@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/strand-membership-writer.js

@@ -219,8 +219,8 @@ async function execStrandTransaction(db, statements, options) {
  */
 function revocationStatement(tableName, stampId, retiree) {
     return {
-        sql: `insert into Strand.Revocation (TableName, StampId)
-       with context MemberKey = :revocationSignerKey, Signature = :revocationSignature
+        sql: `insert into Strand.Revocation (TableName, StampId)
+       with context MemberKey = :revocationSignerKey, Signature = :revocationSignature
        values (:revocationTable, :revocationStampId);`,
         params: {
             revocationSignerKey: retiree.publicKeyB64,
@@ -276,12 +276,6 @@ async function strandTableCount(db, table) {
  * `Revocation` schema comment already flags, tracked by `debt-strand-tombstone-reap`
  * — this wants a stored "founding closed" marker rather than a scan per call.
  *
- * NOTE: on a strand that has never revoked anyone, `Strand.Revocation` has never been
- * written, so this node does not hold its block, and the storage layer consults the
- * block's cohort on every read of a block it does not hold — this scan and every
- * `NotRevoked` insert check pay that per call. Not measured, and cheap while strand
- * membership writes are rare; if they become frequent, file a singleton marker row in
- * the strand schema the way the control schema does (`ControlDatabase.openRevocationLedger`).
  */
 async function strandHasManagerRevocation(db) {
     for await (const row of db.eval('select TableName from Strand.Revocation')) {
@@ -292,7 +286,37 @@ async function strandHasManagerRevocation(db) {
     return false;
 }
 /**
- * Insert the singleton `Strand.Header` if absent.
+ * Commit an empty collection for every table the strand declares except `writtenTables`, so a
+ * read of a table nobody has written is answered from local storage instead of asking the
+ * block's cohort to prove the collection absent, and still answers with the other members
+ * offline. Peer-join backfill hands these collections to every joiner. The founding
+ * transaction's own tables are left out because its inserts create their collections anyway.
+ *
+ * Only while the Header is absent, and before the founding transaction writes it: a machine
+ * cannot write to a strand before it holds the Header (`strand-first-sync-gate.ts`), so no other
+ * machine can yet have created any of these collections and this cannot fork one. On a founder
+ * restart the Header is present and this does not run; running it there could commit an empty
+ * second history beside a table a joiner wrote while the founder was away. A crash between this
+ * and the founding commit repeats it on the next run, which commits only the collections still
+ * missing.
+ *
+ * NOTE: one `sync()` per collection, in sequence. Measured 2026-10-17 on a lone node over the
+ * network transactor (`connectToStrand`, then the step alone, 3 runs each): a nine-table app
+ * schema (20 collections with the strand's own) took 32–82 ms in memory and 465–486 ms on
+ * `FileRawStorage`; the reference chat schema (13 collections) 19–30 ms and 298–350 ms. About
+ * 23 ms per collection on disk, once per strand, before `foundStrand` returns. Leaving out the
+ * founding transaction's tables brings the chat schema to 6 collections on a closed strand whose
+ * founder binds its peer, and 12 on an open one. If founding latency starts to matter (slower
+ * phone storage, much larger schemas), commit them as one batch through a coordinator, the way
+ * the transaction bridge's `commitBatchLegacy` does.
+ */
+async function createDeclaredCollections(params, writtenTables) {
+    const t0 = performance.now();
+    const committed = await params.createEmptyCollections(writtenTables);
+    log('Committed %d empty collections for strand %s in %dms', committed, params.strandId, Math.round(performance.now() - t0));
+}
+/**
+ * The singleton `Strand.Header` insert.
  *
  * Every `Header` column is NOT NULL (Quereus defaults unqualified columns to NOT
  * NULL; the table declares no `null` columns), so all eight are supplied non-null.
