@serfab/cadre-core 1.16.0 → 1.18.0

package/src/control-database.ts

@@ -7,19 +7,27 @@ import optimysticPlugin from '@optimystic/quereus-plugin-optimystic/plugin';
 import { digest, randomBytes } from '@optimystic/quereus-plugin-crypto';
 import type { Libp2p } from '@libp2p/interface';
 import type { IRepo } from '@optimystic/db-core';
-import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow, PushPlatform, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, SeedPeer, MachineRemovalResult } from './types.js';
-import { CONTROL_SCHEMA } from './control-schema.js';
+import { createEmptyCollections } from '@serfab/quereus-plugin-sereus';
+import type { CollectionRegistrySource } from '@serfab/quereus-plugin-sereus';
+import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, DeviceTokenRecord, DeviceTokenRow, PushPlatform, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, OwnerGrantRow, OwnerGrantUsageRow, OwnerGrantRedemptionResult, OwnerGrantStatus, SeedPeer, MachineRemovalResult } from './types.js';
+import { APPLY_CONTROL_SCHEMA, CONTROL_SCHEMA_DECLARATION, CONTROL_SCHEMA_NAME, controlSchemaFileDeclaration } from './control-schema.js';
+import { refuseIncompatibleControlStore } from './control-schema-version.js';
 import { canonicalDatetime } from './canonical-datetime.js';
-import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, CONTROL_TABLES } from './control-authorization.js';
-import type { ControlTable, RevocableTable, BoundControlDomain, UnboundControlDomain, ControlAction, CadreInviteSignedFields } from './control-authorization.js';
-import { ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64 } from './ed25519-key.js';
-import { verifyCadreInviteRow } from './peer-authorization.js';
-import { retryControlWrite, SCHEMA_INIT_RETRY_POLICY } from './control-write-retry.js';
+import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, ownerGrantRowFields, CONTROL_TABLES } from './control-authorization.js';
+import type { ControlTable, RevocableTable, BoundControlDomain, UnboundControlDomain, ControlAction, CadreInviteSignedFields, OwnerGrantSignedFields } from './control-authorization.js';
+import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { verifyCadreInviteRow, verifyOwnerGrantRow } from './peer-authorization.js';
+import { OWNER_KEY_MAX_LABEL } from './owner-key-export.js';
+import { retryControlWrite, LOST_UPDATE_RETRY_POLICY, SCHEMA_INIT_RETRY_POLICY } from './control-write-retry.js';
 import type { ControlWriteRetryOptions } from './control-write-retry.js';
 import { isCohortUnreachableRead, retryControlRead } from './control-read-retry.js';
 import type { ControlReadRetryOptions } from './control-read-retry.js';
 import { chainMessages } from './control-retry.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
+import { TableWatchRegistry } from './table-change-watch.js';
+import type { TableChangeWatch, TableChangeWatchOptions } from './table-change-watch.js';
+import { MembershipView } from './membership-view.js';
+import type { FormationInviteFacts } from './formation-token.js';
 
 export type { ControlTable, RevocableTable, ControlDomain, ControlAction } from './control-authorization.js';
 
@@ -56,12 +64,11 @@ export function generateStampId(peerId: string): string {
  * present locally.
  *
  * Consent is bound to the strand's one-off `StampId` (see the consent branch of
- * `Strand.AuthorizedInsert`), so the writer must read the live row before inserting.
- * The ordinary "host strand has not converged on this responder yet" case is caught
- * earlier and reported as `missing` by `ControlFormationUsageRecorder.resolveStrand`;
- * reaching here means the row vanished between that check and the write, which is a
- * genuine race and is surfaced rather than left to fail the deferred `StrandExists`
- * CHECK at commit (which would drop the write with a far less legible error).
+ * `Strand.AuthorizedInsert`), so a writer not handed the stamp reads the live row before
+ * inserting, and throws this when the row is absent rather than leaving it to fail the
+ * deferred `StrandExists` CHECK at commit (a far less legible error). The formation
+ * responder hands the stamp over from `ControlFormationUsageRecorder.resolveStrand`, which
+ * reports an absent row as `missing`; a row removed after that read fails the CHECK instead.
  */
 export class MissingHostStrandError extends Error {
   constructor(readonly strandId: string, readonly token: string) {
@@ -97,22 +104,23 @@ export class FormationAbortedError extends Error {
 /**
  * The invitation's seat budget is already spent: the count of recorded usage rows for the
  * invitation has reached its `TotalUses`, so this redemption cannot be given a seat. `token`
- * is the `FormationInvite.Token` or the `CadreInvite.Key`, whichever table the caller
- * redeemed against.
+ * is the `FormationInvite.Token`, the `CadreInvite.Key` or the `OwnerGrant.Key`, whichever
+ * table the caller redeemed against.
  *
  * Raised off the committed-count check ({@link ControlDatabase.assertSeatRemains}) ahead of
  * the write, inside {@link ControlDatabase.redeemInvitation} /
  * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
- * ({@link ControlDatabase.redeemCadreInvite}), and off the unlocked pre-check
- * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
- * pass — and off nothing else. It exists because
+ * ({@link ControlDatabase.redeemCadreInvite}) and an owner grant
+ * ({@link ControlDatabase.redeemOwnerGrant}), and off the unlocked re-check
+ * `ControlFormationUsageRecorder.authorizeUsage` runs after an outside approval, before the
+ * manager issues a membership pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
  * schema's own count-based cap clause, which the manager reports as a retryable
  * `Formation conflict, retry` — telling the joiner to retry something that can never succeed.
  * Two redemptions of one token racing on the SAME node serialize behind the local write
- * queue, so the loser reads the winner's committed row and is refused here by name —
- * `StrandFormationManager.validateToken`'s `isTokenUsed` check cannot catch that, since it
- * ran before either redemption wrote anything.
+ * queue, so the loser reads the winner's committed row and is refused here by name — the
+ * use count `StrandFormationManager.validateToken` reads cannot catch that, since it was
+ * read before either redemption wrote anything.
  */
 export class InvitationExhaustedError extends Error {
   constructor(
@@ -148,8 +156,51 @@ export class CadreInviteIssuerUnknownError extends Error {
   }
 }
 
-/** The refusal {@link CadreInviteIssuerUnknownError} wraps — the constraint named, as the engine words it. */
-const CADRE_INVITE_UNAUTHORIZED = /CHECK constraint failed: AuthorizedInsert\b/;
+/**
+ * {@link ControlDatabase.seatOwnerGrant} was refused by `OwnerGrant.AuthorizedInsert`: the
+ * grant twin of {@link CadreInviteIssuerUnknownError}, for the same two causes (the issuer's
+ * `OwnerKey` row has not replicated here yet or has since been removed; or a tampered row).
+ * Its own class rather than a shared one so a caller that handles invitation and grant
+ * bundles can tell by `instanceof` which credential was refused.
+ */
+export class OwnerGrantIssuerUnknownError extends Error {
+  constructor(
+    readonly grantKey: string,
+    readonly issuerKey: string,
+    options?: { cause?: unknown }
+  ) {
+    super(
+      `Owner grant ${grantKey} cannot be seated here: its issuer ${issuerKey} is not an owner on this node, or its signature does not verify`,
+      options
+    );
+    this.name = 'OwnerGrantIssuerUnknownError';
+  }
+}
+
+/**
+ * An issued row (a `CadreInvite` or an `OwnerGrant`) the cadre holds that this node cannot read
+ * yet: {@link ControlDatabase.seatCadreInvite} / {@link ControlDatabase.seatOwnerGrant} had its
+ * insert refused by a cohort member already holding the row, and a refreshed read here still
+ * finds nothing; or the redemption that follows the seat finds no row. It clears once this
+ * node's store catches up, which is why the redemption paths answer it with the retryable
+ * `conflict` code.
+ */
+export class IssuedRowNotHereYetError extends Error {
+  constructor(
+    readonly table: IssuedTable,
+    readonly key: string,
+    options?: { cause?: unknown }
+  ) {
+    super(`${table} ${key} is held by the cadre but not readable on this node yet; try again once it has synced`, options);
+    this.name = 'IssuedRowNotHereYetError';
+  }
+}
+
+/**
+ * The refusal {@link CadreInviteIssuerUnknownError} and {@link OwnerGrantIssuerUnknownError}
+ * wrap — the constraint named, as the engine words it; both tables name theirs `AuthorizedInsert`.
+ */
+const ISSUER_UNAUTHORIZED = /CHECK constraint failed: AuthorizedInsert\b/;
 
 /**
  * What a recorded `FormationUsage` row came out as.
@@ -370,6 +421,51 @@ export function cadreInviteConsentMessage(partyId: string, fields: CadreInviteRe
   ]);
 }
 
+/**
+ * The exact bytes an owner signs to seat an `OwnerGrant` row — the TS mirror of the `'add'`
+ * digest in `OwnerGrant.AuthorizedInsert`, over the whole row in the schema's order with
+ * nullable columns as `''` (`ownerGrantRowFields`, shared with the base64url verifier
+ * `peer-authorization.ts`'s `ownerGrantAddDigest`). `expiresAt` must already be the stored
+ * canonical `datetime` string, as {@link ControlDatabase.insertOwnerGrant} produces it, for
+ * the reason on {@link cadreInviteAddMessage}.
+ */
+export function ownerGrantAddMessage(partyId: string, row: OwnerGrantSignedFields): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.OwnerGrant', 'add', partyId, ownerGrantRowFields(row));
+}
+
+/** The fields both owner-grant redemption signatures cover; see {@link ownerGrantRedeemMessage}. */
+export interface OwnerGrantRedemptionFields {
+  grantKey: string;
+  /** The single-use nonce the holder minted for this redemption (`generateStampId`). */
+  usageStampId: string;
+  /** The owner key being seated (base64url ed25519). */
+  seatedKey: string;
+}
+
+/**
+ * The exact bytes the HOLDER of an owner grant signs, with the grant's private key, to redeem
+ * it once — the TS mirror of the `'redeem'` digest `OwnerGrantUsage.GrantPossessed` verifies
+ * against the grant's public key. Binding the seated key and the nonce means a captured
+ * redemption can seat no other key and spend no other use.
+ */
+export function ownerGrantRedeemMessage(partyId: string, fields: OwnerGrantRedemptionFields): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.OwnerGrantUsage', 'redeem', partyId, [
+    fields.grantKey, fields.usageStampId, fields.seatedKey,
+  ]);
+}
+
+/**
+ * The exact bytes the SEATED key signs, proving the holder holds it — the TS mirror of the
+ * `'consent'` digest `OwnerGrantUsage.OwnerConsented` verifies against `SeatedKey`. Same
+ * fields as {@link ownerGrantRedeemMessage} under a distinct action tag, so neither
+ * signature can stand in for the other.
+ */
+export function ownerGrantConsentMessage(partyId: string, fields: OwnerGrantRedemptionFields): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.OwnerGrantUsage', 'consent', partyId, [
+    fields.grantKey, fields.usageStampId, fields.seatedKey,
+  ]);
+}
+
 /**
  * Minimal interface for the CollectionFactory returned by the optimystic plugin.
  * We only need the methods we actually use.
@@ -393,6 +489,8 @@ interface OptimysticPluginResult {
    * compose-strand.ts).
    */
   hydrate: (db: Database) => Promise<{ tables: number; indexes: number }>;
+  /** The transaction bridge, whose registry holds every collection a control table opened; see {@link ControlDatabase.ensureOwnerKey}. */
+  txnBridge: CollectionRegistrySource;
   [key: string]: unknown;
 }
 
@@ -418,14 +516,23 @@ const GUARDED_KEY_COLUMN: Readonly<Record<RevocableTable, GuardedKeyColumn>> = {
   JoinRequest: 'Id',
   DeviceToken: 'PeerId',
   CadreInvite: 'Key',
+  OwnerGrant: 'Key',
 };
 
 /**
- * A guarded table an owner may remove a row from. `CadreInvite` is excluded by design — its
- * rows are never deleted (`NoDelete`), and withdrawing one is a tombstone alone
- * ({@link ControlDatabase.withdrawCadreInvite}).
+ * A guarded table of owner-issued credentials: signed rows that travel inside a bundle, are
+ * seated verbatim by any member ({@link ControlDatabase.seatCadreInvite},
+ * {@link ControlDatabase.seatOwnerGrant}), and are never deleted (`NoDelete`) because the
+ * rows they admitted prove themselves through them. Withdrawing one is a tombstone alone
+ * ({@link ControlDatabase.withdrawCadreInvite}, {@link ControlDatabase.withdrawOwnerGrant}).
  */
-type RemovableTable = Exclude<RevocableTable, 'CadreInvite'>;
+type IssuedTable = Extract<RevocableTable, 'CadreInvite' | 'OwnerGrant'>;
+
+/** The write-reason prefix each {@link IssuedTable}'s seat and withdrawal log under. */
+const ISSUED_TABLE_REASON: Readonly<Record<IssuedTable, string>> = { CadreInvite: 'cadre-invite', OwnerGrant: 'owner-grant' };
+
+/** A guarded table an owner may remove a row from: every revocable table but the {@link IssuedTable}s. */
+type RemovableTable = Exclude<RevocableTable, IssuedTable>;
 
 /**
  * One row incarnation's owner-signed removal, ready for {@link ControlDatabase.execGuardedRemoval}:
@@ -442,10 +549,9 @@ interface GuardedRemoval {
 
 /**
  * The exact bytes an owner signs to append one `Revocation` tombstone — `Revocation.Authorized`
- * binds the whole (TableName, RowKey, StampId) row under its own domain tag. Shared by every
- * tombstone writer (a guarded removal, a `CadreInvite` withdrawal, the ledger marker) so the
- * field order lives in one place; the base64url verifier is `peer-authorization.ts`'s
- * `revocationDigest`.
+ * binds the whole (TableName, RowKey, StampId) row under its own domain tag. Shared by both
+ * tombstone writers (a guarded removal, an issued row's withdrawal) so the field order lives
+ * in one place; the base64url verifier is `peer-authorization.ts`'s `revocationDigest`.
  */
 function revocationTombstoneMessage(partyId: string, ref: { tableName: string; rowKey: string; stampId: string }): Uint8Array {
   return buildAuthorizationMessage('CadreControl.Revocation', 'remove', partyId, [ref.tableName, ref.rowKey, ref.stampId]);
@@ -455,42 +561,142 @@ function revocationTombstoneMessage(partyId: string, ref: { tableName: string; r
  * The exact bytes an owner signs to seat a further `OwnerKey` row (the signed-add branch of
  * `OwnerKey.Authorized`); the base64url twin is `peer-authorization.ts`'s `ownerKeyAddDigest`.
  */
-function ownerKeyAddMessage(partyId: string, key: string, stampId: string): Uint8Array {
-  return buildAuthorizationMessage('CadreControl.OwnerKey', 'add', partyId, [key, stampId]);
+function ownerKeyAddMessage(partyId: string, key: string, label: string | null, stampId: string): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.OwnerKey', 'add', partyId, [key, label ?? '', stampId]);
 }
 
-function signGuardedRemoval(
+/**
+ * An owner key's label as its row stores it: trimmed, a blank one left out, and refused past
+ * {@link OWNER_KEY_MAX_LABEL} by name rather than by the schema's `LabelLength` check.
+ * Idempotent, so a caller that checks before opening an owner approval can pass the result on.
+ */
+export function ownerKeyLabel(label: string | null | undefined): string | null {
+  const trimmed = label?.trim();
+  if (!trimmed) {
+    return null;
+  }
+  if (trimmed.length > OWNER_KEY_MAX_LABEL) {
+    throw new Error(`An owner key's label must be at most ${OWNER_KEY_MAX_LABEL} characters (this one has ${trimmed.length})`);
+  }
+  return trimmed;
+}
+
+/**
+ * Signs one owner digest's raw bytes (no pre-hash) and returns a base64url Ed25519 signature:
+ * the callback every owner-signed writer takes. An `OwnerSign` from an open
+ * `OwnerSigner.approve` fits it, and so does a synchronous signer.
+ *
+ * NOTE: writers that read the stamp they sign do so inside the write lock, so the lock is held
+ * across these calls, and a `lockedWithRetry` re-run signs again inside the same approval.
+ * Free for a software signer. If a prompting signer ever holds the lock long enough to stall
+ * other control writes, sign outside the lock and re-check the stamp inside it.
+ */
+export type ControlSign = (message: Uint8Array) => string | Promise<string>;
+
+/**
+ * Signs this node's own address record over its `CadrePeer` row as it stands —
+ * {@link ControlDatabase.updateSelfPeerRecord}'s callback, run inside the locked write body on
+ * every attempt, so the record written is always stamped past the row that was actually read.
+ */
+export type SelfRecordSigner = (current: PeerAddressRecord) => PeerAddressRecord;
+
+/**
+ * Which owner re-touch {@link ControlDatabase.reauthorizeCadrePeer} makes over a `CadrePeer` row:
+ *
+ * - `'rebroadcast'` — the write-while-alone drain re-emitting a row that committed local-only. It
+ *   bumps `UpdatedAt` so the row goes out as a fresh transaction, and writes only while the row's
+ *   `Sig` is null: once the machine has self-published, the row is its to refresh, and a bump
+ *   without a re-sign would leave its signature unverifiable.
+ * - `'revouch'` — an owner rebinding the row's voucher to its own key before the vouching key is
+ *   removed (`CadreNode.removeOwner`). Written whether or not the machine has self-published, and
+ *   leaves `UpdatedAt` untouched, so a self-signed record stays verifiable.
+ */
+export type CadrePeerRetouchMode = 'rebroadcast' | 'revouch';
+
+/**
+ * What {@link ControlDatabase.reauthorizeCadrePeer} found and did: the row was re-touched; no
+ * readable row exists (absent, or its stamp retired); or — `'rebroadcast'` only — the machine has
+ * self-published since, so the row is no longer the owner's to re-emit. The two no-write outcomes
+ * are decided over the row as read inside the locked body, so a caller can act on them.
+ */
+export type CadrePeerRetouchOutcome = 'retouched' | 'absent' | 'self-published';
+
+/** A formation invitation written with a founding ({@link FoundingRows}), bound to the strand founded. */
+export interface FoundingInvite {
+  /** The invitation token, the `FormationInvite` primary key. */
+  token: string;
+  /** The sApp a redeemed strand will use. */
+  sAppId: string;
+  /** Epoch ms after which it cannot be redeemed; omit for never. */
+  expiresAtMs?: number;
+  /** How many redemptions it allows; omit for unlimited. */
+  totalUses?: number;
+  /** Web hook sent the disclosure; a `ValidationKey` then signs off each redemption. */
+  validationUrl?: string;
+}
+
+/** The control rows one founding writes together; see {@link ControlDatabase.insertFoundingRows}. */
+export interface FoundingRows {
+  strand: { id: string; type: 'o' | 'c'; memberPrivateKey?: string };
+  /** This party's membership identity key for a closed strand; absent for an open strand, or when a stored key is adopted. */
+  partyKey?: string;
+  /** A formation invitation bound to this strand (its `StrandId` is `strand.id`). */
+  formationInvite?: FoundingInvite;
+}
+
+/** One owner-signed insert, stamped and signed: the statement and parameters to run under the write lock. */
+interface SignedInsert {
+  sql: string;
+  params: SqlParameters;
+}
+
+/** What an owner asks {@link ControlDatabase.insertCadreInvite} (or {@link ControlDatabase.signCadreInvite}) to sign. */
+export interface CadreInviteFields {
+  /** The invitation public key (base64url ed25519), the row's primary key. */
+  key: string;
+  /** The device the invitation is for, or null for whoever redeems first. */
+  peerId?: string | null;
+  /** Epoch ms after which it cannot be redeemed; omit for never. */
+  expiresAtMs?: number | null;
+  /** How many redemptions it allows; omit for unlimited. */
+  totalUses?: number | null;
+}
+
+async function signGuardedRemoval(
   partyId: string,
   tableName: RemovableTable,
   rowKey: string,
   stampId: string,
-  signMessage: (message: Uint8Array) => string
-): GuardedRemoval {
+  signMessage: ControlSign
+): Promise<GuardedRemoval> {
   const ref = { tableName, rowKey, stampId };
   return {
     ref,
-    signature: signMessage(buildAuthorizationMessage(`CadreControl.${tableName}`, 'remove', partyId, [rowKey, stampId])),
-    revocationSignature: signMessage(revocationTombstoneMessage(partyId, ref)),
+    signature: await signMessage(buildAuthorizationMessage(`CadreControl.${tableName}`, 'remove', partyId, [rowKey, stampId])),
+    revocationSignature: await signMessage(revocationTombstoneMessage(partyId, ref)),
   };
 }
 
