * Signs with the same self-owner key as {@link publishStrand} (the ed25519 key behind
-     * this node's PeerId, which must be an enrolled `OwnerKey`). Throws loudly if the node
-     * isn't started, exposes no signing key, or the key is blank — a blank key would reach
-     * the database and fail the signature CHECK as an opaque constraint error.
+     * Signs through the same owner signer as {@link publishStrand}, whose key must be an
+     * enrolled `OwnerKey`. Throws loudly if the node isn't started, has no owner signer wired,
+     * or the key is blank — a blank key would reach the database and fail the signature CHECK
+     * as an opaque constraint error.
      *
      * Enrolling this node's OWN owner key is permitted and harmless: the domain/action tags
      * baked into each authorization digest mean an owner-key signature can never satisfy the
@@ -2650,22 +2988,22 @@ export declare class CadreNode implements SAppIdLookup {
     removeValidationKey(key: string): Promise<void>;
     /**
      * The approver keys currently enrolled, sorted. Read-only, so unlike
-     * {@link enrollValidationKey} / {@link removeValidationKey} it needs no owner signing
-     * key — only a started node.
+     * {@link enrollValidationKey} / {@link removeValidationKey} it needs no owner signer —
+     * only a started node.
      */
     listValidationKeys(): Promise<string[]>;
     /**
-     * Resolve the owner keypair every owner-signed control write needs — {@link publishStrand},
-     * {@link unpublishStrand}, {@link publishFormationInvite}, {@link enrollValidationKey},
-     * {@link removeValidationKey}
-     * — failing loudly in one two-part shape (not started / no signing key, naming owner
-     * genesis as the fix). Narrows `controlDatabase` for the caller: a non-null return means
+     * The owner signer every owner-signed strand write needs — {@link publishStrand},
+     * {@link unpublishStrand}, {@link ensureStrandPartyKey}, {@link publishFormationInvite},
+     * {@link enrollValidationKey}, {@link removeValidationKey} — failing loudly in one two-part
+     * shape (not started / no signer wired, naming the wiring call as the fix). Enrollment is the
+     * schema's to judge. Narrows `controlDatabase` for the caller: a return means
      * `this.controlDatabase` is non-null too.
      *
      * @param action - Infinitive phrase naming the attempted write, e.g. `'enroll a
      *   validation key'`; interpolated into both messages.
      */
-    private requireOwnerSigningKey;
+    private requireOwnerSigner;
     /**
      * Shared strand launch path for both the explicit (`addStrand`) and the
      * control-discovered (`handleStrandAdded`) entry points. Resolves the cohort
@@ -2673,10 +3011,10 @@ export declare class CadreNode implements SAppIdLookup {
      * before emitting `strand:started`.
      *
      * Founder-ness: an explicit `founder` argument wins (the formation/responder flows pass
-     * one deliberately — their consent-seated rows carry a null `FounderOwnerKey`); when
+     * one deliberately — their consent-seated rows carry a null `FounderPeerId`); when
      * unset it is DERIVED from the row, so the control-discovered path
      * (`handleStrandAdded`) and a restart's re-attach found this machine's own strands
-     * without the caller having to know. The derivation is pure key comparison — no I/O.
+     * without the caller having to know. The derivation is a pure peer-id comparison — no I/O.
      *
      * Idempotent when the strand manager already tracks `strand.Id` — the watcher
      * rediscovers a row this node already started and calls this again via
@@ -2686,7 +3024,7 @@ export declare class CadreNode implements SAppIdLookup {
      * fan-out, so a rediscovery costs nothing beyond the map lookup plus the (pure)
      * founder derivation. NOT a silent no-op any more when the launch resolves as a
      * FOUNDER: the tracked instance may have been launched first as a joiner (an app
-     * attach, or this node's own watcher poll winning the `resolveCohortSeed` window
+     * attach, or this node's own watcher run winning the `resolveCohortSeed` window
      * below), which used to drop the founder request and leave the strand headerless —
      * now the tracked instance is founded in place
      * ({@link StrandInstanceManager.foundExistingStrand}), waking it first if quiesced
@@ -2698,9 +3036,9 @@ export declare class CadreNode implements SAppIdLookup {
      *
      * An absent `sAppConfig` launches a storage replica ({@link CadreNodeConfig.hostUnclaimedStrands}),
      * which is ALWAYS a joiner whatever the row says: the founder bootstrap writes the sApp
-     * into `Strand.Header`, and a replica has none. So a self-founded row whose watcher poll
+     * into `Strand.Header`, and a replica has none. So a self-founded row whose watcher run
      * wins the race against its app's `addStrand` after a restart comes up as a replica — and
-     * so does a `foundStrand` whose publish a watcher poll saw before its attach. A claim
+     * so does a `foundStrand` whose publish a watcher run saw before its attach. A claim
      * that finds a tracked replica upgrades it in place, over the same node and store
      * ({@link StrandInstanceManager.attachSApp}), BEFORE any founding: the founder bootstrap
      * needs the sApp the attach supplies.
@@ -2745,10 +3083,11 @@ export declare class CadreNode implements SAppIdLookup {
      * receiver records an admission grant BEFORE `libp2p.start()` (re-)dials the
      * relay reservation — the gate denial there is fatal, not degraded. A
      * party-member relay answers the RPC (its control node admits us as a
-     * member); a dedicated ops/ relay does not speak the protocol and the
-     * per-peer failure comes back `unreachable` — harmless, it has no membership gate and
-     * needs no grant. The relay's direct addr rides along as the dial fallback
-     * for a relay we are not yet connected to.
+     * member); a dedicated ops/ relay does not speak the protocol, comes back
+     * `unsupported`, and is left out of later passes
+     * ({@link relaysRefusingStrandAddr}) — it has no membership gate and needs no
+     * grant. The relay's direct addr rides along as the dial fallback for a relay
+     * we are not yet connected to.
      */
     private resolveCohortSeed;
     /**
@@ -2811,20 +3150,25 @@ export declare class CadreNode implements SAppIdLookup {
      * `libp2p.start()`. Kept because it costs one spread and this is the one place
      * that would silently stop announcing if that rejection is ever relaxed.
      *
+     * Less the relays remembered as refusing the strand-addr protocol
+     * ({@link relaysRefusingStrandAddr}): both callers are announcement passes, and
+     * those relays hold no grant.
+     *
      * NOTE: a relay the STRAND node discovers on its own (autorelay — in neither
      * source) gets no announcement, and a membership-gated one will deny it; fine
      * now, every realistic topology feeds one of the two sources.
      */
     private circuitRelayTargets;
     /**
-     * Record the announce timestamps {@link refreshDelegateGrants} throttles on,
-     * for every relay a delegate-carrying announce pass dialed.
+     * Record what a delegate-carrying announce pass learned about the relays it
+     * dialed: the announce timestamps {@link refreshDelegateGrants} throttles on,
+     * and from `outcomes` which relays refuse the strand-addr protocol
+     * ({@link relaysRefusingStrandAddr}). Every announce site records through here.
      *
-     * Recorded OPTIMISTICALLY at announce time, whatever `collectStrandAddrs`
-     * reports per peer: a dedicated `ops/` relay never speaks the strand-addr
-     * protocol, so recording only on success would re-announce to it on every
-     * reconcile tick, one wasted protocol negotiation each. A failed INITIAL announce
-     * costs the strand supervisor its first attempt only (the relay denies the
+     * Timestamps are recorded OPTIMISTICALLY, whatever `collectStrandAddrs` reports
+     * per peer: recording only on success would re-announce to an unreachable relay
+     * on every reconcile pass, one dial timeout each. A failed INITIAL announce costs
+     * the strand supervisor its first attempt only (the relay denies the
      * reservation; every re-drive re-announces first through
      * {@link announceDelegateToRelay}); a failed REFRESH retries within
      * `DELEGATE_GRANT_TTL_MS / 2` (15 min), still inside the 30 min TTL.
@@ -2860,11 +3204,12 @@ export declare class CadreNode implements SAppIdLookup {
      * The throttle map is updated afterwards, so the periodic pass does not announce
      * again right away.