@@ -300,88 +324,127 @@ async function strandHasManagerRevocation(db) {
  * rather than inserting null. `Header` carries only `InsertOnly` + a singleton PK,
  * so the insert needs no `with context`.
  */
-async function insertHeaderIfAbsent(db, params) {
-    if (await strandTableCount(db, 'Header') > 0) {
-        log('Header already present for strand %s; skipping', params.strandId);
-        return;
-    }
-    await db.exec(`insert into Strand.Header
-       (Id, Type, sAppId, sAppVersion, sAppSchema, sAppSignature, Engine, EngineVersion)
-       values (?, ?, ?, ?, ?, ?, ?, ?)`, [
-        params.strandId,
-        params.type,
-        params.sApp.id,
-        params.sApp.version,
-        params.sApp.schema,
-        params.sApp.signature ?? '',
-        STRAND_ENGINE,
-        STRAND_ENGINE_VERSION,
-    ]);
-    log('Inserted Header for strand %s (type %s)', params.strandId, params.type);
+function headerRow(params) {
+    return {
+        table: 'Strand.Header',
+        statements: {
+            sql: `insert into Strand.Header
+         (Id, Type, sAppId, sAppVersion, sAppSchema, sAppSignature, Engine, EngineVersion)
+         values (:headerId, :headerType, :headerSAppId, :headerSAppVersion, :headerSAppSchema,
+           :headerSAppSignature, :headerEngine, :headerEngineVersion);`,
+            params: {
+                headerId: params.strandId,
+                headerType: params.type,
+                headerSAppId: params.sApp.id,
+                headerSAppVersion: params.sApp.version,
+                headerSAppSchema: params.sApp.schema,
+                headerSAppSignature: params.sApp.signature ?? '',
+                headerEngine: STRAND_ENGINE,
+                headerEngineVersion: STRAND_ENGINE_VERSION,
+            },
+        },
+    };
 }
 /**
- * Insert the founding `Strand.Member` if no member exists yet.
+ * The founding `Strand.Member` insert.
  *
  * The empty PRE-transaction member set (`count(1) from committed.Member = 0`)
  * satisfies the bootstrap branch of `Member.Authorized`, so no signature is
  * needed — the context fields are explicit nulls. The branch also caps the
  * POST-image at one member, so it waives authorization for exactly this single
  * seat, never for a batch. The row still mints a fresh StampId — the column is
- * NOT NULL on every path; bootstrap only waives the SIGNATURE. Guarding on the
- * count makes this idempotent: a re-run (the founder re-`addStrand`/
- * `resumeStrand`) finds the member present and skips.
+ * NOT NULL on every path; bootstrap only waives the SIGNATURE.
  */
-async function insertFounderMemberIfAbsent(db, memberKey, strandId) {
-    if (await strandTableCount(db, 'Member') > 0) {
-        log('Member already present for strand %s; skipping founder Member', strandId);
-        return;
-    }
-    await db.exec(`insert into Strand.Member (Key, StampId)
-       with context ManagerKey = null, ManagerSignature = null, MemberSignature = null
-       values (?, ?)`, [memberKey, generateStrandStampId()]);
-    log('Inserted founding Member for strand %s', strandId);
+function founderMemberRow(memberKey) {
+    return {
+        table: 'Strand.Member',
+        statements: {
+            sql: `insert into Strand.Member (Key, StampId)
+         with context ManagerKey = null, ManagerSignature = null, MemberSignature = null
+         values (:founderMemberKey, :founderMemberStampId);`,
+            params: { founderMemberKey: memberKey, founderMemberStampId: generateStrandStampId() },
+        },
+    };
+}
+/**
+ * The founding `Strand.Manager` insert, at `Generation = 0` — the root of the manager
+ * lineage; the bootstrap branch of `Manager.Authorized` requires exactly that value, and
+ * every later manager is seated at a strictly greater generation (see {@link addManager}).
+ * No signature is needed (a fresh StampId is still minted — the column is NOT NULL).