 /** The control tables keyed by a strand id whose repeat insert a caller may treat as idempotent. */
-type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
+type StrandIdTable = Extract<RevocableTable, 'Strand' | 'StrandPartyKey' | 'JoinedStrand'>;
 
-/** The control tables keyed by an `Id` column whose repeat insert a caller may classify. */
-type IdKeyedTable = StrandIdTable | Extract<RevocableTable, 'JoinRequest'>;
+/** The control tables whose repeat insert of a held key a caller may classify. */
+type KeyConflictTable = StrandIdTable | IssuedTable | Extract<RevocableTable, 'JoinRequest'>;
 
 /**
- * The rejection a second insert of an already-seated id into `table` produces, as the
+ * The rejection a second insert of an already-seated key into `table` produces, as the
  * optimystic vtab words it (`uniqueConstraintMessage`, qualified by table name only — no
- * schema prefix, matching `test/control-constraint-helpers.ts`'s `expectUniqueViolation`).
+ * schema prefix, matching `test/control-constraint-helpers.ts`'s `expectUniqueViolation`),
+ * naming the table's {@link GUARDED_KEY_COLUMN}.
  *
  * Each table's `StampId` is unique too, but a fresh stamp is minted per insert attempt, so
- * only the primary key can collide on a repeat insert. Matching the column explicitly
- * keeps any OTHER uniqueness failure out of the caller's idempotency branch.
+ * only the primary key can collide on a repeat insert. An issued row's bundle copy repeats its
+ * stamp as well, and the engine still names the key (`control-owner-grant.spec.ts` pins it).
+ * Matching the column explicitly keeps any OTHER uniqueness failure out of the caller's
+ * idempotency branch.
  */
-function idConflictPattern(table: IdKeyedTable): RegExp {
-  return new RegExp(`UNIQUE constraint failed: ${table}\\.Id\\b`, 'i');
+function keyConflictPattern(table: KeyConflictTable): RegExp {
+  return new RegExp(`UNIQUE constraint failed: ${table}\\.${GUARDED_KEY_COLUMN[table]}\\b`, 'i');
 }
 
 /**
@@ -499,7 +705,8 @@ function idConflictPattern(table: IdKeyedTable): RegExp {
  * {@link CadreNode.publishStrand} uses this to tell "my own earlier publish already
  * landed" (re-read, and no-op when the row matches) apart from every other rejection —
  * an unauthorized signer, a retired stamp — which must keep surfacing. For `JoinedStrand`
- * the same test tells "another machine of this party already published this join" apart.
+ * the same test tells "another machine of this party already published this join" apart, and
+ * for `StrandPartyKey` it tells a founding that this party's key for the id is already seated.
  *
  * Matched by TEXT, not by type: the typed engine error does not survive the trip out of
  * optimystic (same constraint the retry classifiers in `control-write-retry.ts` document).
@@ -509,7 +716,17 @@ function idConflictPattern(table: IdKeyedTable): RegExp {
  * reword reddens there.
  */
 export function isStrandIdConflict(error: unknown, table: StrandIdTable): boolean {
-  return errorChainMatches(error, idConflictPattern(table));
+  return errorChainMatches(error, keyConflictPattern(table));
+}
+
+/**
+ * Did a seat of an issued row fail because a cohort member already holds a row under its key?
+ * {@link ControlDatabase.seatCadreInvite} / {@link ControlDatabase.seatOwnerGrant} reach this
+ * on a node whose store lags the cohort: its guard read missed the row, and the member that
+ * checked the commit refused the insert. Text-matched, failing closed, like {@link isStrandIdConflict}.
+ */
+export function isIssuedRowKeyConflict(error: unknown, table: IssuedTable): boolean {
+  return errorChainMatches(error, keyConflictPattern(table));
 }
 
 /**
@@ -522,7 +739,7 @@ export function isStrandIdConflict(error: unknown, table: StrandIdTable): boolea
  * until the next reap pass.
  */
 export function isPendingJoinConflict(error: unknown): boolean {
-  return errorChainMatches(error, idConflictPattern('JoinRequest'));
+  return errorChainMatches(error, keyConflictPattern('JoinRequest'));
 }
 
 /**
@@ -556,31 +773,17 @@ export class PendingJoinChangedError extends Error {
 }
 
 /**
- * The one `CadreControl.Revocation` row that retires nothing, filed once by an owner
- * ({@link ControlDatabase.openRevocationLedger}) so the table is never a never-written
- * block. The schema's table comment says why that matters and why the row can never read
- * as a retirement; `RowIsGone` pins this exact triple.
+ * A `CadreControl.Revocation` row that retires nothing, which parties founded before
+ * `control-collections-created-at-cadre-founding` may hold: an owner filed it so the table
+ * had a collection, which genesis now creates. Nothing files it now. `RowIsGone` still admits
+ * this exact triple, and {@link ControlDatabase.queryRevocations} skips it.
  */
-export const REVOCATION_LEDGER_MARKER = {
+const REVOCATION_LEDGER_MARKER = {
   tableName: 'Revocation',
   rowKey: 'ledger',
   stampId: 'opened',
 } as const;
 
-/**
- * The rejection a second insert of the ledger marker produces: the optimystic vtab's
- * primary-key wording (see {@link idConflictPattern}), naming both columns of
- * `Revocation`'s composite key. Applied only to the marker's own insert, whose key
- * ('Revocation', 'opened') no row but the marker can hold (`RowIsGone`), and `Revocation`
- * has no other unique constraint.
- */
-const REVOCATION_LEDGER_CONFLICT = /UNIQUE constraint failed: Revocation\.TableName, Revocation\.StampId\b/i;
-
-/** Did the ledger marker's insert fail because the marker is already filed? Text-matched, failing closed, like {@link isStrandIdConflict}. */
-function isRevocationLedgerConflict(error: unknown): boolean {
-  return errorChainMatches(error, REVOCATION_LEDGER_CONFLICT);
-}
-
 /** Whether any message in `error`'s cause chain matches `pattern`; false for a non-`Error`. */
 function errorChainMatches(error: unknown, pattern: RegExp): boolean {
   return error instanceof Error && chainMessages(error).some(message => pattern.test(message));
@@ -588,42 +791,33 @@ function errorChainMatches(error: unknown, pattern: RegExp): boolean {
 
 /**
  * Project `CadrePeer` rows into the {@link SeedPeer} list a seed, or a cadre invitation
- * redemption reply, carries.
+ * redemption reply, carries. `minterPeerId` is the machine minting the seed or answering the
+ * redemption; it contributes an entry only through its own `CadrePeer` row.
  *
- * Owner identity is sourced from the `OwnerKey` table, not from the transport peer id. An
- * Ed25519 libp2p peer id embeds its public key (identity multihash), so each peer's ed25519
- * key is derivable from its `PeerId`; a peer is an owner iff that derived key is in
- * `ownerKeys`. This makes any owner node markable — not just the local one. A non-Ed25519
- * or unparsable id yields a non-owner rather than failing the whole projection.
- *
- * NOTE: this is the one owner lookup deliberately left on the REPLICATED table rather than
- * the node-local anchor. `SeedPeer.isOwner` is a dial hint — the receiver dials owner-flagged
- * peers first — not a trust decision, and the receiver re-derives real trust from its own
- * anchor. So a polluted table costs at most a wasted dial, while anchoring here would
- * silently drop legitimate co-owners this node never pinned. If `isOwner` ever gates
- * anything the receiver TRUSTS, move it to the anchor.
+ * A peer is `preferred` when it is the minter, the one machine certain to be reachable by the
+ * receiver at that moment, since it is delivering the seed or the reply, or an always-on
+ * machine (`Profile = 'storage'`), the ones that stay dialable. Preference is a dial hint and
+ * reads no `OwnerKey` row: owner keys are not machines, and a receiver derives trust from its
+ * own anchor, never from this list. A `Profile` is self-declared and not checked here, so a
+ * machine misdeclaring one costs the receiver a wasted dial at most.
  */
-export function projectSeedPeers(rows: readonly CadrePeerRow[], ownerKeys: ReadonlySet<string>): SeedPeer[] {
-  return rows.map(({ peerId, multiaddr }) => {
-    const pubKeyB64 = ed25519PublicKeyB64FromPeerId(peerId);
-    const isOwner = pubKeyB64 !== null && ownerKeys.has(pubKeyB64);
-    return {
-      peerId,
-      multiaddrs: multiaddr ? multiaddr.split(',') : [],
-      isOwner,
-      ...(isOwner ? { publicKey: pubKeyB64 } : {}),
-    };
-  });
+export function projectSeedPeers(rows: readonly CadrePeerRow[], minterPeerId: string): SeedPeer[] {
+  return rows.map(({ peerId, multiaddr, profile }) => ({
+    peerId,
+    multiaddrs: multiaddr ? multiaddr.split(',') : [],
+    preferred: peerId === minterPeerId || profile === 'storage',
+  }));
 }
 
 /**
- * The conditions a cadre invitation must still meet to be redeemed, short of its use count:
- * not withdrawn, unexpired (`expiresAt <= now` is expired, as the redemption refuses it),
- * and issued by a current owner. Shared by {@link ControlDatabase.hasLiveCadreInvite},
- * {@link ControlDatabase.isCadreInviteLive} and {@link ControlDatabase.listCadreInviteStatuses}
- * so they cannot drift from each other, or from `CadreInviteUsage.Authorized`.
+ * The conditions an issued credential (a cadre invitation or an owner grant) must still meet
+ * to be redeemed, short of its use count: not withdrawn, unexpired (`expiresAt <= now` is
+ * expired, as the redemption refuses it), and issued by a current owner. Shared by
+ * {@link ControlDatabase.hasLiveCadreInvite}, {@link ControlDatabase.isCadreInviteLive},
+ * {@link ControlDatabase.listCadreInviteStatuses} and their owner-grant twins so they cannot
+ * drift from each other, or from `CadreInviteUsage.Authorized` / `OwnerGrantUsage.Authorized`.
  */
-function cadreInviteStillOpen(
+function issuedRowStillOpen(
   row: { stampId: string; issuerKey: string; expiresAt: string | null },
   withdrawn: ReadonlySet<string>,
   owners: ReadonlySet<string>,
@@ -647,8 +841,8 @@ function cadreInviteStillOpen(
  * hold, so a reaped row is recoverable by re-forming. `JoinRequest` is reapable for the same
  * reason: the inviting party and the user also hold its invitation. `OwnerKey` has no
  * production removal path and `MinOneOwner` makes an automated owner-key reap a
- * party-bricking hazard. `CadreInvite` is never deleted at all (its tombstone is a
- * withdrawal over a row that stays), so there is nothing to reap.
+ * party-bricking hazard. `CadreInvite` and `OwnerGrant` are never deleted at all (their
+ * tombstones are withdrawals over rows that stay), so there is nothing to reap.
  */
 export const REAPABLE_TABLES = ['CadrePeer', 'DeviceToken', 'ValidationKey', 'JoinedStrand', 'JoinRequest'] as const satisfies readonly RevocableTable[];
 export type ReapableTable = (typeof REAPABLE_TABLES)[number];
@@ -656,26 +850,109 @@ export type ReapableTable = (typeof REAPABLE_TABLES)[number];
 /**
  * Runtime membership test for {@link REAPABLE_TABLES}, narrowing a tombstone's
  * `TableName` to the subset {@link ControlDatabase.reapRevokedRow} accepts. A tombstone
- * naming an excluded table (`Strand`, `OwnerKey`, `CadreInvite`) is skipped silently —
+ * naming an excluded table (`Strand`, `OwnerKey`, `CadreInvite`, `OwnerGrant`) is skipped silently —
  * `Strand` tombstones are the common case in a party that has unpublished a strand, so a
  * log line per skip would be per-pass noise.
  */
 const REAPABLE_TABLE_SET: ReadonlySet<RevocableTable> = new Set<RevocableTable>(REAPABLE_TABLES);
 const isReapableTable = (table: RevocableTable): table is ReapableTable => REAPABLE_TABLE_SET.has(table);
 
-/** Every `CadreInvite` column, in the order {@link cadreInviteRowOf} reads them; callers append their `where`. */
-const CADRE_INVITE_SELECT_SQL = 'select Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.CadreInvite';
+/** One control read's rows, and whether it took the committed-read path ({@link ControlDatabase.readRowsOnce}). */
+interface RoutedRead {
+  rows: Record<string, SqlValue>[];
+  committed: boolean;
+}
+
+/**
+ * The full-table scans the `Revocation`, `CadrePeer` and `OwnerKey` membership views load
+ * ({@link ControlDatabase.readMembershipRows}); the four chain tables' scans sit beside their
+ * row mappers below. Specs rig these reads by their text: `from CadreControl.Revocation`, and
+ * the `CadrePeer` scan by its `select PeerId, Multiaddr, StampId` prefix, which no other
+ * `CadrePeer` statement shares.
+ */
+const REVOCATION_SELECT_SQL = 'select TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig from CadreControl.Revocation';
+const CADRE_PEER_SELECT_SQL = 'select PeerId, Multiaddr, StampId, VouchOwner, VouchSig, VouchUsage, PublicKey, UpdatedAt, Profile, Sig from CadreControl.CadrePeer';
+const OWNER_KEY_SELECT_SQL = 'select Key, Label, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.OwnerKey';
+
+/** A stored `CadrePeer` row as a {@link CadrePeerRow}. */
+function cadrePeerRowOf(row: Record<string, SqlValue>): CadrePeerRow {
+  return {
+    peerId: row.PeerId as string,
+    publicKey: (row.PublicKey as string | null) ?? null,
+    multiaddr: (row.Multiaddr as string | null) ?? null,
+    updatedAt: (row.UpdatedAt as number | null) ?? 0,
+    profile: (row.Profile as NodeProfile | null) ?? null,
+    sig: (row.Sig as string | null) ?? null,
+    stampId: (row.StampId as string | null) ?? null,
+    vouchOwner: (row.VouchOwner as string | null) ?? null,
+    vouchSig: (row.VouchSig as string | null) ?? null,
+    vouchUsage: (row.VouchUsage as string | null) ?? null,
+  };
+}
+
+/** A {@link CadrePeerRow} as the address record its machine signed ({@link PeerAddressRecord}); see {@link ControlDatabase.queryPeerRecord} for the coalescing. */
+function peerAddressRecordOf(row: CadrePeerRow): PeerAddressRecord {
+  const multiaddr = row.multiaddr ?? '';
+  return {
+    peerId: row.peerId,
+    publicKey: row.publicKey ?? '',
+    addrs: multiaddr.length > 0 ? multiaddr.split(',') : [],
+    updatedAt: row.updatedAt,
+    profile: row.profile,
+    sig: row.sig ?? '',
+  };
+}
+
+/** The columns {@link ControlDatabase.reauthorizeCadrePeer} signs over and bumps: a row it may write. */
+interface RetouchTarget {
+  stampId: string;
+  updatedAt: number;
+}
+
+/**
+ * {@link ControlDatabase.reauthorizeCadrePeer}'s decision over the row as read: the row to write,
+ * or the {@link CadrePeerRetouchOutcome} that says why nothing is written — no readable row (a
+ * stampless row counts, since the voucher digest binds the stamp), or a self-published row in
+ * `'rebroadcast'` mode. One function so the pre-check outside the lock and the re-check inside it
+ * cannot disagree.
+ */
+function retouchTarget(row: CadrePeerRow | null, mode: CadrePeerRetouchMode): RetouchTarget | 'absent' | 'self-published' {
+  if (row === null || row.stampId === null) {
+    return 'absent';
+  }
+  if (mode === 'rebroadcast' && row.sig !== null) {
+    return 'self-published';
+  }
+  return { stampId: row.stampId, updatedAt: row.updatedAt };
+}
+
+/** A stored `Revocation` row as a {@link RevocationRow}; the caller has already skipped {@link REVOCATION_LEDGER_MARKER}. */
+function revocationRowOf(row: Record<string, SqlValue>): RevocationRow {
+  return {
+    tableName: row.TableName as RevocableTable,
+    rowKey: row.RowKey as string,
+    stampId: row.StampId as string,
+    reissuedAt: (row.ReissuedAt as number | null) ?? 0,
+    signerKey: row.SignerKey as string,
+    signerSig: row.SignerSig as string,
+  };
+}
+
+/**
+ * Every `CadreInvite` column, in the order {@link cadreInviteRowOf} reads them: the full scan the
+ * `CadreInvite` membership view loads, and the base the point reads append their `where` to.
+ */
+const CADRE_INVITE_SELECT_SQL = 'select Key, PeerId, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.CadreInvite';
 
 /**
  * A stored `CadreInvite` row as a {@link CadreInviteRow}. `ExpiresAt` is kept as the
  * engine-canonical string it reads back as — the form the `'add'` signature covers — never
- * parsed to ms here; `GrantsOwner` is the schema's 0/1 integer.
+ * parsed to ms here.
  */
 function cadreInviteRowOf(row: Record<string, SqlValue>): CadreInviteRow {
   return {
     key: row.Key as string,
     peerId: (row.PeerId as string | null) ?? null,
-    grantsOwner: Number(row.GrantsOwner) === 1,
     expiresAt: row.ExpiresAt == null ? null : String(row.ExpiresAt),
     totalUses: (row.TotalUses as number | null) ?? null,
     issuerKey: row.IssuerKey as string,
@@ -684,6 +961,9 @@ function cadreInviteRowOf(row: Record<string, SqlValue>): CadreInviteRow {
   };
 }
 