      *
-     * Against a dedicated ops relay (no strand-addr RPC) the request fails per-peer
-     * and `collectStrandAddrs` reports it `unreachable`: one wasted protocol negotiation per
-     * re-drive attempt, bounded by the supervisor's backoff. Never throws on that
-     * path; a relay addr that names no peer id is logged and skipped (the hook's
-     * caller runs the drive regardless).
+     * Unlike the other announce passes, this asks a relay remembered in
+     * {@link relaysRefusingStrandAddr} too, and its reply clears the entry — see
+     * there for why. Against a dedicated ops relay (no strand-addr RPC) that costs
+     * one refused protocol negotiation (`unsupported`) per re-drive attempt, bounded
+     * by the supervisor's backoff. Never throws on that path; a relay addr that names
+     * no peer id is logged and skipped (the hook's caller runs the drive regardless).
      *
      * NOTE: against a relay that is DOWN this hook costs up to two strand-addr
      * timeouts (dial by peer id, then by addr; 28.5 s each at the default declared link round trip)
@@ -2896,9 +3241,11 @@ export declare class CadreNode implements SAppIdLookup {
      *
      * Due times are per (sibling, strand) and set from each sibling's own outcome, so
      * a sibling that connects late — a phone joining after the party's always-on
-     * machines — is asked on the next tick, and one that could not answer or refused
-     * (its view of the membership may not include us yet) is retried within
-     * {@link STRAND_PEER_ADDR_RETRY_MS} rather than {@link STRAND_PEER_ADDR_REFRESH_MS}.
+     * machines — is asked on the pass its connection starts, and one that could not
+     * answer or refused (its view of the membership may not include us yet) is retried
+     * within {@link STRAND_PEER_ADDR_RETRY_MS} rather than
+     * {@link STRAND_PEER_ADDR_REFRESH_MS}; the pass that stamped the retry arms a wake
+     * for it ({@link armReconcileWake}).
      *
      * Distinct from {@link refreshDelegateGrants}, deliberately: that pass covers
      * RELAYS on a `DELEGATE_GRANT_TTL_MS / 2` throttle to keep circuit-relay
@@ -2918,15 +3265,17 @@ export declare class CadreNode implements SAppIdLookup {
      *
      * `connectedSiblingTargets`' membership read is unbounded, and with zero
      * connections its answer is empty whatever the table holds, so decide it from the
-     * connection list instead of paying for the read once a tick.
+     * connection list instead of paying for the read once a pass.
      *
-     * NOTE: otherwise the read runs on EVERY tick with a running strand, not only when
+     * NOTE: otherwise the read runs on EVERY pass with a running strand, not only when
      * some (sibling, strand) is due: pruning a departed sibling needs the current
      * target set, and whether anyone is due cannot be told without it (a connected
-     * non-member never gets a due time to compare). One more `CadrePeer` read per 15 s
-     * tick, on top of the two `runReconcileControlCohort` already makes; if those reads
-     * get costly, share one row-set across the pass (see the NOTE there) rather than
-     * skipping ticks here.
+     * non-member never gets a due time to compare). One more `CadrePeer` read per
+     * pass, on top of the two `runReconcileControlCohort` already makes, all served
+     * from the membership rows view: an in-memory scan while the view is current,
+     * storage only after the table changed or the view's maximum age passed. Sharing
+     * one row set across the pass would save no storage read and was declined (see
+     * the NOTE there).
      *
      * NOTE: one strand-addr RPC per (running strand × due sibling) — each a tiny
      * request/response on an already-open control connection. If a node ever runs
@@ -2971,8 +3320,8 @@ export declare class CadreNode implements SAppIdLookup {
      *
      * NOTE: every pass serialises the whole FRET table (`exportTable()`), verifies one
      * signature per record and makes one `peerStore.merge` per peer, per running strand
-     * per 15 s tick. Fine at strand table sizes, and an unchanged address set writes
-     * nothing in libp2p's persistent peer store. If many strands or large tables make it
+     * per pass — every change-driven pass and the 2-minute backstop. Fine at strand table
+     * sizes, and an unchanged address set writes nothing in libp2p's persistent peer store. If many strands or large tables make it
      * show up, read only the entries whose address stamp is near the one-hour mark.
      *
      * @returns the ids of the peers the table holds a usable record for.
@@ -3129,8 +3478,8 @@ export declare class CadreNode implements SAppIdLookup {
      * The stop + emit are skipped when the strand manager holds no instance for `strandId` —
      * e.g. a party owner that published a strand's row but never ran it locally, or an
      * explicit {@link stopStrand} for an id this node never started. `hibernationManager`
-     * untrack and the `sAppConfigs` / {@link strandLaunchRefusals} / {@link discoveredStrands}
-     * deletes stay unconditional (all no-ops when there is nothing to remove), so a launch
+     * untrack and the `sAppConfigs` / {@link strandLaunchRefusals} / {@link discoveredStrands} /
+     * {@link formedPartyKeys} deletes stay unconditional (all no-ops when there is nothing to remove), so a launch
      * that failed before an instance was ever tracked still gets its stray entries cleared.
      *
      * Dropping the {@link discoveredStrands} entry here covers both callers, and both
@@ -3321,18 +3670,26 @@ export declare class CadreNode implements SAppIdLookup {
      */
     getControlDatabase(): ControlDatabase | null;
     /**
-     * Open control-network connections right now. A lower-bound proxy for replication
-     * reach: 0 connections ⇒ a control write commits local-only. The private
-     * `committedAlone` write-while-alone seam is defined in terms of this.
-     *
-     * It approximates the precise signal (the block's cluster size), and a caller that
-     * samples it AFTER a write samples a slightly wider window than `committedAlone`
-     * does inside the write itself. It exists so an embedder can warn an owner before a
-     * control write that this machine currently sees none of its siblings, and report
-     * after one that the write may not have travelled — a warning shown unconditionally
-     * is a warning people learn to ignore.
+     * Open control-network connections right now, of every kind: siblings, relays, bootstrap
+     * nodes and peers still identifying. A report of connectivity, not of replication reach: a
+     * control write can commit local-only with connections open, and whether one would is
+     * {@link hasReachableControlSibling}.
      */
     getControlConnectionCount(): number;
+    /**
+     * Whether a control write made now reaches another machine: a connected peer has identified
+     * as serving the control database and is one this node sends control writes to (an
+     * authorized member, or a device whose admission it is writing). Optimystic counts a peer
+     * into a control block's cohort on those same terms; with none, a write commits on this node
+     * alone and is queued for re-issue once one is reachable (docs/architecture.md → "Writes made
+     * while alone").
+     *
+     * It exists so an embedder can warn an owner before a control write that this machine
+     * currently reaches none of its siblings, and report after one that the write may not have
+     * travelled; a warning shown unconditionally is a warning people learn to ignore. A caller
+     * that samples it AFTER a write samples a slightly wider window than the write did.
+     */
+    hasReachableControlSibling(): boolean;
     /**
      * Force a poll of the strand watcher (for testing)
      */
@@ -3342,10 +3699,26 @@ export declare class CadreNode implements SAppIdLookup {
      */
     getSAppConfig(strandId: string): SAppConfig | undefined;
     /**
-     * Initialize the seed bootstrap service with an owner key.
-     * Must be called before using seed-related methods that require signing.
+     * Make `signer` this node's owner signer (`owner-signer.ts`): every owner signature the node
+     * produces from now on goes through it — seeds, vouches, removals, invitations, strand and
+     * join rows, and the background re-issues. Builds the owner-capable seed bootstrap service
+     * around it, so this must come before any of those. One signer per node; a node started
+     * with `claim` is refused (its claimant owns it).
+     *
+     * Anchors the signer's key in the node-local trusted-owner store as `genesis`: wiring a key
+     * declares it an authority of this party.
      *
-     * @param ownerPrivateKey - The owner's private key (base64url encoded)
+     * @throws when the node is not started, was started with `claim`, or already holds the
+     *   seed protocol handler (a second wiring, or {@link enableSeedListener} first).