+ *
+ * The bootstrap branch, `Manager.MemberExists` and `Manager.OnlyClosed` all have subqueries,
+ * so they defer to commit and read the live `Member` and `Header` tables: a founding
+ * `Manager` whose `Member` and `Header` are neither committed already nor in its own
+ * transaction is rejected.
+ */
+function founderManagerRow(memberKey) {
+    return {
+        table: 'Strand.Manager',
+        statements: {
+            sql: `insert into Strand.Manager (MemberKey, Generation, StampId)
+         with context ManagerKey = null, Signature = null
+         values (:founderManagerKey, 0, :founderManagerStampId);`,
+            params: { founderManagerKey: memberKey, founderManagerStampId: generateStrandStampId() },
+        },
+    };
 }
 /**
- * Insert the founding `Strand.Manager` if no manager exists yet.
- *
- * The empty-table state satisfies the bootstrap branch of `Manager.Authorized`, so
- * no signature is needed (a fresh StampId is still minted — the column is NOT
- * NULL). The founder is seated at `Generation = 0` — the root of
- * the manager lineage; the bootstrap branch requires exactly that value, and every
- * later manager is seated at a strictly greater generation (see {@link addManager}).
- * Idempotent via the same count guard.
- *
- * ORDERING IS LOAD-BEARING, not merely convenient. The bootstrap branch is gated to
- * the founding state and now reads `exists (select 1 from Member M where M.Key =
- * new.MemberKey)` alongside `count(Manager) <= 1` and `count(Member) <= 1`, so the
- * founding `Member` row MUST already exist when this commits — a Manager-first
- * seeding path is rejected. It must also run AFTER the Header insert:
- * `Manager.OnlyClosed` is a deferred (subquery) check evaluated at commit. The
- * sequential auto-commit Header→Member→Manager order in
- * {@link bootstrapFounderMembership} satisfies both.
- *
- * SEALED strands are skipped, not re-founded: a strand whose sole manager has
- * {@link sealStrand}ed also has zero `Manager` rows, but its founding branch is
- * closed for good (the schema's bootstrap branch requires no `Manager`-table
- * `Revocation` row to exist). Attempting the founding insert here would be
- * schema-rejected and turn every founder restart of a sealed strand into a
- * loud failure — so this mirrors the schema's own gate and returns quietly.
- * A crash BETWEEN the founding Member and Manager inserts leaves no Revocation
- * rows at all, so that restart still completes the founding.
+ * Whether the founding `Strand.Manager` still has to be seated: no manager exists and the
+ * strand is not SEALED. A strand whose sole manager has {@link sealStrand}ed also has zero
+ * `Manager` rows, but its founding branch is closed for good (the schema's bootstrap branch
+ * requires no `Manager`-table `Revocation` row to exist). Seating it there would be
+ * schema-rejected and turn every founder restart of a sealed strand into a loud failure — so
+ * this mirrors the schema's own gate. A founding that never committed its Manager leaves no
+ * Revocation rows at all, so that restart still completes the founding.
  */
-async function insertFounderManagerIfAbsent(db, memberKey, strandId) {
+async function founderManagerMissing(db, strandId) {
     if (await strandTableCount(db, 'Manager') > 0) {
         log('Manager already present for strand %s; skipping founder Manager', strandId);
-        return;
+        return false;
     }
     if (await strandHasManagerRevocation(db)) {
         log('Strand %s has retired a manager seat (sealed); skipping founder Manager', strandId);
-        return;
+        return false;
     }
-    await db.exec(`insert into Strand.Manager (MemberKey, Generation, StampId)
-       with context ManagerKey = null, Signature = null
-       values (?, 0, ?)`, [memberKey, generateStrandStampId()]);
-    log('Inserted founding Manager for strand %s', strandId);
+    return true;
+}
+/**
+ * This machine's `Strand.MemberPeer` binding, unless there is no peer id to bind or the
+ * binding is already present (a re-run after a torn founding commit).