+/** The full scan the `CadreInviteUsage` membership view loads, in the order {@link cadreInviteUsageRowOf} reads it. */
+const CADRE_INVITE_USAGE_SELECT_SQL = 'select UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, InviteSig, PeerSig from CadreControl.CadreInviteUsage';
+
 /** A stored `CadreInviteUsage` row as a {@link CadreInviteUsageRow}. */
 function cadreInviteUsageRowOf(row: Record<string, SqlValue>): CadreInviteUsageRow {
   return {
@@ -692,12 +972,50 @@ function cadreInviteUsageRowOf(row: Record<string, SqlValue>): CadreInviteUsageR
     peerId: row.PeerId as string,
     peerKey: row.PeerKey as string,
     peerStampId: row.PeerStampId as string,
-    ownerStampId: (row.OwnerStampId as string | null) ?? null,
     inviteSig: row.InviteSig as string,
     peerSig: row.PeerSig as string,
   };
 }
 
+/** Every `OwnerGrant` column, in the order {@link ownerGrantRowOf} reads them; as {@link CADRE_INVITE_SELECT_SQL}, the view's scan and the point read's base. */
+const OWNER_GRANT_SELECT_SQL = 'select Key, Label, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.OwnerGrant';
+
+/** A stored `OwnerGrant` row as an {@link OwnerGrantRow}; `ExpiresAt` kept canonical, as {@link cadreInviteRowOf} keeps it. */
+function ownerGrantRowOf(row: Record<string, SqlValue>): OwnerGrantRow {
+  return {
+    key: row.Key as string,
+    label: (row.Label as string | null) ?? null,
+    expiresAt: row.ExpiresAt == null ? null : String(row.ExpiresAt),
+    totalUses: (row.TotalUses as number | null) ?? null,
+    issuerKey: row.IssuerKey as string,
+    issuerSig: row.IssuerSig as string,
+    stampId: row.StampId as string,
+  };
+}
+
+/** The full scan the `OwnerGrantUsage` membership view loads, in the order {@link ownerGrantUsageRowOf} reads it. */
+const OWNER_GRANT_USAGE_SELECT_SQL = 'select UsageStampId, GrantKey, SeatedKey, SeatedStampId, GrantSig, OwnerSig from CadreControl.OwnerGrantUsage';
+
+/** A stored `OwnerGrantUsage` row as an {@link OwnerGrantUsageRow}. */
+function ownerGrantUsageRowOf(row: Record<string, SqlValue>): OwnerGrantUsageRow {
+  return {
+    usageStampId: row.UsageStampId as string,
+    grantKey: row.GrantKey as string,
+    seatedKey: row.SeatedKey as string,
+    seatedStampId: row.SeatedStampId as string,
+    grantSig: row.GrantSig as string,
+    ownerSig: row.OwnerSig as string,
+  };
+}
+
+/** One issued row's standing, as {@link ControlDatabase.listCadreInviteStatuses} and {@link ControlDatabase.listOwnerGrantStatuses} report it. */
+interface IssuedRowStanding<Row> {
+  row: Row;
+  live: boolean;
+  withdrawn: boolean;
+  usesRecorded: number;
+}
+
 /** A `JoinedStrand` row as a {@link StrandRow}; the schema's `KnownType` check backs the `Type` cast. */
 function joinedStrandRow(row: Record<string, SqlValue>): StrandRow {
   return {
@@ -705,20 +1023,26 @@ function joinedStrandRow(row: Record<string, SqlValue>): StrandRow {
     MemberPrivateKey: row.MemberPrivateKey as string | null,
     Type: row.Type as 'o' | 'c',
     FounderOwnerKey: null,
+    FounderPeerId: null,
+  };
+}
+
+/** A party-own `Strand` row as a {@link StrandRow}; the `Type` cast as {@link joinedStrandRow}'s. */
+function strandRow(row: Record<string, SqlValue>): StrandRow {
+  return {
+    Id: row.Id as string,
+    MemberPrivateKey: row.MemberPrivateKey as string | null,
+    Type: row.Type as 'o' | 'c',
+    FounderOwnerKey: row.FounderOwnerKey as string | null,
+    FounderPeerId: row.FounderPeerId as string | null,
   };
 }
 
+const STRAND_COLUMNS = 'Id, MemberPrivateKey, Type, FounderOwnerKey, FounderPeerId';
+
 /** A `FormationInvite` row as {@link ControlDatabase.queryFormationInvite} reads it. */
-export interface FormationInviteRow {
+export interface FormationInviteRow extends FormationInviteFacts {
   token: string;
-  sAppId: string;
-  /** Parsed epoch ms of the stored `datetime`; null when the invitation never expires. */
-  expiresAtMs: number | null;
-  /** Null is unlimited. */
-  totalUses: number | null;
-  validationUrl: string | null;
-  /** A bound invitation's host strand; null on the responder-provisions path. */
-  strandId: string | null;
 }
 
 const FORMATION_INVITE_SELECT_SQL = 'select Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId from CadreControl.FormationInvite';
@@ -805,13 +1129,13 @@ interface SignedStatement {
  * `JoinSuccess` / `JoinFailure` row and the signature its `AuthorizedInsert` verifies, over the
  * row's columns in the schema's order (a null column signs as `''`, an integer as its text).
  */
-function signJoinOutcomeInsert(
+async function signJoinOutcomeInsert(
   partyId: string,
   requestStampId: string,
   outcome: JoinOutcome,
   ownerKey: string,
-  signMessage: (message: Uint8Array) => string
-): SignedStatement {
+  signMessage: ControlSign
+): Promise<SignedStatement> {
   const at = String(outcome.RecordedAt);
   const { table, sql, fields, values } = outcome.kind === 'joined'
     ? {
@@ -824,7 +1148,7 @@ function signJoinOutcomeInsert(
         fields: [requestStampId, at, outcome.Code, outcome.Reason],
         values: [requestStampId, outcome.RecordedAt, outcome.Code, outcome.Reason],
       };
-  const signature = signMessage(buildAuthorizationMessage(`CadreControl.${table}`, 'add', partyId, fields));
+  const signature = await signMessage(buildAuthorizationMessage(`CadreControl.${table}`, 'add', partyId, fields));
   return { sql, params: [ownerKey, signature, ...values] };
 }
 
@@ -848,9 +1172,6 @@ export type MembershipChangeListener = (reason: string) => Promise<void>;
  */
 export type RevokedRowRef = Pick<RevocationRow, 'tableName' | 'rowKey' | 'stampId'>;
 
-/** What {@link ControlDatabase.removeMachine} wrote: `CadreNode.removeMachine`'s result, less the re-vouches it made first. */
-export type MachineRemovalWrites = Pick<MachineRemovalResult, 'removedPeer' | 'removedOwnerKey' | 'removedDeviceToken' | 'withdrawnInvitations'>;
-
 /**
  * Notified after a guarded-table delete — and the `CadreControl.Revocation`
  * tombstone it writes in the same transaction — has COMMITTED.
@@ -878,6 +1199,30 @@ export type GuardedDeleteListener = (revocation: RevokedRowRef) => void;
  */
 export type ControlWriteAbandonedListener = (abandonment: ControlRetryAbandonment) => void;
 
+/** The text of a {@link ControlDatabaseConfig.schemaPath} file; Node.js only. */
+async function readSchemaFile(schemaPath: string): Promise<string> {
+  if (typeof process === 'undefined' || !process.versions?.node) {
+    throw new Error(
+      'Loading schema from file is not supported in React Native. ' +
+      'Remove the schemaPath option to use the embedded schema instead.'
+    );
+  }
+  try {
+    // Use require to conditionally load fs only in Node.js.
+    // This won't be bundled by React Native's Metro bundler — a dynamic
+    // import() would be statically picked up by Metro, so require is
+    // intentional here (cross-platform constraint, not lazy CommonJS).
+    // eslint-disable-next-line @typescript-eslint/no-require-imports
+    const fs = require('fs/promises');
+    return await fs.readFile(schemaPath, 'utf-8');
+  } catch (error) {
+    throw new Error(
+      `Failed to load schema from ${schemaPath}: ${error instanceof Error ? error.message : String(error)}`,
+      { cause: error }
+    );
+  }
+}
+
 export interface ControlDatabaseConfig {
   /**
    * Party ID for the control network. Also the party every owner and peer signature over a
@@ -890,6 +1235,8 @@ export interface ControlDatabaseConfig {
    * Optional path to the control schema file.
    * If not provided, uses the embedded schema for cross-platform compatibility.
    * Only use this if you need to override the default schema (e.g., for testing).
+   * The file has the shape of `schemas/control.qsql`: one `declare schema CadreControl`
+   * followed by one plain `apply schema CadreControl` ({@link controlSchemaFileDeclaration}).
    */
   schemaPath?: string;
   /** Libp2p node for the control network (injected) */
@@ -905,6 +1252,7 @@ export interface ControlDatabaseConfig {
 export class ControlDatabase {
   private db: Database | null = null;
   private collectionFactory: CollectionFactory | null = null;
+  private txnBridge: CollectionRegistrySource | null = null;
   private readonly config: ControlDatabaseConfig;
   private initialized = false;
   private membershipListener: MembershipChangeListener | null = null;
@@ -912,6 +1260,26 @@ export class ControlDatabase {
   private controlWriteAbandonedListener: ControlWriteAbandonedListener | null = null;
   /** Tail of the local-write chain — see {@link withWriteLock}. */
   private writeQueue: Promise<unknown> = Promise.resolve();
+  /** Subscriptions handed out by {@link watchTables}. */
+  private readonly tableWatches = new TableWatchRegistry();
+  /** The cached membership tables; see {@link readMembershipRows}. */
+  private readonly revocationView = this.membershipView(REVOCATION_SELECT_SQL, 'revocations');
+  private readonly cadrePeerView = this.membershipView(CADRE_PEER_SELECT_SQL, 'cadre-peers');
+  private readonly ownerKeyView = this.membershipView(OWNER_KEY_SELECT_SQL, 'owner-keys');
+  private readonly cadreInviteView = this.membershipView(CADRE_INVITE_SELECT_SQL, 'cadre-invites');
+  private readonly cadreInviteUsageView = this.membershipView(CADRE_INVITE_USAGE_SELECT_SQL, 'cadre-invite-usages');
+  private readonly ownerGrantView = this.membershipView(OWNER_GRANT_SELECT_SQL, 'owner-grants');
+  private readonly ownerGrantUsageView = this.membershipView(OWNER_GRANT_USAGE_SELECT_SQL, 'owner-grant-usages');
+  /** Each membership view by the qualified table it copies, for {@link watchMembershipViews}, {@link watchMembershipTables} and {@link invalidateMembershipViews}. */
+  private readonly membershipViews = new Map<string, MembershipView<Record<string, SqlValue>>>([
+    ['CadreControl.Revocation', this.revocationView],
+    ['CadreControl.CadrePeer', this.cadrePeerView],
+    ['CadreControl.OwnerKey', this.ownerKeyView],
+    ['CadreControl.CadreInvite', this.cadreInviteView],
+    ['CadreControl.CadreInviteUsage', this.cadreInviteUsageView],
+    ['CadreControl.OwnerGrant', this.ownerGrantView],
+    ['CadreControl.OwnerGrantUsage', this.ownerGrantUsageView],
+  ]);
   /**
    * Locked write bodies currently running (see {@link runWriteBody}); what
    * {@link readRowsOnce} consults to route an unlocked read around a write that has
@@ -951,6 +1319,7 @@ export class ControlDatabase {
     }
 
     log('Initializing ControlDatabase for party: %s', this.config.partyId);
+    this.invalidateMembershipViews();
 
     // Create database instance
     this.db = new Database();
@@ -984,6 +1353,7 @@ export class ControlDatabase {
     registerPartyIdFunction(this.db, this.config.partyId);
 
     this.collectionFactory = pluginResult.collectionFactory;
+    this.txnBridge = pluginResult.txnBridge;
 
     // Inject the libp2p node into the collection factory
     t0 = performance.now();
@@ -1040,54 +1410,82 @@ export class ControlDatabase {
     await this.loadSchema();
     timing('[controlDb] loadSchema: %dms', Math.round(performance.now() - t0));
 
+    this.watchMembershipViews();
     this.initialized = true;
     log('ControlDatabase initialized successfully');
   }
 
-  private async loadSchema(): Promise<void> {
-    let schemaContent: string;
+  /**
+   * Drop a membership view whenever its table changes: a commit made here, or a change this
+   * node's storage takes in from elsewhere. `onInvalidate` is the whole consumer, so the run
+   * does nothing; no backstop, since {@link MEMBERSHIP_VIEW_MAX_AGE_MS} bounds what the
+   * subscription cannot hear. {@link close} disposes it with the rest.
+   */
+  private watchMembershipViews(): void {
+    this.tableWatches.watch(this.db!, [...this.membershipViews.keys()], () => Promise.resolve(), {
+      label: 'membership-view',
+      onInvalidate: (table) => this.membershipViews.get(table)?.invalidate(),
+    });
+  }
+
+  /**
+   * {@link watchTables} on the membership tables: the seven the membership views copy
+   * (`CadrePeer`, `OwnerKey`, `Revocation`, `CadreInvite`, `CadreInviteUsage`, `OwnerGrant`,
+   * `OwnerGrantUsage`), which are exactly what the membership gate and the owner-anchor sync
+   * read. `CadreNode.start` takes its gate watch here, so the gate hears every table its
+   * reads can depend on and no list of them lives outside this class.
+   */
+  watchMembershipTables(onChange: () => Promise<void>, options: TableChangeWatchOptions): TableChangeWatch {
+    return this.watchTables([...this.membershipViews.keys()], onChange, options);
+  }
 
+  /**
+   * Empty every membership view, so the next read of each loads afresh and no load in
+   * flight installs. Besides {@link initialize} and {@link close}, `CadreNode` calls it when
+   * a sibling becomes reachable (its identify on a new connection): a machine that was offline
+   * while that sibling committed learns of the commit only when it next reads the block from
+   * storage, and dropping the views makes the pass that starts then read now rather than after
+   * `MEMBERSHIP_VIEW_MAX_AGE_MS`.
+   */
+  invalidateMembershipViews(): void {
+    for (const view of this.membershipViews.values()) {
+      view.invalidate();
+    }
+  }
+
+  private async loadSchema(): Promise<void> {
+    let declaration: string;
     if (this.config.schemaPath) {
-      // Load from file if explicitly provided (for testing or custom schemas)
-      // This only works in Node.js environments
       log('Loading schema from file: %s', this.config.schemaPath);
-
-      // Check if we're in a Node.js environment
-      if (typeof process !== 'undefined' && process.versions?.node) {
-        try {
-          // Use require to conditionally load fs only in Node.js.
-          // This won't be bundled by React Native's Metro bundler — a dynamic
-          // import() would be statically picked up by Metro, so require is
-          // intentional here (cross-platform constraint, not lazy CommonJS).
-          // eslint-disable-next-line @typescript-eslint/no-require-imports
-          const fs = require('fs/promises');
-          schemaContent = await fs.readFile(this.config.schemaPath, 'utf-8');
-        } catch (error) {
-          throw new Error(
-            `Failed to load schema from ${this.config.schemaPath}: ${error instanceof Error ? error.message : String(error)}`,
-            { cause: error }
-          );
-        }
-      } else {
-        throw new Error(
-          'Loading schema from file is not supported in React Native. ' +
-          'Remove the schemaPath option to use the embedded schema instead.'
-        );
-      }
+      declaration = controlSchemaFileDeclaration(await readSchemaFile(this.config.schemaPath));
     } else {
-      // Use embedded schema for cross-platform compatibility
       log('Using embedded control schema');
-      schemaContent = CONTROL_SCHEMA;
+      declaration = CONTROL_SCHEMA_DECLARATION;
     }
 
+    // Declaring runs no DDL; it only records the declaration the check and the apply both read.
+    await this.db!.exec(declaration);
+    // The apply below is also the MIGRATION of a warm store written under an older control
+    // schema version: its diff runs each version's changes in order, every one applied to a
+    // table's catalog record without a row rewritten, and ends by recording this build's version
+    // on the store. A store the apply must not touch is refused HERE, before it runs anything: one
+    // a newer release migrated (this machine is the one to update), one from before migrations,
+    // or one whose diff would rewrite or discard rows (`control-schema-version.ts`).
+    await refuseIncompatibleControlStore(this.db!, this.config.partyId);
+    await this.applyControlSchema();
+    log('Schema loaded and executed');
+  }
+
+  /** Apply the declared control schema, retrying transient cohort failures. */
+  private async applyControlSchema(): Promise<void> {
     // Schema init is a DISTRIBUTED write, so it gets the same bounded transient-failure
     // retry every other control write does ({@link lockedWithRetry}). Every CadreControl
-    // table is optimystic-backed (the default vtab was routed to optimystic just above),
+    // table is optimystic-backed (`initialize` routes the default vtab to optimystic),
     // so each `create table` needs a super-majority of the party's peers to answer. On a
     // node joining a party that already has two live members a single unanswered peer
     // during any one create otherwise kills startup outright.
     //
-    // Re-running the WHOLE `exec` after a partial failure is safe, and this is the
+    // Re-running the apply after a partial failure is safe, and this is the
     // non-obvious part:
     //
     //  - `apply schema` is a DIFF, not a replay. Quereus collects the live catalog, diffs
@@ -1095,11 +1493,6 @@ export class ControlDatabase {
     //    exactly why `initialize` hydrates persisted optimystic schemas BEFORE getting here.
     //    A table the live catalog already lists generates no statements at all, which is what
     //    makes an apply over an already-complete schema (a warm start) a no-op.
-    //    NOTE: a table the catalog lists with DIFFERENT constraint text diffs to
-    //    `alter table ... drop constraint`, which the optimystic module refuses, so a store
-    //    written by a build with older constraint text fails here on every start (policy:
-    //    recreate, docs/architecture.md after the Control Network table). If backwards
-    //    compatibility becomes a requirement, this apply is the migration site.
     //  - a failed apply is taken back WHOLE (Quereus 4.20.0). The migration loop keeps an
     //    undo journal; when a step fails it runs that journal in reverse, re-renders the
     //    catalog, compares it against a fingerprint taken BEFORE the apply, and only then
@@ -1121,6 +1514,20 @@ export class ControlDatabase {
     // argument is a statement about the pair, not about Quereus alone — pinned by
     // `test/control-schema-apply-unwind.spec.ts`.
     //
+    // The same argument covers the statements a MIGRATION runs (`control-schema-version.ts`'s
+    // `catalog-only` kinds, from Optimystic 1.16.0): the plugin's `alterTable` arms (add column,
+    // drop column, add and drop CHECK) and the tag change write the table's catalog record under
+    // the batch's per-statement checkpoint, so a step that throws withdraws its own write, and a
+    // batch whose commit fails is discarded whole and the tables it wrote re-persist on their next
+    // touch. A change the record already holds — another machine migrated first — is adopted with
+    // nothing written, and an undo of an adopted change touches this machine's catalog only. The
+    // one arm Quereus marks irreversible is `drop column`: once it has run, a later failure
+    // unwinds nothing (the apply reports the schema as partially migrated), the plugin's
+    // `endSchemaBatch` commits the steps that landed — or, when that commit fails, marks their
+    // tables to re-persist on next touch — and the retry's diff runs only the steps still
+    // missing. No row is lost either way: rows keep a dropped column's field until they are
+    // rewritten, and nothing reads it.
+    //
     // Only the "cohort did not answer, nothing committed" class is retried; the classifier
     // vetoes indeterminate commits and does not match `Missing block`, which is a durable
     // convergence fault a retry cannot heal (tracked separately) and must keep propagating.
@@ -1132,8 +1539,7 @@ export class ControlDatabase {
     // also what lets schema init absorb optimystic's self-coordination grace refusal, which
     // is unsafe for control writes in general. Why, on
     // `RETRIABLE_SCHEMA_INIT_MATCHERS` in `control-write-retry.ts`.
-    await this.lockedWithRetry(() => this.db!.exec(schemaContent), SCHEMA_INIT_RETRY_POLICY, 'schema-init');
-    log('Schema loaded and executed');
+    await this.lockedWithRetry(() => this.db!.exec(APPLY_CONTROL_SCHEMA), SCHEMA_INIT_RETRY_POLICY, 'schema-init');
   }
 