+     */
+    useOwnerSigner(signer: OwnerSigner): Promise<void>;
+    /**
+     * {@link useOwnerSigner} with a software signer over `ownerPrivateKey` (`softwareOwnerSigner`):
+     * the owner key held in this process's memory. Kept as a convenience because most tests and
+     * the embedders that hold the key themselves wire it this way; one that keeps the key
+     * elsewhere wires its own signer.
+     *
+     * @param ownerPrivateKey - The owner key's 32-byte Ed25519 seed, base64url.
      */
     initializeSeedBootstrap(ownerPrivateKey: string): Promise<void>;
     /**
@@ -3392,15 +3765,12 @@ export declare class CadreNode implements SAppIdLookup {
      * never reach here: {@link ControlDatabase.queryCadrePeers} excludes them, so a
      * revoked peer is not addressable either.
      *
-     * NOTE: answers the whole `CadrePeerRow`, past the two fields declared; the integration
+     * NOTE: answers the whole `CadrePeerRow`, past the fields declared; the integration
      * harness (`owner-cli-node.ts`, `OwnerCliMemberRow.sig`) reads `sig` off it through the admin
      * channel to tell a row another member seated from one the subject published itself. Narrow
      * this to the declared fields only together with that reader.
      */
-    listMembers(): Promise<Array<{
-        peerId: string;
-        multiaddr: string | null;
-    }>>;
+    listMembers(): Promise<CohortPeerRow[]>;
     /**
      * Probe whether a given peer is a `CadrePeer` member.
      *
@@ -3515,7 +3885,7 @@ export declare class CadreNode implements SAppIdLookup {
      * builds its snapshot against that anchor, which is also what its previous snapshot was
      * judged against. Caught here rather than failing the refresh, because the membership read
      * tolerates an unreachable `Revocation` block on an isolated node
-     * (`ControlDatabase.readRevokedStampRows`) and `queryRevocations` does not: failing the
+     * (`ControlDatabase.readRevocationRowsOrNone`) and `queryRevocations` does not: failing the
      * whole refresh on that would freeze such a node's gate snapshot.
      * NOTE: on such a node the sync is skipped at every refresh until the block is held; if an
      * isolated node ever has to derive owner additions while cut off, give `queryRevocations`
@@ -3524,11 +3894,12 @@ export declare class CadreNode implements SAppIdLookup {
      * NOTE: cost per membership refresh is one `OwnerKey` read and one `Revocation` read (the
      * tombstone list, whose `OwnerKey` stamps are handed to `queryOwnerKeyRows` so it does not
      * read the retired set again, and which the hang-up of removed peers shares through
-     * `loadTombstones`), plus the invitation chain when some owner row is
-     * invitation-admitted — shared with the membership read through `loadChain`; the memo
-     * suggestion on {@link loadInvitationChain} covers that part. Before the Revocation ledger
-     * marker is filed that one read is a cohort consult per refresh, which
-     * `control-founding-consult-budget.spec.ts` pins.
+     * `loadTombstones`), plus the owner-grant chain's two reads when some owner row is
+     * grant-seated. All are served from the control database's membership views, so they reach
+     * storage only after their table changed or the view's maximum age passed
+     * (`control-founding-consult-budget.spec.ts` pins the counts). On a party founded before
+     * genesis created every control collection, whose `Revocation` table has never been
+     * written, each `Revocation` load is a cohort consult until the first tombstone.
      *
      * @param retry - forwarded to every read; `false` on the refresh path, for the reason on
      *   {@link refreshAuthorizedControlPeers}.
@@ -3558,19 +3929,18 @@ export declare class CadreNode implements SAppIdLookup {
     /** A per-refresh {@link RevocationSource}: one `queryRevocations` read, shared by every caller in the pass. */
     private revocationSource;
     /**
-     * The usage and invitation rows {@link hasAnchoredProof} and {@link syncOwnerAnchor}
-     * resolve an invitation-admitted row through, keyed for lookup. Both reads honour `retry`
-     * for {@link listAuthorizedMembers}' reason.
-     *
-     * NOTE: once invitations are the only admission route (ticket
-     * `cadre-invitations-redeemable-by-any-member`), every cadre with a member not yet
-     * re-vouched pays these two whole-table reads and three ed25519 verifies per row on every
-     * membership refresh. Both tables are append-only and a verified chain never changes (expiry,
-     * use count and withdrawal are not re-checked), so if the gate's admission deadline ever
-     * shows this, memoise verified (row stamp → usage stamp) pairs per node and skip the reads
-     * when every admitted row is already memoised.
+     * The usage and invitation rows {@link hasAnchoredProof} resolves an invitation-admitted
+     * `CadrePeer` row through, keyed for lookup. Both reads honour `retry` for
+     * {@link listAuthorizedMembers}' reason. The rows come from the membership views, so they
+     * reach storage only after the table changed or the view's maximum age passed.
      */
     private loadInvitationChain;
+    /**
+     * The usage and grant rows {@link syncOwnerAnchor} resolves a grant-seated `OwnerKey` row
+     * through, keyed for lookup: the owner-grant twin of {@link loadInvitationChain}, read only by
+     * the anchor sync, since a grant admits no machine.
+     */
+    private loadOwnerGrantChain;
     /**
      * The owner-voucher half of {@link hasAnchoredProof}: complete voucher, `VouchOwner` in
      * the node-local anchor, signature valid over the row's (PeerId, StampId) voucher digest.
@@ -3635,15 +4005,15 @@ export declare class CadreNode implements SAppIdLookup {
     private installSeedBootstrapService;
     /**
      * The event callbacks every {@link SeedBootstrapService} this node owns is
-     * wired with — shared by the owner-capable service ({@link initializeSeedBootstrap})
+     * wired with — shared by the owner-capable service ({@link useOwnerSigner})
      * and the listener-only one ({@link enableSeedListener}) so the two cannot drift.
      *
      * A seed applied by the INBOUND protocol handler writes no `CadrePeer` row of
-     * its own (it merges the libp2p peer store and dials owners), so the automatic
+     * its own (it merges the libp2p peer store and dials the seed's preferred peers), so the automatic
      * write-driven refresh never fires for it — yet applying it can ANCHOR a new
      * owner key, which flips rows already present from unauthorized to authorized.
      * Hence the explicit refresh here; without it a peer the freshly anchored owner
-     * vouched for stays denied until the next timed cohort reconcile.
+     * vouched for stays denied until the next membership change or the backstop pass.
      */
     private seedEventCallbacks;
     /**
@@ -3662,13 +4032,14 @@ export declare class CadreNode implements SAppIdLookup {
      * NO `CadrePeer` writer needs to call this: the control database notifies it
      * after every committed member-row write (`ControlDatabase.mutateCadrePeer`,
      * wired in {@link start}), which is exactly what makes the refresh automatic
-     * rather than a caller obligation. It stays public for the changes that write
-     * NO row locally and so raise no notification:
-     *
-     * - a membership row that arrived by REPLICATION (otherwise picked up on the
-     *   next timed cohort reconcile — bounded staleness by design), and
-     * - a newly anchored trusted owner key ({@link applySeed}), which flips rows
-     *   ALREADY present from unauthorized to authorized without touching them.
+     * rather than a caller obligation. A membership row that arrived by REPLICATION
+     * refreshes it too, through the gate watch {@link start} takes on the membership
+     * tables (within its 50 ms window; a change this node's storage never hears of
+     * waits for the reconcile pass's backstop). It stays public for the one change
+     * that writes no row and raises no table event: a newly anchored trusted owner
+     * key ({@link applySeed}), which flips rows ALREADY present from unauthorized to
+     * authorized without touching them. A caller may also await it to observe a
+     * refresh that began after its own change.
      *
      * Coalescing: marks the snapshot stale and resolves once a refresh that began
      * after this call has completed, so a caller that awaits it always observes
@@ -3681,13 +4052,10 @@ export declare class CadreNode implements SAppIdLookup {
      * connected peer it newly covers — the strand-side counterpart to
      * {@link refreshMembershipGate}.
      *
-     * Unlike that one, NOTHING calls this automatically: strand membership is
-     * written through the strand's own `Database` handle
-     * (`strand-membership-writer.ts`), which raises no notification this runtime
-     * can hook, and a revocation that arrives by REPLICATION raises none either.