+ */
+async function founderBindingIfAbsent(db, founderKeyPair, peerId) {
+    if (peerId === undefined) {
+        return [];
+    }
+    if (await memberPeerStampId(db, founderKeyPair.publicKeyB64, peerId) !== undefined) {
+        log('MemberPeer (%s, %s) already present; skipping founder binding', founderKeyPair.publicKeyB64, peerId);
+        return [];
+    }
+    return [{ table: 'Strand.MemberPeer', statements: memberPeerInsertStatement(founderKeyPair, peerId) }];
+}
+/**
+ * The closed strand's founding rows that are still missing, in Member → Manager → MemberPeer
+ * order. Each is behind an insert-if-absent guard, so a re-run after a crash or a torn commit
+ * writes only what is missing.
+ *
+ * The binding joins only a run that seats the founding `Member`. With a member row already
+ * present the founder may since have left the strand or been removed, and
+ * `MemberPeer.MemberExists` would then refuse the whole founding transaction; the membership
+ * reconciler, which binds only once it sees this party's member row, writes it instead.
+ */
+async function missingClosedFoundingRows(db, founderKeyPair, params) {
+    const memberKey = founderKeyPair.publicKeyB64;
+    const seatsMember = await strandTableCount(db, 'Member') === 0;
+    if (!seatsMember) {
+        log('Member already present for strand %s; skipping founder Member', params.strandId);
+    }
+    const seatsManager = await founderManagerMissing(db, params.strandId);
+    const binding = seatsMember ? await founderBindingIfAbsent(db, founderKeyPair, params.founderPeerId) : [];
+    return [
+        ...(seatsMember ? [founderMemberRow(memberKey)] : []),
+        ...(seatsManager ? [founderManagerRow(memberKey)] : []),
+        ...binding,
+    ];
 }
 /**
  * Refuse a closed strand whose membership still holds the key derived from the shared
@@ -407,17 +470,23 @@ export async function assertNotPreSplitStrand(db, strandId, sharedMemberPublicKe
  *
  * Runs once at bring-up on the strand's FOUNDER (the party that provisioned and
  * published the strand). A joiner never calls this — it receives these rows via
- * Optimystic sync. Every write is insert-if-absent (guarded by a row count) so a
- * restart / founder re-`addStrand` is a no-op and never double-inserts.
+ * Optimystic sync. It reads which founding rows are missing, then writes all of them in
+ * ONE strand transaction. Every row is insert-if-absent, so a restart / founder
+ * re-`addStrand` writes nothing, and a re-run after a failed or torn founding commit
+ * writes only what is missing.
+ *
+ * On the run that finds no `Header`, it first commits an empty collection for every
+ * table the `Strand` and `App` schemas declare except the ones the founding transaction
+ * writes, so no read of a declared table ever needs another member to prove it empty
+ * ({@link createDeclaredCollections}).
  *
  * Behavior by strand type:
- * - **Open (`'o'`)**: insert `Header` only. `Member`/`Manager`/`Invite` are
- *   `OnlyClosed` and would trip that constraint — they are skipped entirely.
- * - **Closed (`'c'`)**: insert `Header(Type='c')`, then the founding `Member`
- *   (`Key = founderKeyPair.publicKeyB64`), then the founding `Manager`
- *   (`MemberKey = founderKeyPair.publicKeyB64`). Insert order matters: the
- *   Header must commit before the deferred `OnlyClosed` checks on Member/Manager
- *   evaluate at commit.
+ * - **Open (`'o'`)**: `Header` only. `Member`/`Manager`/`Invite` are `OnlyClosed` and
+ *   would trip that constraint — they are skipped entirely.
+ * - **Closed (`'c'`)**: `Header(Type='c')`, the founding `Member` and `Manager` (both
+ *   `founderKeyPair.publicKeyB64`) and, when `founderPeerId` is supplied, this machine's
+ *   `MemberPeer` binding. Every check that reads another founding row has a subquery, so
+ *   it defers to commit and sees the whole transaction.