   /**
@@ -1213,9 +1619,10 @@ export class ControlDatabase {
    * behind back-to-back local writes, narrow the count to the span from a body's first
    * statement to its transaction opening.
    */
-  private async readRowsOnce(sql: string, params: SqlParameters | undefined, underWriteLock: boolean): Promise<Record<string, SqlValue>[]> {
+  private async readRowsOnce(sql: string, params: SqlParameters | undefined, underWriteLock: boolean): Promise<RoutedRead> {
+    const committed = this.writeInFlight(underWriteLock);
     let iterator: AsyncIterableIterator<Record<string, SqlValue>>;
-    if (this.writeInFlight(underWriteLock)) {
+    if (committed) {
       log('read-eval: a write is in flight (%s), asking for a committed read: %s',
         this.db!.getAutocommit() ? 'locked body running, no transaction open yet' : 'transaction open', sql);
       iterator = this.db!.eval(sql, params, { readConcurrency: 'committed' });
@@ -1226,7 +1633,7 @@ export class ControlDatabase {
     for await (const row of iterator) {
       rows.push(row);
     }
-    return rows;
+    return { rows, committed };
   }
 
   /**
@@ -1286,12 +1693,26 @@ export class ControlDatabase {
    * held, and its membership read is opted out at {@link queryCadrePeers}. If another
    * under-lock callback seam is ever added, audit its read graph the same way.
    */
-  private readRows(
+  private async readRows(
     sql: string,
     params: SqlParameters | undefined,
     label: string,
     retry = true
   ): Promise<Record<string, SqlValue>[]> {
+    return (await this.readRowsRouted(sql, params, label, retry)).rows;
+  }
+
+  /**
+   * {@link readRows}, also saying whether the attempt that answered took the committed-read
+   * path — which a {@link MembershipView} load needs, since it may not keep such rows (see
+   * {@link membershipView}).
+   */
+  private readRowsRouted(
+    sql: string,
+    params: SqlParameters | undefined,
+    label: string,
+    retry: boolean
+  ): Promise<RoutedRead> {
     // `retry: false` marks the reads that may run inside a locked write body, which is
     // also what readRowsOnce's committed-read routing must know (see writeInFlight).
     // NOTE: the membership-gate refresh passes it on EVERY trigger, including the
@@ -1310,21 +1731,53 @@ export class ControlDatabase {
     );
   }
 
+  /**
+   * A view over one membership table, loaded by its full scan `sql` through {@link readRows}'s
+   * funnel. Rows a committed read served are never kept: that read may initialize an untouched
+   * table provisionally, and the Optimystic plugin arms a table's replicated-change bridge only
+   * on its full initialization (`OptimysticTable.initializeForCommittedRead`), so no later change
+   * event would ever drop them.
+   */
+  private membershipView(sql: string, label: string): MembershipView<Record<string, SqlValue>> {
+    return new MembershipView(async (retry) => {
+      const { rows, committed } = await this.readRowsRouted(sql, undefined, label, retry);
+      return { rows, installable: !committed };
+    });
+  }
+
+  /**
+   * A membership table's raw rows, from its {@link MembershipView}: `Revocation`, `CadrePeer`
+   * and `OwnerKey`, the tables every membership, owner and peer-record read starts from, and
+   * `CadreInvite`, `CadreInviteUsage`, `OwnerGrant` and `OwnerGrantUsage`, the chains every
+   * membership refresh verifies invitation-admitted machines and grant-seated owner keys through.
+   * Callers build fresh result objects from them and never mutate them.
+   *
+   * Reads the table directly instead when a caller under the write lock (`retry: false`) has an
+   * explicit transaction open: such a read sees the transaction's own uncommitted rows, which
+   * the view does not hold, and a rollback fires no change event, so keeping them would cache
+   * rows that never existed. No reader of these tables runs inside {@link inTransaction} today;
+   * this keeps one added later, or a spec's raw-handle transaction, correct.
+   *
+   * Reads that stay plain SQL on purpose: {@link queryStampId} (sees retired rows), the
+   * schema's CHECK constraints, which read inside the committing transaction, the redemption's
+   * one read of the held credential row ({@link queryCadreInvite},
+   * {@link queryOwnerGrant}), and the indexed usage counts.
+   */
+  private readMembershipRows(view: MembershipView<Record<string, SqlValue>>, retry: boolean): Promise<readonly Record<string, SqlValue>[]> {
+    this.ensureInitialized();
+    if (!retry && !this.db!.getAutocommit()) {
+      return view.readThrough(retry);
+    }
+    return view.read(retry);
+  }
+
   /**
    * Query all strands from the control database
    */
   async queryStrands(): Promise<StrandRow[]> {
     this.ensureInitialized();
-    const results: StrandRow[] = [];
-    for (const row of await this.readRows('select Id, MemberPrivateKey, Type, FounderOwnerKey from CadreControl.Strand', undefined, 'strands')) {
-      results.push({
-        Id: row.Id as string,
-        MemberPrivateKey: row.MemberPrivateKey as string | null,
-        Type: row.Type as 'o' | 'c',
-        FounderOwnerKey: row.FounderOwnerKey as string | null,
-      });
-    }
-    return results;
+    const rows = await this.readRows(`select ${STRAND_COLUMNS} from CadreControl.Strand`, undefined, 'strands');
+    return rows.map(strandRow);
   }
 
   /**
@@ -1335,25 +1788,26 @@ export class ControlDatabase {
    */
   async queryStrand(strandId: string): Promise<StrandRow | null> {
     this.ensureInitialized();
-    for (const row of await this.readRows(
-      'select Id, MemberPrivateKey, Type, FounderOwnerKey from CadreControl.Strand where Id = ?',
-      [strandId],
-      'strand'
-    )) {
-      return {
-        Id: row.Id as string,
-        MemberPrivateKey: row.MemberPrivateKey as string | null,
-        Type: row.Type as 'o' | 'c',
-        FounderOwnerKey: row.FounderOwnerKey as string | null,
-      };
-    }
-    return null;
+    const rows = await this.readRows(`select ${STRAND_COLUMNS} from CadreControl.Strand where Id = ?`, [strandId], 'strand');
+    return rows.length === 0 ? null : strandRow(rows[0]!);
+  }
+
+  /**
+   * {@link queryStrand} plus the row's `StampId`, in one read: the formation responder
+   * resolves a bound invite's host strand with it and later records consent against that
+   * stamp ({@link recordFormationUsage}'s `strandStampId`) without reading the row again.
+   */
+  async queryStrandWithStamp(strandId: string): Promise<(StrandRow & { StampId: string }) | null> {
+    this.ensureInitialized();
+    const rows = await this.readRows(
+      `select ${STRAND_COLUMNS}, StampId from CadreControl.Strand where Id = ?`, [strandId], 'strand-with-stamp');
+    return rows.length === 0 ? null : { ...strandRow(rows[0]!), StampId: rows[0]!.StampId as string };
   }
 
   /**
    * Every strand this party joined from another party (`CadreControl.JoinedStrand`), shaped
    * as a {@link StrandRow} so a reader can treat it like one of the party's own. A joiner
-   * never founds, so `FounderOwnerKey` is always null. Read raw, like {@link queryStrands}:
+   * never founds, so `FounderOwnerKey` and `FounderPeerId` are always null. Read raw, like {@link queryStrands}:
    * no retired-stamp filter.
    */
   async queryJoinedStrands(): Promise<StrandRow[]> {
@@ -1439,31 +1893,75 @@ export class ControlDatabase {
    *
    * Deliberately RAW (no retired-stamp filter, unlike {@link getOwnerKeys}): the genesis
    * insert is refused by the schema whenever any physical row exists, so this must see one.
+   * Served from the `OwnerKey` membership view ({@link readMembershipRows}), which holds every
+   * physical row, so a genesis caller's pre-check and {@link ensureOwnerKey}'s re-check share
+   * one storage read.
    */
   async hasOwnerKey(): Promise<boolean> {
     this.ensureInitialized();
-    for (const row of await this.readRows('select count(1) as Count from CadreControl.OwnerKey', undefined, 'owner-key-exists')) {
-      return (row.Count as number) > 0;
-    }
-    return false;
+    return (await this.readMembershipRows(this.ownerKeyView, true)).length > 0;
   }
 
   /**
    * Idempotent genesis: insert `key` as the founding owner key only when
    * the party has none yet. Returns true if it inserted, false if an owner
    * key already existed (so a repeat `--owner` start is a no-op).
+   *
+   * Before the insert, gives every control table its empty collection
+   * ({@link commitEmptyControlCollections}). A collection committed while a machine is alone
+   * forks if another machine creates the same collection independently; before genesis the
+   * party has no owner, so no other machine can have been admitted and none can hold any of
+   * its collections. The order makes the step repeatable: a crash between it and the insert
+   * leaves no `OwnerKey` row, so the next start runs genesis again and commits only the
+   * collections still missing, while a founder restart finds the row and commits nothing, so
+   * it can never write an empty second history beside a table another machine has since
+   * written. A failure propagates with nothing inserted.
+   *
+   * @param label - the user's name for the key ({@link insertOwnerKey}).
    */
-  async ensureOwnerKey(key: string): Promise<boolean> {
+  async ensureOwnerKey(key: string, label?: string): Promise<boolean> {
     this.ensureInitialized();
     const trimmed = requireEd25519PublicKeyB64(key, 'owner key');
     if (await this.hasOwnerKey()) {
       log('Owner key already present; skipping genesis insert');
       return false;
     }
-    await this.insertOwnerKey(trimmed);
+    // Two locked steps one after the other: the lock is not re-entrant, and the insert takes it itself.
+    await this.commitEmptyControlCollections();
+    await this.insertOwnerKey(trimmed, label);
     return true;
   }
 
+  /**
+   * Commit an empty collection for every `CadreControl` table, index tree and unique-enforcement
+   * tree that has none, so a read of a table nobody has written is answered from this machine's
+   * storage instead of asking the block's cohort to prove the collection absent — a round trip
+   * per read on a party of several machines, and an error or a wait while they are offline.
+   * Joining machines get these collections the ordinary way, by reading them from the cohort.
+   *
+   * Under the write lock: the helper commits whatever is staged in those collections outside any
+   * SQL transaction, which is sound only while nothing else writes.
+   *
+   * Parties founded before this step, and tables a later control schema version adds, have no
+   * such collections, and nothing creates them later: the start-time schema apply runs on every
+   * machine, possibly alone, where committing one would be exactly the fork genesis avoids.
+   *
+   * NOTE: one `sync()` per collection, in sequence: 32 collections for today's schema (17 tables,
+   * 3 indexes, 12 `unique` columns). Measured 2026-10-20 on a lone `CadreNode` over the network
+   * transactor (started, then `ensureOwnerKey` alone, 3 runs each): 64–105 ms in memory and
+   * 750–820 ms on `FileRawStorage`, about 25 ms per collection on disk, roughly 1/75 of the edge
+   * node's 60 s `DEFAULT_OWNER_GENESIS_TIMEOUT_MS`. Under the whole cadre-core suite's load (151
+   * geneses) it took a median of 159 ms and at most 4.6 s. If genesis latency starts to matter
+   * (phone flash under launch contention runs 50–90 ms per storage operation, see the NOTE in
+   * `initialize`), ask Optimystic for an API that commits them as one batch, the one strand
+   * founding would use too; do not build a private batching path.
+   */
+  private async commitEmptyControlCollections(): Promise<void> {
+    const t0 = performance.now();
+    const committed = await this.withWriteLock(() => createEmptyCollections(this.db!, this.txnBridge!, [CONTROL_SCHEMA_NAME]));
+    log('Committed %d empty control collections in %dms', committed, Math.round(performance.now() - t0));
+  }
+
   /**
    * Collect every owner key (`CadreControl.OwnerKey.Key`) as a set.
    *
@@ -1491,8 +1989,9 @@ export class ControlDatabase {
   }
 
   /**
-   * Every live `OwnerKey` row with its persisted proof ({@link OwnerKeyRow}) — what the
-   * trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`). Rows whose
+   * Every live `OwnerKey` row with its label and persisted proof ({@link OwnerKeyRow}) — what
+   * the trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`) and the owner-key
+   * listing shows (`CadreNode.listOwnerKeys`). Rows whose
    * `StampId` is retired in `CadreControl.Revocation` are excluded here, as
    * {@link queryCadrePeers} excludes them and for the reason on {@link getOwnerKeys}, which
    * reads through this. A row with no stamp (the schema permits it; no writer produces one)
@@ -1504,16 +2003,14 @@ export class ControlDatabase {
    *
    * @param retired - the retired `OwnerKey` stamps, when the caller has already read the
    *   tombstones (`CadreNode.syncOwnerAnchor` reads {@link queryRevocations} for their
-   *   signers); omitted, they are read here. Before the ledger marker is filed every
-   *   `Revocation` read is a cohort consult, so the sync passing its own set keeps the
-   *   membership refresh at one such read for the anchor.
+   *   signers); omitted, they are read here. Both come from the same `Revocation` view
+   *   ({@link readMembershipRows}), so passing the set saves only the filtering.
    */
   async queryOwnerKeyRows(retry = true, retired?: ReadonlySet<string>): Promise<OwnerKeyRow[]> {
     this.ensureInitialized();
     const revoked = retired ?? await this.queryRevokedStamps('OwnerKey', retry);
     const rows: OwnerKeyRow[] = [];
-    const sql = 'select Key, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.OwnerKey';
-    for (const row of await this.readRows(sql, undefined, 'owner-keys', retry)) {
+    for (const row of await this.readMembershipRows(this.ownerKeyView, retry)) {
       const stampId = (row.StampId as string | null) ?? null;
       if (stampId === null) {
         log('queryOwnerKeyRows: dropping OwnerKey row %s with no StampId', row.Key);
@@ -1524,6 +2021,7 @@ export class ControlDatabase {
       }
       rows.push({
         key: row.Key as string,
+        label: (row.Label as string | null) ?? null,
         stampId,
         vouchOwner: (row.VouchOwner as string | null) ?? null,
         vouchSig: (row.VouchSig as string | null) ?? null,
@@ -1545,12 +2043,8 @@ export class ControlDatabase {
    * {@link queryRevokedStamps} rather than inlining the SQL, so tests can interpose on
    * that seam to model the replicated live-row-plus-tombstone merge state.
    *
-   * NOTE: runs a second query (the retired-stamp set) per call, on the membership-gate
-   * refresh path. Its cost is storage consults, not rows (see {@link queryRevokedStamps}):
-   * while `Revocation` has never been written every call consults the cohort about it, and
-   * the ledger marker ({@link openRevocationLedger}) is what makes it a held block. Folding
-   * the exclusion into one statement would not help (it reads the same block), and caching
-   * the set would hide a tombstone arriving by replication.
+   * Both tables come from their membership views ({@link readMembershipRows}), so a call after
+   * the first costs no storage read until one of the two tables changes.
    *
    * NOTE: this filter is HAND-MIRRORED by the gate suites' fake control databases
    * (`test/membership-gate-helpers.ts` and `test/cadre-node-authorized-surface.spec.ts`),
@@ -1573,43 +2067,28 @@ export class ControlDatabase {
     this.ensureInitialized();
     const revoked = await this.queryRevokedStamps('CadrePeer', retry);
     const rows: CadrePeerRow[] = [];
-    // The proof columns lead and the record columns follow, so this scan keeps a prefix no
-    // other `CadrePeer` statement shares (`queryPeerRecord` starts `PeerId, PublicKey`): the
-    // read-retry spec rigs the membership scan by that prefix.
-    const sql = 'select PeerId, Multiaddr, StampId, VouchOwner, VouchSig, VouchUsage, PublicKey, UpdatedAt, Profile, Sig from CadreControl.CadrePeer';
-    for (const row of await this.readRows(sql, undefined, 'cadre-peers', retry)) {
-      const stampId = (row.StampId as string | null) ?? null;
-      if (stampId !== null && revoked.has(stampId)) {
+    for (const row of await this.readMembershipRows(this.cadrePeerView, retry)) {
+      const peer = cadrePeerRowOf(row);
+      if (peer.stampId !== null && revoked.has(peer.stampId)) {
         continue;
       }
-      rows.push({
-        peerId: row.PeerId as string,
-        publicKey: (row.PublicKey as string | null) ?? null,
-        multiaddr: (row.Multiaddr as string | null) ?? null,
-        updatedAt: (row.UpdatedAt as number | null) ?? 0,
-        profile: (row.Profile as NodeProfile | null) ?? null,
-        sig: (row.Sig as string | null) ?? null,
-        stampId,
-        vouchOwner: (row.VouchOwner as string | null) ?? null,
-        vouchSig: (row.VouchSig as string | null) ?? null,
-        vouchUsage: (row.VouchUsage as string | null) ?? null,
-      });
+      rows.push(peer);
     }
     return rows;
   }
 