-     * The gate therefore polls (default 30 s). An app that has just called
-     * `revokeMember` or `leaveStrand` should follow the write with this call so
-     * the cut is immediate rather than up to one poll interval late.
+     * The gate already refreshes on its own when the strand's `Member` or
+     * `MemberPeer` table changes: at once for a `revokeMember` or `leaveStrand`
+     * written on this machine, and when a replicated removal reaches this node's
+     * storage. Call this to await the cut — it resolves after the sweep.
      *
      * Quiet no-op for a strand that is not running, is quiesced, is open, or has
      * the gate disabled. Never rejects; resolves once the sweep has finished.
@@ -3717,8 +4085,8 @@ export declare class CadreNode implements SAppIdLookup {
      * CONCURRENT external write's refresh for the life of the scope: that writer's
      * promise resolves before its peer is admitted, and admission lands at scope
      * exit instead. Acceptable — scope exit is milliseconds away (bounded by the
-     * drain), versus the ~15 s reconcile interval that was the alternative before
-     * any of this existed — but it is the reason these scopes stay short and rare.
+     * drain), versus the reconcile pass that was the alternative before any of this
+     * existed — but it is the reason these scopes stay short and rare.
      */
     private deferMembershipGateRefresh;
     /**
@@ -3729,13 +4097,15 @@ export declare class CadreNode implements SAppIdLookup {
      * @param multiaddrs - Optional multiaddrs for the peer
      */
     authorizePeer(peerId: string, multiaddrs?: string[]): Promise<void>;
+    /** {@link authorizePeer}'s body, signing inside the caller's owner approval when it passes `sign` ({@link claimNode}). */
+    private vouchPeer;
     /**
      * Remove a previously-authorized peer from the cadre.
      * Signs the peer ID with the owner key and deletes the CadrePeer row.
      *
-     * Removes the `CadrePeer` row only. The call that removes a machine completely (its owner
-     * key, its push token and the invitations it could come back through, in one transaction)
-     * is {@link removeMachine}.
+     * Removes the `CadrePeer` row only. The call that removes a machine completely (its push
+     * token and the invitations it could come back through too, in one transaction) is
+     * {@link removeMachine}.
      *
      * @param peerId - The peer ID to remove
      */
@@ -3745,55 +4115,123 @@ export declare class CadreNode implements SAppIdLookup {
      * `OwnerKey.Authorized`; the row stores the vouching pair). The write notifies the
      * membership hub, so the refresh it triggers has run by the time this resolves.
      *
+     * Refused while alone ({@link ownerKeyWriteAlone}): an `OwnerKey` add has no re-issue path,
+     * so one committed with no control connection would stay on this node.
+     *
      * @param ownerPublicKeyB64 - the new owner's ed25519 public key (base64url).
+     * @param options.label - the user's name for the key ("phone", "paper backup"), bound into
+     *   the signature; trimmed, at most 64 characters, blank meaning none.
      * @returns `true` when the row was seated, `false` when the key is already a live owner.
+     * @throws OwnerKeyAddRefusedError `alone`, before any write.
+     */
+    addOwner(ownerPublicKeyB64: string, options?: {
+        label?: string;
+    }): Promise<boolean>;
+    /**
+     * Whether an `OwnerKey` add made now ({@link addOwner}, or the re-add of
+     * {@link removeOwner}'s re-vouch) is refused `alone`: this node holds no control connection
+     * while the party has other members. An `OwnerKey` row has no update to re-touch, so nothing
+     * re-issues it on cohort growth, and a row written now would fork this node's history. A
+     * party with no other members cannot fork, so a solo founder adding an owner key is not
+     * refused.
+     *
+     * Waits out an in-flight membership refresh first: until `start`'s first one lands the
+     * member snapshot is empty, which would read as a party with no other members.
+     */
+    private ownerKeyWriteAlone;
+    /**
+     * Every live owner key with its label, who vouched it, whether this node's owner signer
+     * holds it and whether this node's trusted-owner anchor trusts it ({@link CadreOwnerKey}),
+     * for an app's owner-key screen.
+     */
+    listOwnerKeys(): Promise<CadreOwnerKey[]>;
+    /**
+     * What {@link removeOwner} would do for `ownerPublicKeyB64`, read without writing, for an
+     * app's confirmation step ({@link OwnerKeyRemovalPlan}): whether this node may remove it,
+     * which rows the key vouched (so the app can offer to keep them by re-vouching), and how this
+     * node's own rows depend on it (`planOwnerKeyRemoval` in `owner-keys.ts`).
+     */
+    planOwnerKeyRemoval(ownerPublicKeyB64: string): Promise<OwnerKeyRemovalPlan>;
+    /**
+     * Remove an owner key, signed by this node's owner key (which must be a different owner): the
+     * `OwnerKey` row and its `Revocation` tombstone commit together, and the tombstone rides the
+     * committed-delete seam ({@link noteGuardedDelete}), so one committed while alone is re-issued
+     * on cohort growth like every other removal. The machines the key was used on stay members;
+     * removing one is {@link removeMachine}. The owner grants the key issued stop being redeemable
+     * (the plan's `grants` names the live ones) and are not withdrawn: a tombstone over a grant
+     * nobody can redeem would add nothing.
+     *
+     * Steps: re-plan ({@link planOwnerKeyRemoval}) and throw {@link OwnerKeyRemovalRefusedError}
+     * on a refusal; check `options.revouch` against the plan's dependents and throw before any
+     * write when it names anything else; refuse `alone` ({@link ownerKeyWriteAlone}) when an
+     * `OwnerKey` row is to be re-vouched, since that re-add has no re-issue path; **re-vouch
+     * first**, under this node's key, the dependents the caller chose to keep and this node's own
+     * row when the key vouched it (`ControlDatabase.revouchOwnerKey`, `reauthorizePeer`), so they
+     * are never untrusted in between, and stop before the removal if one fails (re-vouches
+     * already made stay, harmlessly); then the removal. The re-vouches and the removal are one owner approval. The
+     * write notifies the membership hub, so the refresh it triggers has run by the time this
+     * resolves.
+     *
+     * @param ownerPublicKeyB64 - the owner's ed25519 public key (base64url).
+     * @returns what was written ({@link OwnerKeyRemovalResult}).
+     * @throws {OwnerKeyRemovalRefusedError} `'not-an-owner'`, `'unknown'`, `'last-owner'`,
+     *   `'self'` or `'alone'`, before any write.
      */
-    addOwner(ownerPublicKeyB64: string): Promise<boolean>;
+    removeOwner(ownerPublicKeyB64: string, options?: RemoveOwnerOptions): Promise<OwnerKeyRemovalResult>;
+    /** {@link planOwnerKeyRemoval} over `controlDatabase`, for a caller that already holds it. */
+    private planOwnerKeyRemovalWith;
     /**
-     * Remove an owner key, signed by this node's owner key (which must be a different owner):
-     * the delete and its `Revocation` tombstone commit together. Refused by name when the key
-     * is this node's own or the only live owner. The write notifies the membership hub; the
-     * tombstone rides the committed-delete seam ({@link noteGuardedDelete}), so one committed
-     * while alone is re-issued on cohort growth like every other removal.
+     * The re-vouch step of {@link removeOwner}: every chosen dependent row is rebound to this
+     * node's key BEFORE the removal, so no reader ever judges it against an owner that is gone.
+     * Owners through `ControlDatabase.revouchOwnerKey` (a delete-and-re-add under a fresh stamp,
+     * the only rebinding `OwnerKey.NoUpdate` allows); peers through the owner re-touch
+     * (`reauthorizePeer`), which rewrites `VouchOwner`/`VouchSig` and clears `VouchUsage`.
      *
-     * Removes the `OwnerKey` row only. The call that removes a machine completely, its owner key
-     * included, is {@link removeMachine}.
+     * The peer re-touch is the re-vouch mode of `reauthorizePeer`, which leaves the row's
+     * `UpdatedAt` untouched and writes whether or not the machine has self-published. The owner
+     * branch of `CadrePeer.AuthorizedUpdate` does not require a bump, and bumping a self-published
+     * row would leave its `Sig` unverifiable, so unresolvable and unlisted as self-published, until
+     * the machine's next heartbeat (the NOTE on that constraint); the write-while-alone drain's
+     * re-broadcast mode bumps because it re-issues an otherwise unchanged row, whereas here the
+     * voucher itself changes. A dependent whose row vanished since the plan is reported absent and
+     * skipped.