  *
  * A closed strand with no `founderKeyPair` throws: a closed strand with no founding
  * Manager could never admit anyone, so failing loudly here (which propagates out
@@ -426,11 +495,14 @@ export async function assertNotPreSplitStrand(db, strandId, sharedMemberPublicKe
  * A closed strand whose membership holds `sharedMemberPublicKey` throws
  * {@link PreSplitStrandIdentityError} before writing anything: the insert-if-absent
  * guards would otherwise skip over its pre-split founding rows and leave the shared
- * key seated.
+ * key seated. Checked only when the `Header` is already present: a strand founded before
+ * the key split committed its Header first, alone, so a strand with no Header has none
+ * of those rows.
  *
  * @param db - The strand's Quereus database (schema already applied).
- * @param params - Strand id/type, the sApp config for the Header, and (closed only)
- *   the derived founder keypair and the shared-derived public key to refuse.
+ * @param params - Strand id/type, the sApp config for the Header, the composition's
+ *   empty-collection step, and (closed only) the derived founder keypair, the
+ *   shared-derived public key to refuse and this machine's peer id to bind.
  * @throws If `type === 'c'` and no `founderKeyPair` is supplied.
  * @throws {PreSplitStrandIdentityError} If `type === 'c'` and a `Strand.Member` or
  *   `Strand.Manager` row is `sharedMemberPublicKey`.
@@ -445,19 +517,35 @@ export async function bootstrapFounderMembership(db, params) {
         throw new Error(`Cannot bootstrap closed strand ${strandId}: no founder key pair derived from this party's ` +
             'StrandPartyKey. A closed strand needs a founding Member + Manager or it can never admit members.');
     }
-    if (type === 'c' && sharedMemberPublicKey !== undefined) {
+    const headerPresent = await strandTableCount(db, 'Header') > 0;
+    if (headerPresent && type === 'c' && sharedMemberPublicKey !== undefined) {
         await assertNotPreSplitStrand(db, strandId, sharedMemberPublicKey);
     }
-    // Header is written for every strand; Member/Manager are closed-only.
-    await insertHeaderIfAbsent(db, params);
-    if (type === 'o') {
-        // Open strand: Member/Manager/Invite are OnlyClosed — nothing else to write.
+    const rows = [
+        ...(headerPresent ? [] : [headerRow(params)]),
+        ...(type === 'c' ? await missingClosedFoundingRows(db, founderKeyPair, params) : []),
+    ];
+    if (!headerPresent) {
+        await createDeclaredCollections(params, rows.map((row) => row.table));
+    }
+    if (rows.length === 0) {
+        log('Strand %s is already founded; nothing to write', strandId);
         return;
     }
-    const memberKey = founderKeyPair.publicKeyB64;
-    await insertFounderMemberIfAbsent(db, memberKey, strandId);
-    await insertFounderManagerIfAbsent(db, memberKey, strandId);
-    log('Founder bootstrap complete for closed strand %s', strandId);
+    // NOTE: a torn founding commit (some of the batch's collections saved, others not) can leave
+    // the Header committed beside a founding table with no collection, which committing every
+    // table's empty collection first used to rule out. A sibling machine of this party could then
+    // create that collection itself (its reconciler binding its own peer into MemberPeer). The
+    // re-run's guards, and this machine's reconciler, read each table before writing it, and a
+    // networked read asks the cohort, so the healing write appends to the sibling's collection
+    // unless the sibling is unreachable at that moment. A torn founding that saves this
+    // machine's MemberPeer without its Member also leaves an orphaned binding, which every
+    // machine's revocation enforcer (this one's and any joiner's) reads as a removed founder
+    // until a later run of this bootstrap seats the Member. If torn founding commits are ever
+    // observed, commit the founding tables a sibling writes (MemberPeer) as empty collections
+    // before this batch again.