   /**
    * The cadre's peers as a seed or a redemption reply carries them: every live `CadrePeer`
-   * row with its addresses, each flagged `isOwner` when the key behind its peer id is in
-   * the replicated `OwnerKey` table ({@link projectSeedPeers}).
+   * row with its addresses, the minter and every always-on machine marked preferred
+   * ({@link projectSeedPeers}).
    *
    * Read through {@link queryCadrePeers}, never a raw `CadrePeer` select, so a removed
    * member's addresses are never packed into a seed or handed to a redeeming device as a
    * dial hint: a revoked peer is off the addressable surface everywhere, and this is one of
    * its exits.
    */
-  async querySeedPeers(): Promise<SeedPeer[]> {
-    return projectSeedPeers(await this.queryCadrePeers(), await this.getOwnerKeys());
+  async querySeedPeers(minterPeerId: string): Promise<SeedPeer[]> {
+    return projectSeedPeers(await this.queryCadrePeers(), minterPeerId);
   }
 
   /**
@@ -1650,10 +2129,11 @@ export class ControlDatabase {
    * guard. A read retrying there would sleep its backoff HOLDING the write lock
    * (`retryControlWrite`'s contract is that backoff sleeps happen with no lock held), and
    * the write funnel already re-runs the body's reads when it re-runs the body. The
-   * unlocked callers — the public stamp readers, {@link reauthorizeCadrePeer} and
-   * {@link reapRevokedRow}, whose stamp reads run BEFORE their locks are taken — keep the
-   * default retried path. Explicit per call rather than an ambient flag: unlocked reads
-   * run concurrently with a locked body, so `this`-state cannot tell the two apart.
+   * unlocked callers — the public stamp readers and {@link reapRevokedRow}, whose stamp
+   * read runs BEFORE its lock is taken — keep the default retried path. Explicit per call
+   * rather than an ambient flag: unlocked reads run concurrently with a locked body, so
+   * `this`-state cannot tell the two apart. The same flag threads through
+   * {@link findCadrePeerRow} for the two writers that read the whole row inside their body.
    */
   private async queryStampId(
     table: RevocableTable,
@@ -1671,8 +2151,8 @@ export class ControlDatabase {
   /**
    * `CadrePeer` stamp nonce — read by {@link SeedBootstrapService.removePeer} as its
    * row-present gate before it delegates to {@link deleteCadrePeer}. The in-class
-   * `CadrePeer` writers ({@link insertCadrePeer}, {@link reauthorizeCadrePeer}) go
-   * straight to {@link queryStampId}.
+   * `CadrePeer` writers go straight to {@link queryStampId} ({@link insertCadrePeer}) or read
+   * the whole row ({@link reauthorizeCadrePeer}, through {@link findCadrePeerRow}).
    */
   queryCadrePeerStampId(peerId: string): Promise<string | null> {
     return this.queryStampId('CadrePeer', peerId);
@@ -1738,18 +2218,17 @@ export class ControlDatabase {
    * ({@link queryCadrePeers}, {@link queryPeerRecord},
    * {@link CadreNode.resolveDeviceToken}) drop any row whose stamp appears here.
    *
-   * NOTE: the per-call cost that matters is the storage layer's, not the row count. While
-   * `Revocation` has never been written, this node does not hold its block, and Optimystic
-   * consults a block's cohort on every read of a block it does not hold: 1 consult per
-   * call (measured), each a round trip to every other member on a multi-machine party. The
-   * ledger marker ({@link openRevocationLedger}) ends that — a held block is re-consulted
-   * at most once per read-repair window (10 s). Do not cache the set instead: a cache
-   * cannot see a tombstone arriving by replication, so it would delay a revocation. The
-   * row count only grows (append-only) but stays small while removals are rare; revisit if
+   * Served from the `Revocation` membership view ({@link readMembershipRows}), dropped by
+   * every change to the table, local or replicated into this node's storage, so a tombstone
+   * arriving by replication is seen on the next call. The cost that matters is the storage
+   * layer's, paid by a cold view's load: while `Revocation` has never been written, this node
+   * does not hold its block, and Optimystic consults a block's cohort on every read of a block
+   * it does not hold, each a round trip to every other member on a multi-machine party. The row
+   * count only grows (append-only) but stays small while removals are rare; revisit if
    * removals become routine and the scan itself shows up in a profile.
    *
    * An isolated node that has never received the `Revocation` block reads it as holding no
-   * revocations instead of throwing — see {@link readRevokedStampRows}.
+   * revocations instead of throwing — see {@link readRevocationRowsOrNone}.
    *
    * `retry: false` is forwarded by {@link queryCadrePeers} for the one caller that reads
    * under the write lock — see that method's note.
@@ -1757,22 +2236,26 @@ export class ControlDatabase {
   async queryRevokedStamps(tableName: RevocableTable, retry = true): Promise<Set<string>> {
     this.ensureInitialized();
     const stamps = new Set<string>();
-    for (const row of await this.readRevokedStampRows(tableName, retry)) {
-      stamps.add(row.StampId as string);
+    for (const row of await this.readRevocationRowsOrNone(retry)) {
+      if (row.TableName === tableName) {
+        stamps.add(row.StampId as string);
+      }
     }
     return stamps;
   }
 
   /**
-   * The `Revocation` scan behind {@link queryRevokedStamps}, answering NO ROWS when the read
-   * fails `cohort-unreachable` ({@link isCohortUnreachableRead}): this node does not hold
+   * The `Revocation` rows behind {@link queryRevokedStamps}, answering NO ROWS when the view's
+   * load fails `cohort-unreachable` ({@link isCohortUnreachableRead}): this node does not hold
    * the block and could ask no other cohort member about it. Every other failure rethrows.
    * The retry in {@link readRows} runs first, so a node whose connectivity returns within
-   * the read budget still gets the real answer.
+   * the read budget still gets the real answer. The empty answer is never installed in the
+   * view (a failed load keeps nothing), so the next call asks again.
    *
    * Without this, a machine cut off from every other machine in its party before it ever
-   * received the block — the block does not exist anywhere until the owner files the
-   * ledger marker ({@link openRevocationLedger}) on a connected reconcile pass — cannot
+   * received the block — a joining machine gets it only by reading it from the cohort, and
+   * on a party founded before genesis created every control collection it exists nowhere
+   * until the first tombstone or the marker ({@link REVOCATION_LEDGER_MARKER}) — cannot
    * answer ANY membership, peer-record or device-token lookup, although it holds those
    * rows locally.
    *
@@ -1791,19 +2274,19 @@ export class ControlDatabase {
    *
    * NOTE: an isolated node pays the whole read retry (up to
    * `CONTROL_READ_RETRY_BUDGET_MS`, plus the slow attempt that exhausted it) before this
-   * answers, and {@link queryPeerRecord} then issues its row scan on top. If an isolated
-   * node's lookups are seen exceeding the admission gate's 2 s deadline
-   * (`ADMISSION_DECISION_TIMEOUT_MS`), skip the retry for this read when the first attempt
-   * fails `cohort-unreachable`.
+   * answers, on every call since the answer is not kept, and {@link queryPeerRecord} may then
+   * load the `CadrePeer` view on top. If an isolated node's lookups are seen exceeding the
+   * admission gate's 2 s deadline (`ADMISSION_DECISION_TIMEOUT_MS`), skip the retry for this
+   * read when the first attempt fails `cohort-unreachable`.
    */
-  private async readRevokedStampRows(tableName: RevocableTable, retry: boolean): Promise<Record<string, SqlValue>[]> {
+  private async readRevocationRowsOrNone(retry: boolean): Promise<readonly Record<string, SqlValue>[]> {
     try {
-      return await this.readRows('select StampId from CadreControl.Revocation where TableName = ?', [tableName], 'revoked-stamps', retry);
+      return await this.readMembershipRows(this.revocationView, retry);
     } catch (error) {
       if (!isCohortUnreachableRead(error)) {
         throw error;
       }
-      log('revoked-stamps(%s): no cohort member reachable and the Revocation block is not held here; reading as no revocations known: %s', tableName, error);
+      log('revoked-stamps: no cohort member reachable and the Revocation block is not held here; reading as no revocations known: %s', error);
       return [];
     }
   }
@@ -1816,10 +2299,10 @@ export class ControlDatabase {
    * `where`, so the composite-primary-key point-lookup hazard (see the statement comment in
    * {@link reissueRevocations}) does not arise. Unlocked, like every other read.
    *
-   * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}): it retires nothing, so
-   * neither sweep may reap or re-sign it, and skipping it keeps `RevocationRow.tableName`
-   * a {@link RevocableTable}. Filtered on `TableName` alone, in TypeScript: `RowIsGone`
-   * admits no other row under `'Revocation'`.
+   * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}) an older party may hold: it
+   * retires nothing, so neither sweep may reap or re-sign it, and skipping it keeps
+   * `RevocationRow.tableName` a {@link RevocableTable}. Filtered on `TableName` alone, in
+   * TypeScript: `RowIsGone` admits no other row under `'Revocation'`.
    *
    * `retry: false` from a caller that reads under the write lock, for the reason on
    * {@link queryCadrePeers}.
@@ -1827,25 +2310,17 @@ export class ControlDatabase {
   async queryRevocations(retry = true): Promise<RevocationRow[]> {
     this.ensureInitialized();
     const rows: RevocationRow[] = [];
-    const sql = 'select TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig from CadreControl.Revocation';
-    for (const row of await this.readRows(sql, undefined, 'revocations', retry)) {
-      if (row.TableName === REVOCATION_LEDGER_MARKER.tableName) {
-        continue;
+    for (const row of await this.readMembershipRows(this.revocationView, retry)) {
+      if (row.TableName !== REVOCATION_LEDGER_MARKER.tableName) {
+        rows.push(revocationRowOf(row));
       }
-      rows.push({
-        tableName: row.TableName as RevocableTable,
-        rowKey: row.RowKey as string,
-        stampId: row.StampId as string,
-        reissuedAt: (row.ReissuedAt as number | null) ?? 0,
-        signerKey: row.SignerKey as string,
-        signerSig: row.SignerSig as string,
-      });
     }
     return rows;
   }
 
   /**
-   * Read a single peer's address record (the full `CadrePeer` row) by PeerId.
+   * Read a single peer's address record (the full `CadrePeer` row) by PeerId, found in the
+   * `CadrePeer` membership view ({@link readMembershipRows}).
    *
    * Returns null when no row exists, or when the row's `StampId` is retired in
    * `CadreControl.Revocation` — a revoked peer reads as absent, so the resolver
@@ -1861,34 +2336,36 @@ export class ControlDatabase {
    * The split `addrs` re-join to the exact stored `Multiaddr` (split-on-`,` is
    * the inverse of join-on-`,`), so the resolver re-verifies over the same bytes
    * the publisher signed.
+   *
+   * `retry: false` from the one caller that reads under the write lock,
+   * {@link updateSelfPeerRecord}'s body, for the reason on {@link queryCadrePeers}.
+   */
+  async queryPeerRecord(peerId: string, retry = true): Promise<PeerAddressRecord | null> {
+    const row = await this.findCadrePeerRow(peerId, retry);
+    return row === null ? null : peerAddressRecordOf(row);
+  }
+
+  /**
+   * One readable `CadrePeer` row by PeerId from the membership view, or null when no row exists
+   * or its stamp is retired in `Revocation` — the single-row read behind {@link queryPeerRecord}
+   * and the two writers that decide over the row inside their locked body
+   * ({@link updateSelfPeerRecord}, {@link reauthorizeCadrePeer}). Same retired-stamp rule as
+   * {@link queryCadrePeers}, and the same `retry` contract.
    */
-  async queryPeerRecord(peerId: string): Promise<PeerAddressRecord | null> {
+  private async findCadrePeerRow(peerId: string, retry: boolean): Promise<CadrePeerRow | null> {
     this.ensureInitialized();
-    const revoked = await this.queryRevokedStamps('CadrePeer');
-    for (const row of await this.readRows(
-      'select PeerId, PublicKey, Multiaddr, UpdatedAt, Profile, Sig, StampId from CadreControl.CadrePeer where PeerId = ?',
-      [peerId],
-      'peer-record'
-    )) {
-      const stampId = (row.StampId as string | null) ?? null;
-      if (stampId !== null && revoked.has(stampId)) {
-        return null;
-      }
-      const multiaddr = (row.Multiaddr as string | null) ?? '';
-      return {
-        peerId: row.PeerId as string,
-        publicKey: (row.PublicKey as string | null) ?? '',
-        addrs: multiaddr.length > 0 ? multiaddr.split(',') : [],
-        updatedAt: (row.UpdatedAt as number | null) ?? 0,
-        profile: (row.Profile as NodeProfile | null) ?? null,
-        sig: (row.Sig as string | null) ?? '',
-      };
+    const revoked = await this.queryRevokedStamps('CadrePeer', retry);
+    const row = (await this.readMembershipRows(this.cadrePeerView, retry)).find((candidate) => candidate.PeerId === peerId);
+    if (row === undefined) {
+      return null;
     }
-    return null;
+    const peer = cadrePeerRowOf(row);
+    return peer.stampId !== null && revoked.has(peer.stampId) ? null : peer;
   }
 
   /**
-   * Apply a peer's own self-signed address-record update to an existing row.
+   * Apply a peer's own self-signed address-record update to its existing row: read the row
+   * under the write lock, have `sign` build the record over it, and write that record.
    *
    * Authorization is carried entirely by the record: the `Sig` column (verified
    * by the `AuthorizedUpdate` self-branch against the stored `PublicKey`) plus
@@ -1897,6 +2374,21 @@ export class ControlDatabase {
    * exists. `PublicKey` is intentionally not in the SET list (it is immutable on
    * self-update and the constraint enforces `new.PublicKey = old.PublicKey`).
    *
+   * The read, the decision and the signature all run INSIDE the locked body, which is what
+   * lets it opt into {@link LOST_UPDATE_RETRY_POLICY}: the row has a second writer, the owner's
+   * re-touch ({@link reauthorizeCadrePeer}), and the two fire together while a cadre starts.
+   * When this write loses that race the commit is refused as a lost update and re-run, and the
+   * re-run reads the row the rival left — including its bumped `UpdatedAt`, which a record
+   * signed before the race could no longer exceed — and signs past it. A record signed outside
+   * the body would be re-presented unchanged and refused again, this time by the schema's
+   * monotonic rule, which is correctly never retried. The row's read inside is `retry: false`
+   * (see {@link queryStampId}'s NOTE).
+   *
+   * Returns the record actually written, so the caller's bookkeeping describes the row rather
+   * than the first record it signed; null, and nothing written, when no readable row exists:
+   * the row is absent, or its stamp is retired in `Revocation` (a revoked node reads its own row
+   * as absent every heartbeat, and must not refresh it).
+   *
    * Deliberately NOT wrapped in {@link mutateCadrePeer}, the one `CadrePeer` mutator that
    * is not: it only ever touches THIS node's own row (sole caller
    * `CadreNode.publishSelfRecord`), and `CadreNode.listAuthorizedMembers` filters self out
@@ -1909,17 +2401,42 @@ export class ControlDatabase {
    * row, and a self insert happens once at startup, so the wasted refresh is a single read
    * — cheaper than a conditional carve-out inside the shared writer. Only the repeating
    * path is worth exempting.
+   *
+   * @param peerId - the row to refresh: this node's own.
+   * @param sign - builds the signed record over the row as read; called once per attempt.
    */
-  async updateSelfPeerRecord(record: PeerAddressRecord): Promise<void> {
+  async updateSelfPeerRecord(peerId: string, sign: SelfRecordSigner): Promise<PeerAddressRecord | null> {
     this.ensureInitialized();
-    const multiaddr = record.addrs.join(',');
-    await this.execWrite(`
-      update CadreControl.CadrePeer
-        with context OwnerKey = null, Signature = ?
-        set Multiaddr = ?, UpdatedAt = ?, Profile = ?, Sig = ?
-        where PeerId = ?
-    `, [record.sig, multiaddr, record.updatedAt, record.profile, record.sig, record.peerId], 'self-record-update');
-    log('Self peer record updated: %s (updatedAt=%d)', record.peerId, record.updatedAt);
+    const written = await this.lockedWithRetry(async () => {
+      // retry: false — inside the locked write body (see queryStampId's NOTE).
+      // NOTE: this read of the Revocation and CadrePeer views is charged to the retry budget,
+      // so a cold view load that waits out a per-peer read deadline leaves the attempt no room
+      // for its one retry (the 14.7 s abandonment the policy's doc cites). The caller's read
+      // outside the funnel warms the views, so this is a cache hit except when a table change
+      // between the two reads dropped them — the racing case itself. If that residual ever
+      // matters, measure which phase of the losing attempt pays the deadline first; the
+      // retired-stamp check cannot simply move outside, since `publishSelfRecord`'s insert
+      // path reads a revoked node's row as absent and relies on this body to skip it.
+      const current = await this.queryPeerRecord(peerId, false);
+      if (current === null) {
+        return null;
+      }
+      const record = sign(current);
+      // Bare `exec` — inside the non-re-entrant write lock (see insertCadrePeer).
+      await this.db!.exec(`
+        update CadreControl.CadrePeer
+          with context OwnerKey = null, Signature = ?
+          set Multiaddr = ?, UpdatedAt = ?, Profile = ?, Sig = ?
+          where PeerId = ?
+      `, [record.sig, record.addrs.join(','), record.updatedAt, record.profile, record.sig, peerId]);
+      return record;
+    }, LOST_UPDATE_RETRY_POLICY, 'self-record-update');
+    if (written === null) {
+      log('Self peer record not updated: no readable CadrePeer row for %s (absent, or its stamp retired)', peerId);
+    } else {
+      log('Self peer record updated: %s (updatedAt=%d)', peerId, written.updatedAt);
+    }
+    return written;
   }
 
   /**
@@ -1978,9 +2495,13 @@ export class ControlDatabase {
 
   /**
    * Insert the initial owner key (bootstrap - no existing owners required)
+   *
+   * @param label - the user's name for the key, at most {@link OWNER_KEY_MAX_LABEL}
+   *   characters once trimmed; blank is stored as none.
    */
-  async insertOwnerKey(key: string): Promise<void> {
+  async insertOwnerKey(key: string, label?: string): Promise<void> {
     this.ensureInitialized();
+    const storedLabel = ownerKeyLabel(label);
     log('Inserting owner key: %s', key);
 
     // Bootstrap is authorized by the schema's genesis branch — `(select count(1) from
@@ -1993,10 +2514,10 @@ export class ControlDatabase {
     // optimystic `StampId()` SQL function.
     const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
     await this.execWrite(`
-      insert into CadreControl.OwnerKey (Key, StampId)
+      insert into CadreControl.OwnerKey (Key, Label, StampId)
         with context OwnerKey = null, Signature = null
-        values (?, ?)
-    `, [key, stampId], 'owner-key-insert');
+        values (?, ?, ?)
+    `, [key, storedLabel, stampId], 'owner-key-insert');
     log('Owner key inserted');
   }
 