      *
-     * @param ownerPublicKeyB64 - the owner's ed25519 public key (base64url).
-     * @returns `true` when the row was removed, `false` when the key is not a live owner here.
+     * A failure rethrows and stops the call before the removal; re-vouches already made stay
+     * (the row is only re-signed by a current owner) and the caller retries. An owner re-vouch
+     * is refused alone before this runs; one whose last connection drops while it runs is logged,
+     * as {@link addOwner}'s add is.
+     *
+     * NOTE: a peer re-touch committed alone is not queued, and the drain skips self-published
+     * rows anyway, so the other machines may get the removal's tombstone without the new voucher
+     * (`tickets/backlog/bug-owner-key-removal-revouch-made-alone-is-not-reissued`).
      */
-    removeOwner(ownerPublicKeyB64: string): Promise<boolean>;
+    private revouchDependents;
     /**
      * The cadre's machines as an app lists them ({@link CadreMachine}): one entry per live
-     * `CadrePeer` row, judged by this node's membership predicate, plus one per live `OwnerKey`
-     * whose key names a machine with no row (`describeMachines` in `machine-removal.ts`).
+     * `CadrePeer` row, judged by this node's membership predicate (`describeMachines` in
+     * `machine-removal.ts`). Owner keys are not machines; {@link listOwnerKeys} lists them.
      * Unlocked reads with the default retry.
      */
     listMachines(): Promise<CadreMachine[]>;
     /**
      * What {@link removeMachine} would do for `peerId`, read without writing, for an app's
-     * confirmation step ({@link MachineRemovalPlan}): whether this node may remove it, whether its
-     * owner key goes with it, which rows that key vouched (so the app can offer to keep them by
-     * re-vouching), which invitations it could come back through, and whether this node's own
-     * rows depend on it (`planMachineRemoval` in `machine-removal.ts`).
+     * confirmation step ({@link MachineRemovalPlan}): whether this node may remove it and which
+     * invitations it could come back through (`planMachineRemoval` in `machine-removal.ts`).
      */
     planMachineRemoval(peerId: string): Promise<MachineRemovalPlan>;
     /**
      * Remove a machine from the cadre completely, signed by this node's owner key: its
-     * `CadrePeer` row, its `OwnerKey` row when its key is an owner, its `DeviceToken` row (a
-     * removed phone must not be push-woken) and a withdrawal of every live invitation it could
-     * redeem to come back, in ONE transaction ({@link ControlDatabase.removeMachine}), with a
-     * `Revocation` tombstone per row so the removal holds on every machine
-     * ("Deletes made while alone" in docs/architecture.md).
-     *
-     * Steps: re-plan ({@link planMachineRemoval}) and throw {@link MachineRemovalRefusedError} on a
-     * refusal; check `options.revouch` against the plan's dependents and throw before any write
-     * when it names anything else; **re-vouch first**, under this node's key, the dependents the
-     * caller chose to keep (`ControlDatabase.revouchOwnerKey`, `reauthorizePeer`), so they are
-     * never untrusted in between, and stop before the removal if one fails (re-vouches already
-     * made stay, harmlessly); then the removal transaction. Afterwards this node forgets the
-     * machine as a dial target, and the refresh the write notifies hangs up its control
-     * connection ({@link hangUpRevokedControlPeers}) before this resolves.
+     * `CadrePeer` row, its `DeviceToken` row (a removed phone must not be push-woken) and a
+     * withdrawal of every live invitation it could redeem to come back, in ONE transaction
+     * ({@link ControlDatabase.removeMachine}), with a `Revocation` tombstone per row so the
+     * removal holds on every machine ("Deletes made while alone" in docs/architecture.md), under
+     * one owner approval. Afterwards this node forgets the machine as a dial target, and the
+     * refresh the write notifies hangs up its control connection ({@link hangUpRevokedControlPeers})
+     * before this resolves.
+     *
+     * Owner keys stay: they are the person's, not the machine's. A lost phone that held one can
+     * still sign, a fresh machine invitation it could redeem included, so removing that key
+     * ({@link removeOwner}) is the step that locks it out.
      *
      * Not undone by this call: the machine keeps every row and strand block it already synced
      * and the party's strand member keys (`tickets/blocked/decide-removed-machine-strand-access`).
@@ -3801,37 +4239,14 @@ export declare class CadreNode implements SAppIdLookup {
      *
      * @returns what was written ({@link MachineRemovalResult}); all false when no live row names
      *   the machine here (already removed elsewhere).
-     * @throws {MachineRemovalRefusedError} `'not-an-owner'`, `'self'` or `'last-owner'`.
+     * @throws {MachineRemovalRefusedError} `'not-an-owner'` or `'self'`, before any write.
      */
-    removeMachine(peerId: string, options?: RemoveMachineOptions): Promise<MachineRemovalResult>;
+    removeMachine(peerId: string): Promise<MachineRemovalResult>;
     /**
-     * The reads behind {@link listMachines}: the live `CadrePeer` and `OwnerKey` rows and the
-     * machines projected from them, with this node's membership predicate as the `trusted` test.
+     * The read behind {@link listMachines}: the live `CadrePeer` rows projected as machines, with
+     * this node's membership predicate as the `trusted` test.
      */
     private readMachines;
-    /** {@link planMachineRemoval} with the rows it was judged from, which {@link removeMachine} re-vouches dependents by. */
-    private planMachineRemovalWith;
-    /**
-     * The re-vouch step of {@link removeMachine}: every chosen dependent row is rebound to this
-     * node's key BEFORE the removal, so no reader ever judges it against an owner that is gone.
-     * Owners through `ControlDatabase.revouchOwnerKey` (a delete-and-re-add under a fresh stamp,
-     * the only rebinding `OwnerKey.NoUpdate` allows); peers through the owner re-touch
-     * (`reauthorizePeer`), which rewrites `VouchOwner`/`VouchSig` and clears `VouchUsage`.
-     *
-     * The peer re-touch keeps the row's `UpdatedAt` where it is. The owner branch of
-     * `CadrePeer.AuthorizedUpdate` does not require a bump, and bumping a self-published row
-     * would leave its `Sig` unverifiable, so unresolvable and unlisted as self-published, until
-     * the machine's next heartbeat (the NOTE on that constraint); the write-while-alone drain
-     * bumps because it re-issues an otherwise unchanged row, whereas here the voucher itself
-     * changes. A row never self-published carries no stamp to keep and gets the clock.
-     *
-     * A failure rethrows and stops the call before the removal; re-vouches already made stay
-     * (the row is only re-signed by a current owner) and the caller retries. An owner re-vouch
-     * committed alone is not re-issued on growth (the add half has no re-issue path,
-     * `tickets/backlog/debt-owner-key-add-while-alone-has-no-reissue`), so it is logged as
-     * {@link addOwner} logs it; the peer re-touches are re-issued by the existing drain.
-     */
-    private revouchDependents;
     /**
      * Create a seed from the current control network state.
      * The seed contains peer information and is signed by an owner.
@@ -3852,9 +4267,9 @@ export declare class CadreNode implements SAppIdLookup {
         trustPolicy?: SeedTrustPolicy;
     }): Promise<ApplySeedResult>;
     /**
-     * Post-process an {@link applySeed} outcome: retain the seed's owner peers as
+     * Post-process an {@link applySeed} outcome: retain the seed's preferred peers as
      * cold-start bootstrap targets, and surface a seed that was accepted but whose
-     * every owner dial failed — the node is now seeded yet unconnected, and the
+     * every dial failed — the node is now seeded yet unconnected, and the
      * cold-start reconcile branch is what gets it out of that state.
      */
     private noteAppliedSeed;
@@ -3895,12 +4310,13 @@ export declare class CadreNode implements SAppIdLookup {
      * that connection from the addresses it was handed, on this launch or a later
      * one.