+    await execStrandTransaction(db, combineStatements(...rows.map((row) => row.statements)));
+    log('Founder bootstrap for strand %s wrote %s', strandId, rows.map((row) => row.table).join(', '));
 }
 /**
  * Issue a single-use invitation to join a closed strand.
@@ -489,8 +577,8 @@ export async function issueInvite(db, params) {
     const payload = `${inviteKey}|${expirationSegment}`;
     const managerSignature = signStrandPayload(payload, managerKeyPair.privateKeyB64);
     const inviteSignature = signStrandPayload(payload, invitePrivateKey);
-    await db.exec(`insert into Strand.Invite (Key, Expiration)
-       with context ManagerKey = ?, ManagerSignature = ?, InviteSignature = ?
+    await db.exec(`insert into Strand.Invite (Key, Expiration)
+       with context ManagerKey = ?, ManagerSignature = ?, InviteSignature = ?
        values (?, ?)`, [managerKeyPair.publicKeyB64, managerSignature, inviteSignature, inviteKey, expirationColumn]);
     log('Issued invite %s (expires=%s)', inviteKey, expirationColumn ?? 'never');
     return { inviteKey, invitePrivateKey };
@@ -547,8 +635,8 @@ export async function consumeInvite(db, params, options) {
     // Member first — admitted by the deferred invite branch (the matching ConsumedInvite
     // after it), so no manager signature is supplied.
     const member = {
-        sql: `insert into Strand.Member (Key, StampId)
-       with context ManagerKey = null, ManagerSignature = null, MemberSignature = null
+        sql: `insert into Strand.Member (Key, StampId)
+       with context ManagerKey = null, ManagerSignature = null, MemberSignature = null
        values (:memberKey, :memberStampId);`,
         params: { memberKey, memberStampId: generateStrandStampId() },
     };
@@ -569,8 +657,8 @@ export async function consumeInvite(db, params, options) {
 async function consumedInviteStatement(db, params) {
     const { inviteKey, invitePrivateKey, memberKey, nowMs } = params;
     return {
-        sql: `insert into Strand.ConsumedInvite (InviteKey, MemberKey)
-       with context InviteSignature = :consumedSignature, Now = :consumedNow
+        sql: `insert into Strand.ConsumedInvite (InviteKey, MemberKey)
+       with context InviteSignature = :consumedSignature, Now = :consumedNow
        values (:consumedInviteKey, :consumedMemberKey);`,
         params: {
             consumedSignature: signStrandPayload(`${inviteKey}|${memberKey}`, invitePrivateKey),
@@ -676,8 +764,8 @@ export async function cancelInvite(db, params) {
         return;
     }
     const signature = signStrandApproval(['Strand.CancelledInvite', 'cancel', inviteKey], managerKeyPair.privateKeyB64);
-    await db.exec(`insert into Strand.CancelledInvite (InviteKey)
-       with context ManagerKey = ?, ManagerSignature = ?
+    await db.exec(`insert into Strand.CancelledInvite (InviteKey)
+       with context ManagerKey = ?, ManagerSignature = ?
        values (?)`, [managerKeyPair.publicKeyB64, signature, inviteKey]);
     log('Cancelled invite %s by manager %s', inviteKey, managerKeyPair.publicKeyB64);
 }
@@ -790,8 +878,8 @@ function memberAddByManagerStatement(params) {
     const { managerKeyPair, memberKey } = params;
     const stampId = generateStrandStampId();
     return {
-        sql: `insert into Strand.Member (Key, StampId)
-       with context ManagerKey = :memberAdmitterKey, ManagerSignature = :memberAdmitterSignature, MemberSignature = null
+        sql: `insert into Strand.Member (Key, StampId)
+       with context ManagerKey = :memberAdmitterKey, ManagerSignature = :memberAdmitterSignature, MemberSignature = null
        values (:memberKey, :memberStampId);`,
         params: {
             memberAdmitterKey: managerKeyPair.publicKeyB64,
@@ -837,12 +925,11 @@ function memberAddByManagerStatement(params) {
  * (`Member.MinOneMember`, a local-count floor with the cross-node caveat its
  * schema NOTE states).