@@ -2004,57 +2525,85 @@ export class ControlDatabase {
    * Owner-signed INSERT of a further `OwnerKey` row, notifying the membership listener once
    * it has committed. The signed-add branch of `OwnerKey.Authorized`: the signer must be an
    * owner in the pre-transaction snapshot, its signature covers the `'add'` digest over
-   * (Key, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a reader
-   * can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
+   * (Key, Label, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a
+   * reader can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
    *
    * Through {@link mutateCadrePeer}, the membership hub. The liveness read, the stamp and the
    * signature all sit inside the locked body: a {@link lockedWithRetry} re-run starts over a
    * rolled-back attempt with a fresh stamp, as {@link redeemCadreInvite} does.
    *
-   * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
-   * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
-   * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
-   * would collide on the primary key. Re-add from the machine that removed the key, or any
-   * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
-   * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
-   *
+   * @param label - the user's name for the key, as {@link insertOwnerKey}'s.
    * @returns `true` when this call seated the row, `false` when `key` is already a live owner
-   *   here (nothing written).
-   * @throws when this node holds `key`'s row under a retired stamp (above), or when the
-   *   schema refuses the signer.
+   *   here (nothing written, whatever its label).
+   * @throws when this node holds `key`'s row under a retired stamp
+   *   ({@link liveOwnerKeyStamp}), or when the schema refuses the signer.
    */
   async insertOwnerKeyVouched(
     key: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign,
+    label?: string | null
   ): Promise<boolean> {
     this.ensureInitialized();
+    const storedLabel = ownerKeyLabel(label);
     return await this.mutateCadrePeer('owner-key-add', async () => {
-      // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
-      const heldStamp = await this.queryStampId('OwnerKey', key, false);
-      if (heldStamp !== null) {
-        if (!(await this.queryRevokedStamps('OwnerKey', false)).has(heldStamp)) {
-          log('insertOwnerKeyVouched: %s is already an owner; nothing written', key);
-          return false;
-        }
-        throw new Error(
-          `Cannot re-add owner key ${key} here: this node still holds the row it was removed under ` +
-          '(OwnerKey rows are not reaped); re-add it from the machine that removed it'
-        );
+      if (await this.liveOwnerKeyStamp(key) !== null) {
+        log('insertOwnerKeyVouched: %s is already an owner; nothing written', key);
+        return false;
       }
       const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
-      const signature = signMessage(ownerKeyAddMessage(this.config.partyId, key, stampId));
-      // Bare `exec`: already inside the write lock, which is NOT re-entrant.
-      await this.db!.exec(`
-        insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
-          with context OwnerKey = ?, Signature = ?
-          values (?, ?, ?, ?)
-      `, [ownerKey, signature, key, stampId, ownerKey, signature]);
+      const signature = await signMessage(ownerKeyAddMessage(this.config.partyId, key, storedLabel, stampId));
+      await this.execOwnerKeyVouchedInsert({ key, label: storedLabel, stampId }, ownerKey, signature);
       log('Owner key %s added (vouched by %s)', key, ownerKey);
       return true;
     });
   }
 
+  /**
+   * The stamp of `key`'s live `OwnerKey` row here, or null when this node holds none: the
+   * insert-if-absent read of {@link insertOwnerKeyVouched} and {@link redeemOwnerGrant}. Inside
+   * the locked body (both reads `retry: false`; see queryStampId's NOTE).
+   *
+   * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
+   * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
+   * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
+   * would collide on the primary key. Re-add from the machine that removed the key, or any
+   * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
+   * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
+   *
+   * @throws when this node holds `key`'s row under a retired stamp (above).
+   */
+  private async liveOwnerKeyStamp(key: string): Promise<string | null> {
+    const heldStamp = await this.queryStampId('OwnerKey', key, false);
+    if (heldStamp === null) {
+      return null;
+    }
+    if ((await this.queryRevokedStamps('OwnerKey', false)).has(heldStamp)) {
+      throw new Error(
+        `Cannot re-add owner key ${key} here: this node still holds the row it was removed under ` +
+        '(OwnerKey rows are not reaped); re-add it from the machine that removed it'
+      );
+    }
+    return heldStamp;
+  }
+
+  /**
+   * The signed-add statement of {@link insertOwnerKeyVouched} and {@link revouchOwnerKey}, the
+   * stored voucher being the signing pair. Bare `exec`: callers hold the write lock, which is
+   * NOT re-entrant.
+   */
+  private async execOwnerKeyVouchedInsert(
+    row: { key: string; label: string | null; stampId: string },
+    ownerKey: string,
+    signature: string
+  ): Promise<void> {
+    await this.db!.exec(`
+      insert into CadreControl.OwnerKey (Key, Label, StampId, VouchOwner, VouchSig)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?)
+    `, [ownerKey, signature, row.key, row.label, row.stampId, ownerKey, signature]);
+  }
+
   /**
    * Owner-signed removal of one `OwnerKey` row plus the `Revocation` tombstone retiring its
    * stamp, notifying the membership listener once it has committed. The remove branch of
@@ -2075,7 +2624,7 @@ export class ControlDatabase {
   async deleteOwnerKey(
     key: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     if (key === ownerKey) {
       throw new Error(`Cannot remove owner key ${key}: an owner cannot remove itself`);
@@ -2097,14 +2646,14 @@ export class ControlDatabase {
   /**
    * Re-vouch a live `OwnerKey` row under this owner's signature: in ONE transaction, the
    * current row's guarded delete plus tombstone ({@link deleteOwnerKey}'s body) and an insert
-   * of the same key under a fresh stamp, signed by `ownerKey` ({@link insertOwnerKeyVouched}'s
-   * body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
+   * of the same key and label under a fresh stamp, signed by `ownerKey`
+   * ({@link insertOwnerKeyVouched}'s body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
    * this is the only way to rebind a row's voucher; the anchor derivation lets the re-add
    * under a fresh stamp beat the older tombstone (`deriveOwnerAnchor`). For
-   * {@link removeMachine}: the owners a machine being removed had added keep their anchor
-   * place everywhere once their row stands on a remaining owner's signature.
+   * `CadreNode.removeOwner`: the owners a key being removed had added keep their anchor place
+   * everywhere once their row stands on a remaining owner's signature.
    *
-   * Through {@link mutateCadrePeer}, the membership hub. The stamp read runs inside the locked
+   * Through {@link mutateCadrePeer}, the membership hub. The row read runs inside the locked
    * body; a row whose stamp is already retired (held without its delete) is reported as absent
    * rather than tombstoned twice.
    *
@@ -2114,70 +2663,66 @@ export class ControlDatabase {
   async revouchOwnerKey(
     key: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     if (key === ownerKey) {
       throw new Error(`Cannot re-vouch owner key ${key}: an owner cannot re-vouch itself`);
     }
     return await this.mutateCadrePeer('owner-key-revouch', async () => {
-      // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
-      const stampId = await this.queryStampId('OwnerKey', key, false);
-      if (stampId === null || (await this.queryRevokedStamps('OwnerKey', false)).has(stampId)) {
+      // retry: false — inside the locked write body (see queryStampId's NOTE).
+      const live = (await this.queryOwnerKeyRows(false)).find((row) => row.key === key);
+      if (live === undefined) {
         log('revouchOwnerKey: %s is not a live owner here (nothing to re-vouch)', key);
         return false;
       }
-      const removal = signGuardedRemoval(this.config.partyId, 'OwnerKey', key, stampId, signMessage);
-      const freshStampId = generateStampId(this.config.libp2pNode.peerId.toString());
-      const signature = signMessage(ownerKeyAddMessage(this.config.partyId, key, freshStampId));
+      const removal = await signGuardedRemoval(this.config.partyId, 'OwnerKey', key, live.stampId, signMessage);
+      const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
+      const signature = await signMessage(ownerKeyAddMessage(this.config.partyId, key, live.label, stampId));
       await this.inTransaction('revouch OwnerKey', async () => {
         await this.execGuardedRemoval(removal, ownerKey);
-        await this.db!.exec(`
-          insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
-            with context OwnerKey = ?, Signature = ?
-            values (?, ?, ?, ?)
-        `, [ownerKey, signature, key, freshStampId, ownerKey, signature]);
+        await this.execOwnerKeyVouchedInsert({ key, label: live.label, stampId }, ownerKey, signature);
       });
-      log('Owner key %s re-vouched by %s (stamp %s retired)', key, ownerKey, stampId);
+      log('Owner key %s re-vouched by %s (stamp %s retired)', key, ownerKey, live.stampId);
       this.notifyGuardedDelete(removal.ref);
       return true;
     });
   }
 
   /**
-   * Remove one machine completely, in ONE transaction: its `CadrePeer` row, its `OwnerKey`
-   * row when `target.ownerKey` names one, its `DeviceToken` row when it has one, each with
-   * the `Revocation` tombstone retiring its stamp ({@link deleteGuardedRow}'s statement pair,
-   * composed bare as {@link deleteStrandAndPartyKey} composes it), plus a withdrawal tombstone
-   * for every `CadreInvite` in `target.inviteKeys` that is still live here
-   * ({@link withdrawCadreInvite}'s body). One transaction so no reader sees the machine half
-   * removed: a row gone but its push token resolvable, or its owner key gone but an invitation
-   * it could redeem again still open.
+   * Remove one machine completely, in ONE transaction: its `CadrePeer` row and its
+   * `DeviceToken` row when it has one, each with the `Revocation` tombstone retiring its stamp
+   * ({@link deleteGuardedRow}'s statement pair, composed bare as {@link deleteStrandAndPartyKey}
+   * composes it), plus a withdrawal tombstone for every `CadreInvite` in `target.inviteKeys`
+   * that is still live here ({@link withdrawCadreInvite}'s body). One transaction so no reader
+   * sees the machine half removed: a row gone but its push token resolvable, or an invitation
+   * it could redeem again still open. Owner keys are never touched: they are the person's, and
+   * removing one is {@link deleteOwnerKey}.
    *
    * Through {@link mutateCadrePeer}, the membership hub. Every stamp is read inside the locked
    * body, and a row whose stamp is already retired (held without its delete) is skipped rather
-   * than tombstoned twice. The by-name owner refusals of {@link deleteOwnerKey} apply to the
-   * owner-key arm. Nothing to remove writes nothing and returns all false.
+   * than tombstoned twice. Nothing to remove writes nothing and returns all false.
    *
-   * The caller decides WHAT to remove, which owner key is the machine's and which invitations
-   * it could use, from its plan (`CadreNode.planMachineRemoval`); this method only refuses to
-   * write an inconsistent set.
+   * Opted into {@link LOST_UPDATE_RETRY_POLICY} for the reason on {@link deleteCadrePeer}: every
+   * stamp and signature is minted inside the body, and the invitation keys come from the
+   * caller's plan, which a self-publish does not touch (a withdrawal of an invitation withdrawn
+   * since collides on `Revocation`'s primary key — a constraint failure, never retried, as
+   * before). A lost update after a sibling tree of the transaction already synced arrives as a
+   * partial commit and stays declined.
    *
-   * @throws when `target.ownerKey` is `ownerKey`, or is the only live owner here.
+   * The caller decides which invitations the machine could use, from its plan
+   * (`CadreNode.planMachineRemoval`).
    */
   async removeMachine(
-    target: { peerId: string; ownerKey: string | null; inviteKeys: readonly string[] },
+    target: { peerId: string; inviteKeys: readonly string[] },
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
-  ): Promise<MachineRemovalWrites> {
-    if (target.ownerKey === ownerKey) {
-      throw new Error(`Cannot remove owner key ${ownerKey}: an owner cannot remove itself`);
-    }
+    signMessage: ControlSign
+  ): Promise<MachineRemovalResult> {
     return await this.mutateCadrePeer('machine-remove', async () => {
-      const removals = await this.signMachineRemovals(target, signMessage);
-      const withdrawals = await this.signCadreInviteWithdrawals(target.inviteKeys, signMessage);
+      const removals = await this.signMachineRemovals(target.peerId, signMessage);
+      const withdrawals = await this.signWithdrawals('CadreInvite', target.inviteKeys, signMessage);
       if (removals.length === 0 && withdrawals.length === 0) {
         log('removeMachine: nothing live names %s here (already removed)', target.peerId);
-        return { removedPeer: false, removedOwnerKey: false, removedDeviceToken: false, withdrawnInvitations: [] };
+        return { removedPeer: false, removedDeviceToken: false, withdrawnInvitations: [] };
       }
       await this.inTransaction('remove machine', async () => {
         for (const removal of removals) {
@@ -2197,23 +2742,19 @@ export class ControlDatabase {
       }
       return {
         removedPeer: removed.has('CadrePeer'),
-        removedOwnerKey: removed.has('OwnerKey'),
         removedDeviceToken: removed.has('DeviceToken'),
         withdrawnInvitations: withdrawals.map((withdrawal) => withdrawal.ref.rowKey),
       };
-    });
+    }, LOST_UPDATE_RETRY_POLICY);
   }
 
   /**
    * The guarded removals {@link removeMachine} runs, signed over each row's current stamp:
-   * the `CadrePeer` row, the `OwnerKey` row when named, the `DeviceToken` row when present.
-   * Inside the locked body (every read `retry: false`); one `Revocation` scan serves the
-   * retired-stamp check for all three tables and the last-owner refusal.
-   */
-  private async signMachineRemovals(
-    target: { peerId: string; ownerKey: string | null },
-    signMessage: (message: Uint8Array) => string
-  ): Promise<GuardedRemoval[]> {
+   * the `CadrePeer` row and the `DeviceToken` row, each when present. Inside the locked body
+   * (every read `retry: false`); one `Revocation` scan serves the retired-stamp check for both
+   * tables.
+   */
+  private async signMachineRemovals(peerId: string, signMessage: ControlSign): Promise<GuardedRemoval[]> {
     const retiredByTable = new Map<RevocableTable, Set<string>>();
     for (const tombstone of await this.queryRevocations(false)) {
       const stamps = retiredByTable.get(tombstone.tableName) ?? new Set<string>();
@@ -2226,24 +2767,12 @@ export class ControlDatabase {
       return stampId !== null && !retired(table).has(stampId) ? stampId : null;
     };
     const removals: GuardedRemoval[] = [];
-    const peerStamp = await liveStamp('CadrePeer', target.peerId);
-    if (peerStamp !== null) {
-      removals.push(signGuardedRemoval(this.config.partyId, 'CadrePeer', target.peerId, peerStamp, signMessage));
-    }
-    if (target.ownerKey !== null) {
-      const ownerStamp = await liveStamp('OwnerKey', target.ownerKey);
-      if (ownerStamp !== null) {
-        const owners = await this.queryOwnerKeyRows(false, retired('OwnerKey'));
-        if (owners.length <= 1) {
-          throw new Error(`Cannot remove owner key ${target.ownerKey}: cannot remove the last owner`);
-        }
-        removals.push(signGuardedRemoval(this.config.partyId, 'OwnerKey', target.ownerKey, ownerStamp, signMessage));
+    for (const table of ['CadrePeer', 'DeviceToken'] as const) {
+      const stampId = await liveStamp(table, peerId);
+      if (stampId !== null) {
+        removals.push(await signGuardedRemoval(this.config.partyId, table, peerId, stampId, signMessage));
       }
     }
-    const tokenStamp = await liveStamp('DeviceToken', target.peerId);
-    if (tokenStamp !== null) {
-      removals.push(signGuardedRemoval(this.config.partyId, 'DeviceToken', target.peerId, tokenStamp, signMessage));
-    }
     return removals;
   }
 
@@ -2270,32 +2799,86 @@ export class ControlDatabase {
     strandId: string,
     type: 'o' | 'c',
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string,
+    signMessage: ControlSign,
     memberPrivateKey?: string
   ): Promise<void> {
     this.ensureInitialized();
     log('Inserting strand: %s (type: %s)', strandId, type);
+    const insert = await this.signStrandInsert(strandId, type, ownerKey, signMessage, memberPrivateKey);
+    await this.execWrite(insert.sql, insert.params, 'strand-insert');
+    log('Strand inserted: %s', strandId);
+  }
 
+  /** The stamped, owner-signed `Strand` insert that {@link insertStrand} and {@link insertFoundingRows} run. */
+  private async signStrandInsert(
+    strandId: string,
+    type: 'o' | 'c',
+    ownerKey: string,
+    signMessage: ControlSign,
+    memberPrivateKey?: string
+  ): Promise<SignedInsert> {
     // Generate a unique stamp ID using the peer ID for distributed uniqueness
     const peerId = this.config.libp2pNode.peerId.toString();
     const stampId = generateStampId(peerId);
 
     // Field order MUST match the schema's Strand `AuthorizedInsert` verify:
-    // Id, Type, MemberPrivateKey ('' when null), StampId. FounderOwnerKey is
+    // Id, Type, MemberPrivateKey ('' when null), FounderPeerId, StampId. FounderOwnerKey is
     // deliberately NOT in the digest — the schema binds it by equality to the
     // verified context.OwnerKey instead (see the constraint's comment).
-    const message = buildAuthorizationMessage('CadreControl.Strand', 'add', this.config.partyId, [strandId, type, memberPrivateKey ?? '', stampId]);
-    const signature = signMessage(message);
+    const message = buildAuthorizationMessage('CadreControl.Strand', 'add', this.config.partyId, [strandId, type, memberPrivateKey ?? '', peerId, stampId]);
+    const signature = await signMessage(message);
 
     // StampId is a real, unique column (single-use anti-replay), no longer a context value.
-    // FounderOwnerKey must equal the signing owner or the constraint rejects the row.
-    await this.execWrite(`
-      insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?)
-    `, [ownerKey, signature, strandId, type, memberPrivateKey ?? null, stampId, ownerKey], 'strand-insert');
+    // FounderOwnerKey must equal the signing owner or the constraint rejects the row.
+    return {
+      sql: `
+        insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey, FounderPeerId)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?, ?, ?, ?)
+      `,
+      params: [ownerKey, signature, strandId, type, memberPrivateKey ?? null, stampId, ownerKey, peerId],
+    };
+  }
 