      *
-     * Nothing is dialed here: the drone has not received the seed yet. After
-     * delivering it, call {@link reconcileControlCohort} to dial straight away;
-     * otherwise the next timed reconcile pass does. A pass already in flight is
-     * joined rather than restarted, and one that listed siblings before this add
-     * does not dial the drone, so a caller waiting for the connection should allow
-     * for one more timed pass.
+     * Nothing is dialed here: the drone has not received the seed yet. Its `CadrePeer`
+     * insert is a membership change, so a reconcile pass dials the retained addresses
+     * within about 50 ms of this call returning, whether or not the caller runs one, and
+     * a failed dial is retried on the redial ladder (15 s, 30 s, 60 s, then every
+     * backstop). A caller that wants to await the connection calls
+     * {@link reconcileControlCohort} itself, twice in a row: a call made while a pass is
+     * in flight joins it, and that pass may have listed siblings before this add.
      */
     addDrone(options: AddDroneOptions): Promise<DroneInitResult>;
     /**
@@ -3910,9 +4326,10 @@ export declare class CadreNode implements SAppIdLookup {
      * vouch the node into this cadre and keep its addresses as a dial target. The owner
      * side of the claim-secret entry in the Seed Delivery Protocol (`docs/architecture.md`).
      *
-     * Requires the seed service with an owner key ({@link initializeSeedBootstrap}), as
-     * {@link addDrone} does. The order is the REVERSE of `addDrone`'s: seed first, row
-     * second. A refused claim or a failed delivery therefore leaves no `CadrePeer` row and
+     * Requires the seed service with an owner key ({@link useOwnerSigner}), as
+     * {@link addDrone} does, and like it is one owner approval (the seed and the vouch). The
+     * order is the REVERSE of `addDrone`'s: seed first, row second. A refused claim or a
+     * failed delivery therefore leaves no `CadrePeer` row and
      * no retained dial target behind on this node — a phone that typed the wrong secret,
      * or scanned a node someone else already owns, has nothing to clean up.
      *
@@ -3932,12 +4349,19 @@ export declare class CadreNode implements SAppIdLookup {
      * by the node (its anchored branch), the row insert is a no-op on an existing row
      * (`ControlDatabase.insertCadrePeer`), and the dial target is replaced, not duplicated.
      *
-     * The first dial is kicked (not awaited) so it happens now rather than on the next
-     * timed reconcile pass; a caller that wants to wait for the connection awaits
-     * {@link reconcileControlCohort} itself, with `addDrone`'s caveat that a pass already
-     * in flight is joined rather than restarted. The claimed node dials this one back too,
-     * from the seed's owner list, when this node has a listen or relay address; a phone
-     * with neither is reached by its own reconcile pass alone.
+     * Once it has acknowledged, the node restarts into this party (cadre-cli's
+     * `restartIntoClaimedParty`), closing the connection the claim used. The dial target puts
+     * the address that connection was dialed on first, so every later dial tries the address
+     * that just worked before the others (a QR code lists public addresses before LAN ones, and
+     * a home router often drops a connection to its own public address from inside). A
+     * reconcile pass is kicked (not awaited) now, and the vouch's `CadrePeer` insert starts
+     * another about 50 ms later; for the first {@link CONTROL_COHORT_REDIAL_MS} after the
+     * acknowledgement this node also retries the node every second while it restarts
+     * ({@link redialClaimedNode}). A caller that wants to wait for the connection awaits
+     * {@link reconcileControlCohort} itself, with `addDrone`'s caveat that a pass already in
+     * flight is joined rather than restarted. The claimed node dials this one back too, as the
+     * seed's minter, when this node has a listen or relay address; a phone with neither is
+     * reached by its own dials alone.
      *
      * @throws {ClaimRefusedError} when the node was reached and refused the claim.
      * @throws {PeerUnreachableError} when the node was never reached.
@@ -3947,6 +4371,33 @@ export declare class CadreNode implements SAppIdLookup {
         multiaddrs: string[];
         secret: string;
     }): Promise<void>;
+    /**
+     * `addrs` with the address this node's open connection to `peerId` was dialed on moved to
+     * the front, when it is one of them; `addrs` unchanged otherwise. Compared without a
+     * trailing `/p2p/<peerId>`, which a QR code's address may or may not carry ({@link addrKey}).
+     */
+    private connectedAddrFirst;
+    /**
+     * Retry a node this node has just claimed ({@link claimNode}) once every
+     * {@link CLAIM_RESTART_REDIAL_STEP_MS} for {@link CONTROL_COHORT_REDIAL_MS} after it accepted.
+     * The node restarts into this party right after it acknowledges, and while it does, a
+     * reconcile pass's dial either fails or opens a connection the restarting node closes at
+     * once. The first failure puts the pass's next redial 15 s out ({@link armReconcileWake}),
+     * and an owner that cannot be dialed has no other way back to the node.
+     *
+     * Each step dials once from the retained dial target, unless a connection to the node is
+     * open: the one the claim used until the restart closes it, or one to the restarted node
+     * that has not identified yet. A dial that connects does not end the loop, because the
+     * restarting node may still close it. The loop ends once the node has identified as serving
+     * this party's control database ({@link identifiedControlPeers}, which the placeholder node
+     * it ran before the claim never joins), at the window's end, when this node stops, or when
+     * the target is forgotten ({@link removePeer}). Steps run one after another, so a dial
+     * finishes on its own budget first. The redial streak is left alone: the ladder carries on
+     * after the window. One loop per peer: a repeated claim while one runs starts none.
+     */
+    private redialClaimedNode;
+    /** One step of {@link redialClaimedNode}; false ends the loop. */
+    private redialClaimedNodeStep;
     /**
      * Add a phone to the cadre with relay support.
      * Use when both nodes are NAT'd (phone-to-phone).
@@ -3969,13 +4420,13 @@ export declare class CadreNode implements SAppIdLookup {
     /**
      * Mint an owner-signed cadre invitation that a device can redeem at ANY member machine of
      * this party, the owner offline included ({@link redeemCadreInvitation}). Requires the
-     * owner key ({@link initializeSeedBootstrap}).
+     * owner key ({@link useOwnerSigner}).
      *
      * The invitation is an ed25519 keypair: the public half is the `CadreInvite` row's key,
-     * the private half rides in the returned bundle as the proof of possession. Whoever holds
-     * the bundle can redeem it, so an UNTARGETED, OWNER-GRANTING invitation — a bearer
-     * credential for admin rights — defaults to a 15-minute lifetime; every other kind to 24
-     * hours. One use unless `uses` says otherwise. The bundle carries the signed row (so a
+     * the private half rides in the returned bundle as the proof of possession. It admits a
+     * machine and grants nothing else (ownership is {@link createOwnerGrant}'s), so it defaults
+     * to a 24-hour lifetime ({@link CADRE_INVITATION_DEFAULT_TTL_MS}) and one use unless `uses`
+     * says otherwise. The bundle carries the signed row (so a
      * member that has not received it by replication seats it from the bundle), this node's
      * anchored owner keys — every current owner this node has verified, the out-of-band ones
      * and those derived along verifiable chains ({@link syncOwnerAnchor}) — (the device pins
@@ -4000,7 +4451,15 @@ export declare class CadreNode implements SAppIdLookup {
      * @throws when no owner key is wired, the anchor is empty, `uses` is not a positive
      *   integer, or neither this machine nor any other member has an address.
      */
-    createCadreInvitation(options: CreateCadreInvitationOptions): Promise<CreateCadreInvitationResult>;
+    createCadreInvitation(options?: CreateCadreInvitationOptions): Promise<CreateCadreInvitationResult>;
+    /**
+     * What the two credentials an owner mints share ({@link createCadreInvitation},
+     * {@link createOwnerGrant}), checked in this order: the owner-capable service; the anchor's
+     * keys the holder pins (an empty anchor is refused rather than falling back to the table, since
+     * a reply could not be checked against it); the use count; and the member addresses with their
+     * reach, refused when neither this machine nor any other member has one.
+     */
+    private issuedBundleParts;
     /**
      * Every cadre invitation this node holds — minted here or replicated in — with its
      * standing ({@link CadreInviteStatus}: live, withdrawn, redemptions recorded).