  *
- * Callers running inside a cadre runtime should follow this write with
- * `CadreNode.refreshRevocationEnforcement(strandId)`. The removed party's
- * machines are refused at the network layer by the strand's revoked-peer gate
- * (`strand-revocation-enforcer.ts`), which polls for membership changes because
- * this bare `Database` handle raises no event the runtime can hook — so without
- * that call the cut lands up to one poll interval (default 30 s) later.
+ * Inside a cadre runtime the removed party's machines are then refused at the
+ * network layer by the strand's revoked-peer gate (`strand-revocation-enforcer.ts`),
+ * which re-reads membership when this write commits on the runtime's own
+ * `Database`. A caller that wants to await the cut follows the write with
+ * `CadreNode.refreshRevocationEnforcement(strandId)`, which resolves after it.
  *
  * @param db - The closed strand's database.
  * @param params - The revoking manager keypair and the target member key.
@@ -860,8 +947,8 @@ export async function revokeMember(db, params, options) {
         return;
     }
     const removal = {
-        sql: `delete from Strand.Member
-       with context ManagerKey = :memberRemoverKey, ManagerSignature = :memberRemoverSignature, MemberSignature = null
+        sql: `delete from Strand.Member
+       with context ManagerKey = :memberRemoverKey, ManagerSignature = :memberRemoverSignature, MemberSignature = null
        where Key = :memberKey;`,
         params: {
             memberRemoverKey: managerKeyPair.publicKeyB64,
@@ -886,10 +973,10 @@ export async function revokeMember(db, params, options) {
  * The same floors as {@link revokeMember} apply: a manager must resign first
  * (`NotAManager`) and the last member cannot leave (`MinOneMember`).
  *
- * Like {@link revokeMember}, a caller inside a cadre runtime should follow this
- * with `CadreNode.refreshRevocationEnforcement(strandId)` — here it is what
- * makes the departing node notice its own departure promptly (the gate emits
- * `strand:revoked` when it finds this node's own peer id revoked).
+ * Like {@link revokeMember}, inside a cadre runtime the write wakes the strand's
+ * revoked-peer gate, which emits `strand:revoked` when it finds this node's own
+ * peer id revoked; `CadreNode.refreshRevocationEnforcement(strandId)` awaits that
+ * refresh.
  *
  * @param db - The closed strand's database.
  * @param params - The departing member's own keypair.
@@ -906,8 +993,8 @@ export async function leaveStrand(db, params, options) {
         return;
     }
     const departure = {
-        sql: `delete from Strand.Member
-       with context ManagerKey = null, ManagerSignature = null, MemberSignature = :memberSignature
+        sql: `delete from Strand.Member
+       with context ManagerKey = null, ManagerSignature = null, MemberSignature = :memberSignature
        where Key = :memberKey;`,
         params: {
             memberSignature: signStrandApproval(['Strand.Member', 'leave', memberKey, stampId], memberKeyPair.privateKeyB64),
@@ -960,10 +1047,19 @@ export async function registerMemberPeer(db, params, options) {
         log('MemberPeer (%s, %s) already present; skipping', memberKey, peerId);
         return;
     }
+    await execStrandTransaction(db, memberPeerInsertStatement(memberKeyPair, peerId), options);
+    log('Registered MemberPeer (%s, %s)', memberKey, peerId);
+}
+/**
+ * The self-signed `Strand.MemberPeer` insert binding `peerId` to the member, under a fresh
+ * stamp bound into the add-tagged digest (see {@link registerMemberPeer}).