-    log('Strand inserted: %s', strandId);
+  /**
+   * Insert one founding's control rows — the `Strand` row, a closed strand's `StrandPartyKey`
+   * row, and a formation invitation bound to the strand — in ONE transaction: one commit, and
+   * never a strand row without the key or invitation written beside it.
+   *
+   * Each row is stamped and signed exactly as its single-row writer ({@link insertStrand},
+   * {@link insertStrandPartyKey}, {@link insertFormationInvite}) does it, and all of that — the
+   * invitation's {@link canonicalDatetime} read included — happens BEFORE the write lock is
+   * taken: signing may prompt the user, and the lock held across a prompt would stall every
+   * other control write. A {@link lockedWithRetry} re-run re-presents the same signed rows.
+   *
+   * No row's `AuthorizedInsert` reads another of these rows (`StrandPartyKey` and
+   * `FormationInvite` check only `OwnerKey` and `Revocation`), so their order is free; the
+   * `Strand` row goes first, so a founding repeated over a stored row is refused on `Strand.Id`.
+   *
+   * A uniqueness rejection rolls the whole transaction back. The caller resolves it and writes
+   * again: a `Strand.Id` conflict is another founder's row, a `StrandPartyKey.Id` conflict a key
+   * stored with no strand row ({@link isStrandIdConflict}; see `CadreNode.publishStrand`).
+   */
+  async insertFoundingRows(rows: FoundingRows, ownerKey: string, signMessage: ControlSign): Promise<void> {
+    this.ensureInitialized();
+    const { strand, partyKey, formationInvite } = rows;
+    log('Inserting founding rows: strand %s (type: %s, party key: %s, invitation: %s)',
+      strand.id, strand.type, partyKey !== undefined, formationInvite !== undefined);
+    const inserts = [await this.signStrandInsert(strand.id, strand.type, ownerKey, signMessage, strand.memberPrivateKey)];
+    if (partyKey !== undefined) {
+      inserts.push(await this.signStrandPartyKeyInsert(strand.id, partyKey, ownerKey, signMessage));
+    }
+    if (formationInvite) {
+      const { token, sAppId, ...options } = formationInvite;
+      inserts.push(await this.signFormationInviteInsert(token, sAppId, ownerKey, signMessage, { ...options, strandId: strand.id }));
+    }
+    // Bare `exec`: the lock is held, and `execWrite` would take it again and self-deadlock.
+    await this.lockedWithRetry(() => this.inTransaction('found strand', async () => {
+      for (const insert of inserts) {
+        await this.db!.exec(insert.sql, insert.params);
+      }
+    }), {}, 'strand-found');
+    log('Founding rows inserted: strand %s', strand.id);
   }
 
   /**
@@ -2328,7 +2911,7 @@ export class ControlDatabase {
   deleteStrand(
     strandId: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     return this.lockedWithRetry(() => this.deleteStrandAndPartyKey(strandId, ownerKey, signMessage), {}, 'strand-delete');
   }
@@ -2348,7 +2931,7 @@ export class ControlDatabase {
   private async deleteStrandAndPartyKey(
     strandId: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     this.ensureInitialized();
     // retry: false — these reads run inside the locked write body (see queryStampId's NOTE).
@@ -2359,10 +2942,10 @@ export class ControlDatabase {
     }
     const partyKeyStamp = await this.queryStampId('StrandPartyKey', strandId, false);
 
-    const strandRemoval = signGuardedRemoval(this.config.partyId, 'Strand', strandId, strandStamp, signMessage);
+    const strandRemoval = await signGuardedRemoval(this.config.partyId, 'Strand', strandId, strandStamp, signMessage);
     const partyKeyRemoval = partyKeyStamp === null
       ? null
-      : signGuardedRemoval(this.config.partyId, 'StrandPartyKey', strandId, partyKeyStamp, signMessage);
+      : await signGuardedRemoval(this.config.partyId, 'StrandPartyKey', strandId, partyKeyStamp, signMessage);
 
     await this.inTransaction('delete Strand', async () => {
       await this.execGuardedRemoval(strandRemoval, ownerKey);
@@ -2400,26 +2983,37 @@ export class ControlDatabase {
     strandId: string,
     privateKey: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<void> {
     this.ensureInitialized();
     log('Inserting strand party key for strand: %s', strandId);
+    const insert = await this.signStrandPartyKeyInsert(strandId, privateKey, ownerKey, signMessage);
+    await this.execWrite(insert.sql, insert.params, 'strand-party-key-insert');
+    log('Strand party key inserted for strand: %s', strandId);
+  }
 
-    const peerId = this.config.libp2pNode.peerId.toString();
-    const stampId = generateStampId(peerId);
+  /** The stamped, owner-signed `StrandPartyKey` insert that {@link insertStrandPartyKey} and {@link insertFoundingRows} run. */
+  private async signStrandPartyKeyInsert(
+    strandId: string,
+    privateKey: string,
+    ownerKey: string,
+    signMessage: ControlSign
+  ): Promise<SignedInsert> {
+    const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
 
     // Field order MUST match the schema's StrandPartyKey `AuthorizedInsert` verify:
     // Id, PrivateKey, StampId.
     const message = buildAuthorizationMessage('CadreControl.StrandPartyKey', 'add', this.config.partyId, [strandId, privateKey, stampId]);
-    const signature = signMessage(message);
-
-    await this.execWrite(`
-      insert into CadreControl.StrandPartyKey (Id, PrivateKey, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?)
-    `, [ownerKey, signature, strandId, privateKey, stampId], 'strand-party-key-insert');
+    const signature = await signMessage(message);
 
-    log('Strand party key inserted for strand: %s', strandId);
+    return {
+      sql: `
+        insert into CadreControl.StrandPartyKey (Id, PrivateKey, StampId)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?)
+      `,
+      params: [ownerKey, signature, strandId, privateKey, stampId],
+    };
   }
 
   /**
@@ -2437,7 +3031,7 @@ export class ControlDatabase {
   deleteStrandPartyKey(
     strandId: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     return this.lockedWithRetry(() => this.deleteGuardedRow('StrandPartyKey', strandId, ownerKey, signMessage), {}, 'strand-party-key-delete');
   }
@@ -2457,7 +3051,7 @@ export class ControlDatabase {
   async insertJoinedStrand(
     row: Pick<StrandRow, 'Id' | 'Type' | 'MemberPrivateKey'>,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<void> {
     this.ensureInitialized();
     log('Inserting joined strand: %s (type: %s)', row.Id, row.Type);
@@ -2467,7 +3061,7 @@ export class ControlDatabase {
     // Field order MUST match the schema's JoinedStrand `AuthorizedInsert` verify:
     // Id, Type, MemberPrivateKey ('' when null), StampId.
     const message = buildAuthorizationMessage('CadreControl.JoinedStrand', 'add', this.config.partyId, [row.Id, row.Type, row.MemberPrivateKey ?? '', stampId]);
-    const signature = signMessage(message);
+    const signature = await signMessage(message);
 
     await this.execWrite(`
       insert into CadreControl.JoinedStrand (Id, Type, MemberPrivateKey, StampId)
@@ -2487,7 +3081,7 @@ export class ControlDatabase {
   deleteJoinedStrand(
     strandId: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     return this.lockedWithRetry(() => this.deleteGuardedRow('JoinedStrand', strandId, ownerKey, signMessage), {}, 'joined-strand-delete');
   }
@@ -2502,10 +3096,10 @@ export class ControlDatabase {
   async insertJoinRequest(
     request: JoinRequestFields,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<PendingJoin> {
     this.ensureInitialized();
-    const { written, insert } = this.signJoinRequestInsert(request, ownerKey, signMessage);
+    const { written, insert } = await this.signJoinRequestInsert(request, ownerKey, signMessage);
     await this.execWrite(insert.sql, insert.params, 'join-request-insert');
     log('Join request inserted: %s', request.Id);
     return { ...written, outcome: null };
@@ -2528,10 +3122,10 @@ export class ControlDatabase {
     expected: PendingJoin,
     outcome: JoinOutcome,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<PendingJoin> {
     this.ensureInitialized();
-    const insert = signJoinOutcomeInsert(this.config.partyId, expected.StampId, outcome, ownerKey, signMessage);
+    const insert = await signJoinOutcomeInsert(this.config.partyId, expected.StampId, outcome, ownerKey, signMessage);
     return this.lockedWithRetry(async () => {
       const live = await this.readPendingJoin(expected.Id, false);
       if (live === null || live.StampId !== expected.StampId || live.outcome?.kind !== expected.outcome?.kind) {
@@ -2566,13 +3160,13 @@ export class ControlDatabase {
     expectedStampId: string,
     next: PendingJoinFields,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<PendingJoin> {
     this.ensureInitialized();
     const { outcome, ...request } = next;
-    const removal = signGuardedRemoval(this.config.partyId, 'JoinRequest', next.Id, expectedStampId, signMessage);
-    const { written, insert } = this.signJoinRequestInsert(request, ownerKey, signMessage);
-    const outcomeInsert = outcome === null ? null : signJoinOutcomeInsert(this.config.partyId, written.StampId, outcome, ownerKey, signMessage);
+    const removal = await signGuardedRemoval(this.config.partyId, 'JoinRequest', next.Id, expectedStampId, signMessage);
+    const { written, insert } = await this.signJoinRequestInsert(request, ownerKey, signMessage);
+    const outcomeInsert = outcome === null ? null : await signJoinOutcomeInsert(this.config.partyId, written.StampId, outcome, ownerKey, signMessage);
 
     return this.lockedWithRetry(async () => {
       // retry: false — this runs inside the locked write body (see queryStampId's NOTE).
@@ -2603,7 +3197,7 @@ export class ControlDatabase {
   deletePendingJoin(
     id: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     return this.lockedWithRetry(
       () => this.deleteGuardedRow('JoinRequest', id, ownerKey, signMessage, (stampId) => this.deleteJoinOutcomes(stampId)),
@@ -2614,13 +3208,13 @@ export class ControlDatabase {
    * Mint a fresh stamp for `request` and the owner signature `JoinRequest.AuthorizedInsert`
    * verifies, returning the row as it will be written and its insert.
    */
-  private signJoinRequestInsert(
+  private async signJoinRequestInsert(
     request: JoinRequestFields,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
-  ): { written: JoinRequestRow; insert: SignedStatement } {
+    signMessage: ControlSign
+  ): Promise<{ written: JoinRequestRow; insert: SignedStatement }> {
     const written: JoinRequestRow = { ...request, StampId: generateStampId(this.config.libp2pNode.peerId.toString()) };
-    const signature = signMessage(buildAuthorizationMessage('CadreControl.JoinRequest', 'add', this.config.partyId, joinRequestAddFields(written)));
+    const signature = await signMessage(buildAuthorizationMessage('CadreControl.JoinRequest', 'add', this.config.partyId, joinRequestAddFields(written)));
     const params = [ownerKey, signature, written.Id, written.Invitation, written.Disclosure, written.RequestedAt, written.ExpiresAt, written.StampId];
     return { written, insert: { sql: JOIN_REQUEST_INSERT_SQL, params } };
   }
@@ -2660,7 +3254,7 @@ export class ControlDatabase {
   async insertValidationKey(
     key: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<void> {
     this.ensureInitialized();
     log('Inserting validation key: %s', key);
@@ -2670,7 +3264,7 @@ export class ControlDatabase {
 
     // Field order MUST match the schema's ValidationKey `AuthorizedInsert` verify: Key, StampId.
     const message = buildAuthorizationMessage('CadreControl.ValidationKey', 'add', this.config.partyId, [key, stampId]);
-    const signature = signMessage(message);
+    const signature = await signMessage(message);
 
     await this.execWrite(`
       insert into CadreControl.ValidationKey (Key, StampId)
@@ -2700,7 +3294,7 @@ export class ControlDatabase {
   deleteValidationKey(
     key: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     return this.lockedWithRetry(() => this.deleteGuardedRow('ValidationKey', key, ownerKey, signMessage), {}, 'validation-key-delete');
   }
@@ -2752,13 +3346,13 @@ export class ControlDatabase {
       profile: NodeProfile | null;
     },
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     this.ensureInitialized();
     // Stamp is minted from the ADMITTED peer's id, not this node's — the nonce names the
     // row it vouches.
     const stampId = generateStampId(row.peerId);
-    const signature = signMessage(
+    const signature = await signMessage(
       buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [row.peerId, stampId])
     );
     return await this.mutateCadrePeer('peer-insert', async () => {
@@ -2783,32 +3377,44 @@ export class ControlDatabase {
   }
 
   /**
-   * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
-   * rewrite `VouchOwner`/`VouchSig` under the owner branch of `CadrePeer.AuthorizedUpdate`
-   * (a signature over the SAME `'vouch'`-tagged digest {@link insertCadrePeer} builds), so
-   * the row is re-emitted as a fresh, broadcasting transaction.
-   *
-   * This is the write-while-alone re-replication primitive: a membership row that committed
-   * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it grows, by
-   * re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because the row
-   * already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness stamp
-   * and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact (the
-   * owner branch requires them kept: they are the machine's own claim) — so it is safe
-   * over a row whose peer has not self-published (`Sig` null); the caller must skip a row
-   * that already carries a self-`Sig` (that row is the owning peer's to refresh, and bumping
-   * `UpdatedAt` without re-signing would invalidate its self-signature).
-   *
-   * Signs over the row's CURRENT `StampId` (unchanged by the re-touch), read BEFORE the lock
-   * is taken. An absent row returns `false` WITHOUT notifying: nothing was written, so the
-   * membership snapshot cannot have changed.
-   *
-   * NOTE: that stamp read is outside the lock, same as {@link deleteGuardedRow}'s. A writer
-   * that removes the row in between makes the `update` match nothing, and this still returns
-   * `true` and notifies — harmless today (the sole caller, the write-while-alone drain, only
-   * logs the result, and a spurious notify just re-reads the member set), and a remove-then-
-   * re-add in the same window fails loudly instead, since the signature binds the retired
-   * stamp. If a caller ever acts on `true` as proof the row was written, fold the stamp read
-   * into the locked body.
+   * Owner "re-touch" of an existing `CadrePeer` membership row: rewrite `VouchOwner`/`VouchSig`
+   * (and, re-broadcasting, bump `UpdatedAt`) under the owner branch of
+   * `CadrePeer.AuthorizedUpdate` — a signature over the SAME `'vouch'`-tagged digest
+   * {@link insertCadrePeer} builds — so the row is re-emitted as a fresh, broadcasting
+   * transaction, or stands on a different owner's voucher.
+   *
+   * Re-broadcasting is the write-while-alone re-replication primitive: a membership row that
+   * committed local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it
+   * grows, by re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because
+   * the row already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness
+   * stamp and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact
+   * (the owner branch requires them kept: they are the machine's own claim) — so it is safe
+   * over a row whose peer has not self-published (`Sig` null), and this method itself skips a
+   * row that already carries a self-`Sig` (that row is the owning peer's to refresh, and
+   * bumping `UpdatedAt` without re-signing would invalidate its self-signature).
+   *
+   * The two modes ({@link CadrePeerRetouchMode}) differ in what they write: `'rebroadcast'`
+   * bumps `UpdatedAt` to `max(now, current + 1)` from the row read inside the body and writes
+   * only while the row's `Sig` is null; `'revouch'` leaves `UpdatedAt` out of the `set` list and
+   * writes whether or not the machine has self-published (the owner branch has no monotonic
+   * rule, so the column simply keeps its value).
+   *
+   * The row read (stamp, `Sig`, `UpdatedAt`), the mode's decision and the signature over the
+   * row's CURRENT `StampId` (unchanged by the re-touch) all run INSIDE the locked body, which is
+   * what lets both modes opt into {@link LOST_UPDATE_RETRY_POLICY}: the row's other writer is
+   * the machine's own publish ({@link updateSelfPeerRecord}), and the drain's re-broadcast fires
+   * at the moment that publish does. A re-run after losing to it reads the self-signed row and
+   * reports `'self-published'` instead of writing the owner branch over it — which would rewrite
+   * `UpdatedAt` under a `Sig` signed over the old value and make the record unverifiable to
+   * resolvers until the machine's next heartbeat. The decision has to be the body's for that;
+   * a caller's pre-check outside the lock is only a fast path (see below).
+   *
+   * An absent row — none, or its stamp retired, or a stampless row no writer produces — is
+   * `'absent'`. Checked once outside the lock too, as `'self-published'` is: the common case
+   * writes nothing, takes no lock and does NOT notify, so an absent target stays quiet
+   * ({@link SeedBootstrapService.removePeer} keeps the same gate for the same reason). The
+   * in-body re-check covers the race; a no-write outcome reached there notifies spuriously,
+   * which only re-reads the member set.
    *
    * Notifies like the insert/remove paths even though this is "only" a re-touch: it rewrites
    * VouchOwner/VouchSig, which the authorized-membership predicate judges on, so it CAN
@@ -2822,45 +3428,61 @@ export class ControlDatabase {
    *
    * NOTE: this rebinds VouchOwner to the CALLING owner's key, and the authorized-membership
    * predicate (`CadreNode.listAuthorizedMembers`) now judges rows by that column against each
-   * reader's node-local anchor. Benign today because the only caller — the write-while-alone
-   * drain — re-touches solely rows this node itself authored (`pendingPeerWrites`), so the
-   * voucher is rewritten to the key that already signed it. If a future path ever lets one
-   * owner re-touch a row a DIFFERENT owner vouched, the voucher silently flips: readers that
-   * anchor the original owner but not this one would drop a legitimate member. Such a path
-   * must re-vouch deliberately (or preserve the existing VouchOwner/VouchSig) rather than
-   * inherit this rebinding.
+   * reader's node-local anchor. The two callers rebind on purpose: the write-while-alone drain
+   * re-touches solely rows this node itself authored (`pendingPeerWrites`), so the voucher is
+   * rewritten to the key that already signed it, and `CadreNode.removeOwner` moves rows off a
+   * key it is about to remove. A new caller that re-touches a row a DIFFERENT owner vouched
+   * flips the voucher silently: readers that anchor the original owner but not this one would
+   * drop a legitimate member. It must re-vouch deliberately (or preserve the existing
+   * VouchOwner/VouchSig) rather than inherit this rebinding.
    *
    * @param peerId - the membership row to re-touch.
-   * @param updatedAt - the strictly-increasing freshness stamp to write.
+   * @param mode - re-broadcast or re-vouch ({@link CadrePeerRetouchMode}).
    * @param ownerKey - public key of the re-vouching owner, rewritten into `VouchOwner`.
-   * @param signMessage - ed25519-signs the raw message bytes with that owner's private key.
-   * @returns `true` when the row was re-touched, `false` when no row exists (no notify).
+   * @param signMessage - ed25519-signs the raw message bytes with that owner's private key;
+   *   called inside the lock, once per attempt (the NOTE on {@link ControlSign}).
+   * @returns what was found and done ({@link CadrePeerRetouchOutcome}).
    */
   async reauthorizeCadrePeer(
     peerId: string,
-    updatedAt: number,
+    mode: CadrePeerRetouchMode,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
-  ): Promise<boolean> {
+    signMessage: ControlSign
+  ): Promise<CadrePeerRetouchOutcome> {
     this.ensureInitialized();
-    const stampId = await this.queryStampId('CadrePeer', peerId);
-    if (stampId === null) {
-      log('reauthorizeCadrePeer: no CadrePeer row for %s (nothing to re-touch)', peerId);
-      return false;
+    const outside = retouchTarget(await this.findCadrePeerRow(peerId, true), mode);
+    if (typeof outside === 'string') {
+      log('reauthorizeCadrePeer(%s): %s for %s (nothing to write)', mode, outside, peerId);
+      return outside;
     }
-    const signature = signMessage(
-      buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, stampId])
-    );
-    await this.mutateCadrePeer('peer-reauthorize', async () => {
+    return await this.mutateCadrePeer('peer-reauthorize', async () => {
+      // retry: false — inside the locked write body (see queryStampId's NOTE).
+      const target = retouchTarget(await this.findCadrePeerRow(peerId, false), mode);
+      if (typeof target === 'string') {
+        log('reauthorizeCadrePeer(%s): %s for %s since the pre-check (nothing to write)', mode, target, peerId);
+        return target;
+      }
+      const signature = await signMessage(
+        buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, target.stampId])
+      );
       // Bare `exec` — inside the non-re-entrant write lock (see insertCadrePeer).
-      await this.db!.exec(`
-        update CadreControl.CadrePeer
-          with context OwnerKey = ?, Signature = ?
-          set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?, VouchUsage = null
-          where PeerId = ?
-      `, [ownerKey, signature, updatedAt, ownerKey, signature, peerId]);
-    });
-    return true;
+      if (mode === 'rebroadcast') {
+        await this.db!.exec(`
+          update CadreControl.CadrePeer
+            with context OwnerKey = ?, Signature = ?
+            set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?, VouchUsage = null
+            where PeerId = ?
+        `, [ownerKey, signature, Math.max(Date.now(), target.updatedAt + 1), ownerKey, signature, peerId]);
+      } else {
+        await this.db!.exec(`
+          update CadreControl.CadrePeer
+            with context OwnerKey = ?, Signature = ?
+            set VouchOwner = ?, VouchSig = ?, VouchUsage = null
+            where PeerId = ?
+        `, [ownerKey, signature, ownerKey, signature, peerId]);
+      }
+      return 'retouched';
+    }, LOST_UPDATE_RETRY_POLICY);
   }
 