@@ -4026,11 +4485,13 @@ export declare class CadreNode implements SAppIdLookup {
      * Steps: refuse an invitation for another party; pin its `ownerKeys` into the node-local
      * anchor (`'invite'` provenance — the pin sticks even if the redemption then fails, as it
      * does for a seed invite, so a later attempt or seed from the same owner is anchored);
-     * sign the request; dial the listed members in order (`redeemAtMembers`); on
-     * acceptance verify the reply against the pinned keys, merge its dial hints into the peer
-     * store, retain the answering member as a cold-start dial target, refresh the membership
-     * gate and start a cohort reconcile pass. This node then syncs the control database over
-     * the connection it already holds, the same unified behaviour as after a seed.
+     * sign the request, which carries this node's own signed address record; dial the listed
+     * members in order (`redeemAtMembers`); on acceptance verify the reply against the pinned
+     * keys, merge its dial hints into the peer store, retain the answering member as a
+     * cold-start dial target and start a cohort reconcile pass. This node then syncs the control
+     * database over the connection it already holds, the same unified behaviour as after a seed.
+     * The member writes the record on this node's `CadrePeer` row when its signature verifies, so
+     * the row resolves to this node's addresses from its admission.
      *
      * A device that is already a member (a restart with the invitation still configured) is
      * answered as accepted by the member's idempotent redemption, with no second usage row.
@@ -4044,11 +4505,9 @@ export declare class CadreNode implements SAppIdLookup {
      * pass whose reply was lost answers the next as already a member. `options.onProgress`
      * reports each pass and pause.
      *
-     * When the invitation grants ownership, the member seats this node's key as an `OwnerKey`
-     * row by consent. The caller still has to wire that key for signing afterwards, with
-     * {@link wireOwnKeyIfOwner}; never `ensureOwnerKey`, the row is already there. Other
-     * machines derive this node's key into their anchors from the row's stored proof on their
-     * next membership refresh ({@link syncOwnerAnchor}).
+     * The invitation admits this node as a machine and nothing else: ownership is an owner
+     * grant ({@link redeemOwnerGrant}, {@link joinWithOwnerGrant}). A key of this node's that is
+     * already an owner here is wired afterwards with {@link wireOwnKeyIfOwner}(signer).
      *
      * Limit: the reply check ({@link verifyRedeemReply}) does not authenticate the member. A
      * forged bundle, or a legitimate one whose addresses were swapped, dials a machine that
@@ -4064,24 +4523,175 @@ export declare class CadreNode implements SAppIdLookup {
      */
     redeemCadreInvitation(invitation: CadreInvitation, options?: RedeemCadreInvitationOptions): Promise<RedeemCadreInvitationResult>;
     /**
-     * If this node's identity key is a live `OwnerKey` here, wire it for signing
-     * ({@link initializeSeedBootstrap}) and return true; otherwise change nothing and return
-     * false. For a machine that joined someone else's cadre by invitation: after an
-     * owner-granting redemption, and on every later start. A redemption seats the request's
-     * `peerKey`, the key behind this node's peer id, so the identity key is the one to look for.
+     * If `signer`'s key is a live `OwnerKey` here, wire it ({@link useOwnerSigner}) and return
+     * true; otherwise change nothing and return false. For a machine that joined someone else's
+     * cadre: after an owner grant seated its key, and on every later start.
+     *
+     * Without `signer` the candidate is the signer already wired, so the call answers whether
+     * that key is still a live owner; with nothing wired it is false. The node's identity key is
+     * never a candidate: a machine's network identity is never an owner key.
      *
      * Unlike `ensureOwnerKey` it never inserts an `OwnerKey` row, so a machine that joined a
      * cadre can never genesis-insert itself into it, and a non-owner never anchors its own key.
      * An owner whose key is already wired (an earlier call) is answered true with nothing redone.
      *
      * NOTE: a node running the listener-only seed service ({@link enableSeedListener}) cannot be
-     * wired this way: libp2p takes one seed handler, and {@link initializeSeedBootstrap} would
-     * register a second. Nothing that joins by invitation enables the listener today; if one
-     * does, replace the listener here rather than beside it.
-     *
-     * @throws when the node is not started.
-     */
-    wireOwnKeyIfOwner(): Promise<boolean>;
+     * wired this way: libp2p takes one seed handler, and {@link useOwnerSigner} would register a
+     * second. Nothing that joins by invitation enables the listener today; if one does, replace
+     * the listener here rather than beside it.
+     *
+     * @throws when the node is not started, or when `signer` names a different key from the
+     *   signer already wired (one signer per node).
+     */
+    wireOwnKeyIfOwner(signer?: OwnerSigner): Promise<boolean>;
+    /**
+     * Mint an owner-signed owner grant: whoever holds the returned bundle can seat an owner key of
+     * their own through ANY member machine of this party ({@link redeemOwnerGrant}), or join the
+     * party as a machine and an owner at once ({@link joinWithOwnerGrant}), the owner that minted
+     * it offline or not. Requires the owner key ({@link useOwnerSigner}); one owner approval.
+     *
+     * The grant is an ed25519 keypair: the public half is the `OwnerGrant` row's key, the private
+     * half rides in the bundle as the proof of possession. It admits no machine and names no peer
+     * id. Whoever holds the bundle can become an owner, so it defaults to a 15-minute lifetime
+     * ({@link OWNER_GRANT_DEFAULT_TTL_MS}) and one use; `expiresInMs: null` mints a BACKUP grant
+     * with no expiry, which must be asked for explicitly and kept as carefully as an owner key.
+     * The label is the issuer's choice and goes on every key the grant seats ({@link addOwner}'s
+     * rule: trimmed, at most 64 characters, blank meaning none). The bundle carries the signed
+     * row, this node's anchored owner keys and at most six member addresses, chosen as
+     * {@link createCadreInvitation} chooses them and for the same reasons; `reach` says where a
+     * holder could redeem it once this machine is gone. A backup's addresses are those at mint
+     * time, so it can go stale if every member's address changes.
+     *
+     * @throws when no owner key is wired, the anchor is empty, `uses` is not a positive integer,
+     *   the label is over 64 characters, or neither this machine nor any other member has an address.
+     */
+    createOwnerGrant(options?: CreateOwnerGrantOptions): Promise<CreateOwnerGrantResult>;
+    /**
+     * Every owner grant this node holds — minted here or replicated in — with its standing
+     * ({@link OwnerGrantStatus}: live, withdrawn, redemptions recorded).
+     */
+    listOwnerGrants(): Promise<OwnerGrantStatus[]>;
+    /**
+     * Withdraw an owner grant: an owner-signed `Revocation` tombstone over its row, which stays as
+     * the proof behind every key it seated; those keys stay owners (removing one is
+     * {@link removeOwner}). No further redemption succeeds anywhere the tombstone reaches, and a
+     * member holding it refuses the bundle's copy of the row. A withdrawal committed while alone is
+     * re-issued on cohort growth like any other tombstone.
+     *
+     * @returns `true` when this call filed the tombstone, `false` when the row is not held here or
+     *   was already withdrawn.
+     */
+    withdrawOwnerGrant(key: string): Promise<boolean>;
+    /**
+     * Become an owner of this node's party with an owner grant: seat `signer`'s key as an
+     * `OwnerKey` row by consent, with no owner online. `signer` holds the key to seat; its one
+     * `approve` names the party and says the key becomes an owner of it, and signs the `'consent'`
+     * digest. The grant's `'redeem'` signature is made with the bundle's private key in memory.
+     * A bundle for another party is refused before anything is pinned, dialed or written.
+     *
+     * Two paths, chosen by whether this node is a live member of the party ({@link isLiveMemberSelf})
+     * or an enrolled owner of it ({@link isOwner}):
+     *
+     * - **Local**, on a member machine: the grant row is seated from the bundle when absent (its
+     *   own transaction) and the redemption written in this node's own control database
+     *   (`ControlDatabase.redeemOwnerGrant`), replicating like any other write. Refused `alone`
+     *   under {@link addOwner}'s rule, before the approval: an `OwnerKey` row has no re-issue
+     *   path, so one committed with no control connection while the party has other members would
+     *   stay here; connect, then try again. A grant that is not live here (withdrawn, expired,
+     *   spent, its issuer no longer an owner) is refused before the approval too, unless the key
+     *   is already an owner. The bundle's `ownerKeys` are NOT pinned: this node judges the issuer
+     *   by its own `OwnerKey` table, and its anchor must not be widened by pasted text.