+ */
+function memberPeerInsertStatement(memberKeyPair, peerId) {
+    const memberKey = memberKeyPair.publicKeyB64;
     const stampId = generateStrandStampId();
-    await execStrandTransaction(db, {
-        sql: `insert into Strand.MemberPeer (MemberKey, PeerId, StampId)
-       with context Signature = :peerSignature, ManagerKey = null, ManagerSignature = null
+    return {
+        sql: `insert into Strand.MemberPeer (MemberKey, PeerId, StampId)
+       with context Signature = :peerSignature, ManagerKey = null, ManagerSignature = null
        values (:peerMemberKey, :peerId, :peerStampId);`,
         params: {
             peerSignature: signStrandApproval(['Strand.MemberPeer', 'add', memberKey, peerId, stampId], memberKeyPair.privateKeyB64),
@@ -971,8 +1067,7 @@ export async function registerMemberPeer(db, params, options) {
             peerId,
             peerStampId: stampId,
         },
-    }, options);
-    log('Registered MemberPeer (%s, %s)', memberKey, peerId);
+    };
 }
 /**
  * Yield every `(PeerId, StampId)` bound to `memberKey`, re-comparing the member key
@@ -1114,8 +1209,8 @@ function ownMemberPeerRemovalStatements(params, stampId) {
     const { memberKeyPair, peerId } = params;
     const memberKey = memberKeyPair.publicKeyB64;
     const removal = {
-        sql: `delete from Strand.MemberPeer
-       with context Signature = :peerSignature, ManagerKey = null, ManagerSignature = null
+        sql: `delete from Strand.MemberPeer
+       with context Signature = :peerSignature, ManagerKey = null, ManagerSignature = null
        where MemberKey = :peerMemberKey and PeerId = :peerId;`,
         params: {
             peerSignature: signStrandApproval(['Strand.MemberPeer', 'remove', memberKey, peerId, stampId], memberKeyPair.privateKeyB64),
@@ -1139,8 +1234,8 @@ function ownMemberPeerRemovalStatements(params, stampId) {
 function memberPeerRemovalByManagerStatements(params, stampId) {
     const { managerKeyPair, memberKey, peerId } = params;
     const removal = {
-        sql: `delete from Strand.MemberPeer
-       with context Signature = null, ManagerKey = :peerManagerKey, ManagerSignature = :peerManagerSignature
+        sql: `delete from Strand.MemberPeer
+       with context Signature = null, ManagerKey = :peerManagerKey, ManagerSignature = :peerManagerSignature
        where MemberKey = :peerMemberKey and PeerId = :peerId;`,
         params: {
             peerManagerKey: managerKeyPair.publicKeyB64,
@@ -1226,8 +1321,8 @@ async function managerAddStatement(db, params) {
     const generation = authorizer == null ? 1 : authorizer.generation + 1;
     const stampId = generateStrandStampId();
     return {
-        sql: `insert into Strand.Manager (MemberKey, Generation, StampId)
-       with context ManagerKey = :managerAuthorizerKey, Signature = :managerSignature
+        sql: `insert into Strand.Manager (MemberKey, Generation, StampId)
+       with context ManagerKey = :managerAuthorizerKey, Signature = :managerSignature
        values (:managerMemberKey, :managerGeneration, :managerStampId);`,
         params: {
             managerAuthorizerKey: byManagerKeyPair.publicKeyB64,
@@ -1371,8 +1466,8 @@ export async function removeManager(db, params, options) {
  */
 function managerRemovalStatements(signer, signature, targetManagerKey, targetStampId) {
     const removal = {
-        sql: `delete from Strand.Manager
-       with context ManagerKey = :managerRemoverKey, Signature = :managerRemoverSignature
+        sql: `delete from Strand.Manager
+       with context ManagerKey = :managerRemoverKey, Signature = :managerRemoverSignature
        where MemberKey = :managerMemberKey;`,
         params: {
             managerRemoverKey: signer.publicKeyB64,