+     * - **Protocol**, otherwise (a device with no machine in the cadre; a node started in the
+     *   party on an empty store): the bundle's `ownerKeys` are pinned into the node-local anchor
+     *   (`'invite'` provenance, the pin a credential the owner handed out carries, as
+     *   {@link redeemCadreInvitation} pins), then the members the bundle names are dialed over
+     *   `/sereus/owner-grant/1.0.0` (`redeemOwnerGrantInPasses`), one signed request for every
+     *   address and every pass as {@link redeemCadreInvitation} dials, so a retry after a lost
+     *   reply is answered `alreadyOwner`. The member that accepts pushes its control store here
+     *   and writes the row with this node counted in its write cohort, so a member alone with
+     *   this node still commits. `options` are the invitation's (`waitForMember`, `signal`,
+     *   `onProgress`).
+     *
+     * Neither path wires the signer: call {@link wireOwnKeyIfOwner}(signer) afterwards — at once
+     * on the local path, and on the protocol path once the row has synced here. A key that is
+     * already a live owner is answered `alreadyOwner` with no use spent, on both paths. To join
+     * the party as a machine too, use {@link joinWithOwnerGrant}.
+     *
+     * @throws a plain `Error` for a node not started or a bundle naming another party;
+     *   {@link OwnerKeyAddRefusedError} `alone` on the local path, `OwnerGrantIssuerUnknownError`
+     *   when the issuer is not an owner here, `OwnerGrantRejectedError` `grant-spent` for a
+     *   grant no longer live here, and `OwnerGrantRejectedError` `conflict` (retryable) when the
+     *   cadre holds the grant row and this node has not synced it yet; on the protocol path
+     *   `OwnerGrantRejectedError` on a final refusal, `OwnerGrantReplyInvalidError` on an
+     *   acceptance that fails the reply check,
+     *   `OwnerGrantUnreachableError` when every address was tried (one pass only), and the
+     *   signal's reason on an abort.
+     */
+    redeemOwnerGrant(bundle: OwnerGrantBundle, signer: OwnerSigner, options?: RedeemOwnerGrantOptions): Promise<RedeemOwnerGrantResult>;
+    /**
+     * {@link redeemOwnerGrant}'s local path: the alone refusal, the seat (only when this node holds
+     * no grant row), the liveness refusal, then one approval around the consent signature and the
+     * write. Every refusal comes before the approval, so a prompting signer never asks for a
+     * redemption this node would refuse. The held row is read once and carried into the liveness
+     * check and the write, as the member handler carries it (`MemberRedemptionHandler`).
+     */
+    private redeemOwnerGrantLocally;
+    /**
+     * {@link redeemOwnerGrant}'s protocol path, given the signed request: dial the bundle's members
+     * in passes, then refresh the membership gate, since the rows the member pushed and wrote are
+     * judged against the pins and the anchor derives this node's key from them once its row is here.
+     */
+    private redeemOwnerGrantAtMembers;
+    /** The signed request for `bundle` seating `signer`'s key, under an open approval's `sign`; the nonce is minted here, by the holder. */
+    private signOwnerGrantRequest;
+    /**
+     * Join this node's party as a machine AND an owner with one owner grant, for a node started in
+     * the grant's party that is not a member: a fresh install recovering with a backup grant, an
+     * app joining as an owner. Needs a started node with a stable identity, as
+     * {@link redeemCadreInvitation} does, and a bundle for this party.
+     *
+     * Steps, the two signatures made under ONE approval of `signer` before any dial, so a
+     * prompting signer asks once and its prompt does not span the network:
+     *
+     * 1. {@link redeemOwnerGrant}'s protocol path: the member that accepts seats `signer`'s key.
+     * 2. A **self-invitation**: a `CadreInvite` row targeted at this node's peer id, one use, a
+     *    short expiry ({@link SELF_INVITATION_TTL_MS}), signed by `signer`
+     *    (`ControlDatabase.signCadreInvite`; never inserted here, since this store holds no
+     *    `OwnerKey` row for the issuer yet). Its bundle carries the grant's owner keys plus the
+     *    new key (the device's reply check wants the row's issuer among the pins) and the grant's
+     *    members with the member that accepted the grant first, since that member holds the new
+     *    key as a live owner and seats the row from the bundle; one the row has not reached yet
+     *    answers `issuer-unknown`, which is retryable.
+     * 3. {@link redeemCadreInvitation} with it: the member admits this node.
+     * 4. {@link wireOwnKeyIfOwner}(signer) once the `OwnerKey` row has synced here, asked every
+     *    {@link OWNER_ROW_SYNC_RECHECK_MS} up to {@link OWNER_ROW_SYNC_TIMEOUT_MS}; the result's
+     *    `ownerWired` says whether it did in time, and a later call wires it otherwise.
+     *
+     * @throws as {@link redeemOwnerGrant} (protocol path) and {@link redeemCadreInvitation} throw,
+     *   and a plain `Error` for an ephemeral identity.
+     */
+    joinWithOwnerGrant(bundle: OwnerGrantBundle, signer: OwnerSigner, options?: RedeemOwnerGrantOptions): Promise<JoinWithOwnerGrantResult>;
+    /**
+     * {@link wireOwnKeyIfOwner}(signer) once `signer`'s `OwnerKey` row has reached this node, asked
+     * again every {@link OWNER_ROW_SYNC_RECHECK_MS} until it has, the node stops, or
+     * {@link OWNER_ROW_SYNC_TIMEOUT_MS} passes: false then, and a later call wires it. Usually
+     * immediate: the member pushed its whole store, the row included, before the admission write.
+     */
+    private wireOwnKeyOnceSynced;
+    /**
+     * The started node's handles for a grant call, the bundle's party checked first: a grant for
+     * another party is refused before any pin, dial or write.
+     */
+    private requireStartedForGrant;
+    /**
+     * Is this node a live member of its party: its own `CadrePeer` row is held here and passes the
+     * membership predicate ({@link hasAnchoredProof}, judged as {@link listAuthorizedMembers}
+     * judges every other row; that listing leaves this node out)? What decides
+     * {@link redeemOwnerGrant}'s path. A machine's own row is written by its enrollment (or its
+     * first self-record, for an owner's machine), so a node on an empty store, or one holding only
+     * a store a member pushed it, is not one.
+     */
+    private isLiveMemberSelf;
     /**
      * Replace this node's strand solicitation service — the formation responder every node
      * installs at {@link start}, and the initiator side of {@link formStrand}. Optional: call it
@@ -4191,8 +4801,8 @@ export declare class CadreNode implements SAppIdLookup {
      */
     dismissPendingJoin(id: string): Promise<boolean>;
     private requirePendingJoins;
-    /** This machine's owner key and signer for an owner-signed control write, or a throw carrying `refusal`. */
-    private requireOwnerSigner;
+    /** This machine's enrolled owner signer ({@link enrolledOwnerSigner}), or a throw carrying `refusal`. */
+    private requireEnrolledOwnerSigner;
     /**
      * Write a join request, or adopt the party's existing request for the same invitation: a
      * pending one as it is, a finished one rewritten as `requested` (the user asked again).
@@ -4270,6 +4880,10 @@ export declare class CadreNode implements SAppIdLookup {
      * implements): mint a single-use `Strand.Invite` against the LIVE host strand so a
      * validated joiner can seat its own `Strand.Member` row.
      *
+     * `host` is the strand as the formation session resolved it from its `Strand` row, read
+     * once there; this method reads no `Strand` row of its own. A row removed in between is
+     * refused when the consent row is written (the `StrandExists` CHECK).
+     *
      * - Open host strand → `null` (no members, nothing to invite into).
      * - Closed host strand whose founder launch was refused as pre-split
      *   ({@link strandLaunchRefusals}) → rethrow the recorded `PreSplitStrandIdentityError`;