   /**
@@ -2882,14 +3504,20 @@ export class ControlDatabase {
    *
    * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
    * when a row was actually removed.
+   *
+   * Opted into {@link LOST_UPDATE_RETRY_POLICY}: the row's machine may publish its own record
+   * at the moment of the removal (its first publish lands about a second after it starts), and
+   * the removal that loses is refused as a lost update. {@link deleteGuardedRow} reads the stamp
+   * and signs inside the body, and a self-publish never changes the stamp the `'remove'` digest
+   * binds, so the re-run reads the published row and removes it.
    */
   deleteCadrePeer(
     peerId: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     return this.mutateCadrePeer('peer-remove', () =>
-      this.deleteGuardedRow('CadrePeer', peerId, ownerKey, signMessage));
+      this.deleteGuardedRow('CadrePeer', peerId, ownerKey, signMessage), LOST_UPDATE_RETRY_POLICY);
   }
 
   /**
@@ -2908,7 +3536,7 @@ export class ControlDatabase {
   deleteDeviceToken(
     peerId: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
     return this.lockedWithRetry(() => this.deleteGuardedRow('DeviceToken', peerId, ownerKey, signMessage), {}, 'device-token-delete');
   }
@@ -2944,7 +3572,7 @@ export class ControlDatabase {
     table: RemovableTable,
     keyValue: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string,
+    signMessage: ControlSign,
     alongside?: (stampId: string) => Promise<void>
   ): Promise<boolean> {
     this.ensureInitialized();
@@ -2955,7 +3583,7 @@ export class ControlDatabase {
       return false;
     }
 
-    const removal = signGuardedRemoval(this.config.partyId, table, keyValue, stampId, signMessage);
+    const removal = await signGuardedRemoval(this.config.partyId, table, keyValue, stampId, signMessage);
     await this.inTransaction(`delete ${table}`, async () => {
       await alongside?.(stampId);
       await this.execGuardedRemoval(removal, ownerKey);
@@ -2991,10 +3619,9 @@ export class ControlDatabase {
 
   /**
    * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
-   * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of a
-   * `CadreInvite` withdrawal ({@link withdrawCadreInvite}), whose row stays — or the ledger
-   * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
-   * lock and, where one is needed, the transaction.
+   * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of an
+   * issued row's withdrawal ({@link withdrawIssuedRow}), whose row stays. The caller
+   * supplies the lock and, where one is needed, the transaction.
    *
    * `ReissuedAt` is named explicitly at 0 (the only value `FreshTombstone` accepts) rather
    * than leaning on the column default — the seat-at-zero rule is load-bearing for
@@ -3003,11 +3630,7 @@ export class ControlDatabase {
    * `SignerKey` / `SignerSig` store the context pair (`Revocation.Authorized` pins them
    * equal), so a node that receives the row by replication can tell which owner filed it.
    */
-  private async execTombstone(
-    ref: RevokedRowRef | typeof REVOCATION_LEDGER_MARKER,
-    revocationSignature: string,
-    ownerKey: string
-  ): Promise<void> {
+  private async execTombstone(ref: RevokedRowRef, revocationSignature: string, ownerKey: string): Promise<void> {
     await this.db!.exec(`
       insert into CadreControl.Revocation (TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig)
         with context OwnerKey = ?, Signature = ?
@@ -3053,9 +3676,10 @@ export class ControlDatabase {
    * statement, and without the clause the reap would delete the owner's brand-new row.
    * With it the statement matches nothing and the reap is a silent no-op (the schema
    * branch would also refuse that delete, but as a constraint error thrown into a
-   * background sweep — matched-nothing is the better failure mode). Like
-   * {@link reauthorizeCadrePeer}, a race lost AFTER the guard still returns `true`;
-   * harmless — nothing was deleted, and the next sweep re-reads.
+   * background sweep — matched-nothing is the better failure mode). A race lost AFTER the
+   * guard still returns `true` here (unlike {@link reauthorizeCadrePeer}, which reads inside
+   * its lock and reports what it found); harmless — nothing was deleted, and the next sweep
+   * re-reads.
    *
    * Writes NOTHING to `Revocation`: `RevocationRecorded` is satisfied by the same
    * committed tombstone that authorizes the reap, so a reap files no second tombstone.
@@ -3082,7 +3706,7 @@ export class ControlDatabase {
    * present clause are the shape {@link redeemInvitation}'s consent-branch insert ships).
    *
    * Driven automatically by {@link reapRevokedRows}, which the periodic control-cohort
-   * reconcile pass runs while the node has at least one control connection.
+   * reconcile pass runs while a sibling is reachable (`CadreNode.hasReachableControlSibling`).
    */
   async reapRevokedRow(table: ReapableTable, rowKey: string, stampId: string): Promise<boolean> {
     this.ensureInitialized();
@@ -3139,8 +3763,8 @@ export class ControlDatabase {
    * carry the delete (replaying a delete of an already-absent row is a no-op), so a node
    * that converged on a removal while holding the removed row keeps that row as inert
    * garbage until something walks the tombstones and drops it. `CadreNode`'s periodic
-   * control-cohort reconcile pass is that something, gated on the node having at least one
-   * control connection (a reap is a write, and a write committed alone is local-only).
+   * control-cohort reconcile pass is that something, gated on a sibling being reachable
+   * (a reap is a write, and a write committed alone is local-only).
    *
    * Enumerated UNLOCKED, deleted per-row LOCKED: {@link reapRevokedRow} takes the write
    * lock itself (via {@link mutateCadrePeer} / {@link execWrite}) and the lock is not
@@ -3173,12 +3797,11 @@ export class ControlDatabase {
    *
    * NOTE: cost is O(tombstones), not O(live rows) — one {@link queryRevocations} scan plus
    * one {@link queryStampId} point lookup per tombstone, and the empty early return makes
-   * the common case (a party that has never revoked anyone; {@link queryRevocations} skips
-   * the ledger marker) a single scan per pass. That scan consults the cohort on every pass
-   * only while `Revocation` has never been written; the ledger marker
-   * ({@link openRevocationLedger}), filed by the same connected pass, makes it a held block.
+   * the common case (a party that has never revoked anyone) a single scan per pass, served
+   * from the `Revocation` membership view
+   * ({@link readMembershipRows}) unless the table changed since the last read.
    * But `Revocation` is append-only and unbounded, so this is O(all tombstones ever) point
-   * lookups on every reconcile tick. Fine while revocations stay rare for a cadre-sized
+   * lookups on every connected reconcile pass. Fine while revocations stay rare for a cadre-sized
    * party; if the table ever grows, persist a node-local high-water mark of what has
    * already been reaped instead of re-scanning everything (the same bound the sweep in
    * `CadreNode.drainPendingRevocations` wants).
@@ -3243,25 +3866,28 @@ export class ControlDatabase {
    *
    * Returns how many UPDATE statements ran (`rows.length` on success).
    */
-  reissueRevocations(
+  async reissueRevocations(
     rows: readonly RevocationRow[],
     reissuedAt: number,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<number> {
     this.ensureInitialized();
     // Signatures minted OUTSIDE the locked body: a retried attempt must re-present the
     // exact signed message, never re-mint (the contract on withWriteLock). ReissuedAt
     // rides in the digest as a string — SQL-side it is cast(new.ReissuedAt as text),
     // and every digest field is TEXT on both sides (see buildAuthorizationMessage).
-    const signed = rows.map((row) => ({
-      row,
-      signature: signMessage(buildAuthorizationMessage(
-        'CadreControl.Revocation', 'reissue', this.config.partyId,
-        [row.tableName, row.rowKey, row.stampId, String(reissuedAt)]
-      )),
-    }));
-    return this.lockedWithRetry(async () => {
+    const signed: Array<{ row: RevocationRow; signature: string }> = [];
+    for (const row of rows) {
+      signed.push({
+        row,
+        signature: await signMessage(buildAuthorizationMessage(
+          'CadreControl.Revocation', 'reissue', this.config.partyId,
+          [row.tableName, row.rowKey, row.stampId, String(reissuedAt)]
+        )),
+      });
+    }
+    return await this.lockedWithRetry(async () => {
       // Counter lives INSIDE the locked body so a lockedWithRetry re-run (which
       // re-executes the whole body) starts from zero instead of double-counting.
       let executed = 0;
@@ -3293,78 +3919,6 @@ export class ControlDatabase {
     }, {}, 'revocation-reissue');
   }
 
-  /**
-   * Owner-signed filing of the singleton `Revocation` ledger marker
-   * ({@link REVOCATION_LEDGER_MARKER}), the one row in that table that retires nothing.
-   *
-   * Why it exists: while `Revocation` has never been written, this node does not hold its
-   * block, and Optimystic consults a block's cohort on EVERY read of a block it does not
-   * hold — and every membership lookup, and every guarded insert's `NotRevoked` check,
-   * reads this table. Once any row exists the block is held and re-checked at most once per
-   * read-repair window, like every other populated table. The schema's table comment says
-   * why the row can never read as a retirement.
-   *
-   * Insert-if-absent, shaped like {@link reissueRevocations}: the signature is minted
-   * OUTSIDE the locked body so a retried attempt re-presents the same one, and the guard
-   * runs INSIDE it so it sees a concurrent local writer's committed row. The guard scans
-   * the `'Revocation'` rows and compares the stamp in TypeScript rather than seeking the
-   * full composite primary key, which is served as a point lookup that can miss an existing
-   * row on a networked database (tickets/backlog/debt-composite-pk-point-lookup-unreliable-untracked).
-   *
-   * Two owners filing at once: the loser either sees the marker in its guard or is refused
-   * on the primary key, and both answer `'already-open'`.
-   *
-   * The caller decides WHEN. A marker committed while the node is alone is local-only and
-   * can fork the collection, so {@link CadreNode} files it only while connected; this
-   * method does not look at connectivity.
-   *
-   * @param ownerKey - owner public key for the write context (`Revocation.Authorized`).
-   * @param signMessage - ed25519-signs the raw message bytes (no pre-hash) with that owner's
-   *   private key, returning a base64url signature.
-   * @returns `'opened'` when this call filed the marker, `'already-open'` when it was
-   *   already there.
-   */
-  async openRevocationLedger(
-    ownerKey: string,
-    signMessage: (message: Uint8Array) => string
-  ): Promise<RevocationLedgerOpenResult> {
-    this.ensureInitialized();
-    const signature = signMessage(revocationTombstoneMessage(this.config.partyId, REVOCATION_LEDGER_MARKER));
-    try {
-      return await this.lockedWithRetry<RevocationLedgerOpenResult>(async () => {
-        if (await this.revocationLedgerFiled()) {
-          return 'already-open';
-        }
-        // execTombstone is a bare `exec`: already inside the write lock, which is NOT re-entrant.
-        await this.execTombstone(REVOCATION_LEDGER_MARKER, signature, ownerKey);
-        log('Revocation ledger marker filed');
-        return 'opened';
-      }, {}, 'revocation-ledger-open');
-    } catch (error) {
-      if (!isRevocationLedgerConflict(error)) {
-        throw error;
-      }
-      log('Revocation ledger marker already filed (refused on the primary key, most likely by another owner filing first): %s', error);
-      return 'already-open';
-    }
-  }
-
-  /**
-   * Whether the ledger marker is present locally: a scan of the `'Revocation'` rows with the
-   * stamp compared in TypeScript (see {@link openRevocationLedger} for why not a seek).
-   * Called only inside the locked write body, so never retried (see queryStampId's NOTE).
-   */
-  private async revocationLedgerFiled(): Promise<boolean> {
-    const { tableName, stampId } = REVOCATION_LEDGER_MARKER;
-    const rows = await this.readRows(
-      'select StampId from CadreControl.Revocation where TableName = ?',
-      [tableName],
-      'revocation-ledger',
-      false
-    );
-    return rows.some(row => row.StampId === stampId);
-  }
-
   /**
    * Run `body` between `beginTransaction` and `commit`, rolling back on failure.
    *
@@ -3411,11 +3965,28 @@ export class ControlDatabase {
    * {@link CadreNode}, which wires this in `start()` and clears it on teardown. A
    * second call replaces the first rather than fanning out, so a stale node can
    * never keep receiving notifications for a database it no longer owns.
+   *
+   * Only this database's own writes notify here, awaited inside the write so the gate is
+   * current before the write returns. A membership change replicated in from another
+   * machine reaches the gate through the subscription `CadreNode.start` takes on the
+   * membership tables ({@link watchTables}), a coalesced run up to 50 ms after the change
+   * lands in storage; one storage never hears of waits for the reconcile pass's backstop.
    */
   setMembershipChangeListener(listener: MembershipChangeListener | null): void {
     this.membershipListener = listener;
   }
 
+  /**
+   * Subscribe `onChange` to changes in control tables (`'CadreControl.Strand'`, …): commits
+   * made here and changes replicated into this node's storage alike, on the single-flight
+   * schedule `table-change-watch.ts` describes. {@link close} disposes every subscription
+   * still live before it drains the write queue.
+   */
+  watchTables(tables: readonly string[], onChange: () => Promise<void>, options: TableChangeWatchOptions): TableChangeWatch {
+    this.ensureInitialized();
+    return this.tableWatches.watch(this.db!, tables, onChange, options);
+  }
+
   /**
    * Wire (or clear, with null) the single listener notified after every committed
    * guarded-table delete. Same ownership contract as
@@ -3447,8 +4018,9 @@ export class ControlDatabase {
    * Covers every write that can change who is a member or an owner: EVERY `CadrePeer`
    * writer, with one documented exception ({@link updateSelfPeerRecord}, which cannot
    * change the snapshot), the `OwnerKey` writers ({@link insertOwnerKeyVouched},
-   * {@link deleteOwnerKey}) and the invitation redemption ({@link redeemCadreInvite}),
-   * which seats both. That is what makes the party-membership snapshot refresh automatic
+   * {@link deleteOwnerKey}), the invitation redemption ({@link redeemCadreInvite}), which
+   * seats both, and the owner-grant redemption ({@link redeemOwnerGrant}). That is what
+   * makes the party-membership snapshot refresh automatic
    * rather than a caller obligation. The name predates the `OwnerKey` writers. A
    * writer necessarily holds the target node's ControlDatabase (the `SeedBootstrapService`'s
    * event callbacks are NOT a viable seam: the temp service `CadreNode.applySeed`
@@ -3475,8 +4047,11 @@ export class ControlDatabase {
    * exhaustion.
    *
    * @param reason - Label for the log line only (e.g. `'peer-insert'`).
+   * @param policy - The retry policy, default unless the body has earned a wider one: the three
+   *   `CadrePeer` writers whose bodies re-read the row and decide inside pass
+   *   `LOST_UPDATE_RETRY_POLICY` (its `NOTE:` names them and the rule).
    */
-  async mutateCadrePeer<T>(reason: string, body: () => Promise<T>): Promise<T> {
+  async mutateCadrePeer<T>(reason: string, body: () => Promise<T>, policy: ControlWriteRetryOptions = {}): Promise<T> {
     this.ensureInitialized();
     return this.lockedWithRetry(async () => {
       this.assertCommitBoundary(reason, 'on entry to');
@@ -3484,7 +4059,7 @@ export class ControlDatabase {
       this.assertCommitBoundary(reason, 'on return from');
       await this.notifyMembershipChanged(reason);
       return result;
-    }, {}, reason);
+    }, policy, reason);
   }
 
   /**
@@ -3499,8 +4074,8 @@ export class ControlDatabase {
    * class: every public write method of this class runs its statement(s) under it, and
    * `SeedBootstrapService` reaches it through {@link execWrite} rather than touching the
    * `Database` directly, so it is covered too. The race is
-   * real, not theoretical: the background self-record publish on a control connection
-   * opening (`CadreNode.drainPendingControlReplication` → `registerSelf`) collided with
+   * real, not theoretical: the background self-record publish when a sibling becomes
+   * reachable (`CadreNode.drainPendingControlReplication` → `registerSelf`) collided with
    * a foreground `authorizePeer` — both `CadrePeer` inserts — and tripped the boundary
    * assert.
    *
@@ -3524,6 +4099,11 @@ export class ControlDatabase {
    * re-runnable means a retry re-runs the body's reads too, which is what makes it safe.
    * Signatures and stamp ids minted OUTSIDE the body are deliberately NOT re-minted per
    * attempt: a retry re-presents the exact signed message the first attempt presented.
+   * A body opted into `LOST_UPDATE_RETRY_POLICY` is the exception, and must mint INSIDE:
+   * its re-run is a re-decision over a row another writer changed, not a re-presentation of
+   * the same write, so its read of the row, its decision and its signature all run in the
+   * body ({@link updateSelfPeerRecord}, {@link reauthorizeCadrePeer}, {@link deleteGuardedRow}
+   * under {@link deleteCadrePeer}, {@link removeMachine}).
    */
   async withWriteLock<T>(fn: () => Promise<T>): Promise<T> {
     // Chain behind the current tail regardless of how it settled, then park a
@@ -3561,13 +4141,18 @@ export class ControlDatabase {
    * backoff never stalls the other local writers queued behind it. Safe because every
    * locked body is atomic and re-runnable (the contract on {@link withWriteLock}).
    *
-   * Also carries {@link loadSchema}'s distributed DDL, the one caller that runs BEFORE
+   * Also carries {@link applyControlSchema}'s distributed DDL, the one caller that runs BEFORE
    * `initialized` is set — so it reaches this method directly rather than through
    * {@link execWrite}, whose {@link ensureInitialized} would reject it. The write queue is
    * necessarily empty at that point, so the lock is uncontended there; it is taken anyway
-   * rather than carving out a lockless path. It is also the ONLY caller that passes a
-   * `policy` — everything else takes the default, whose classifier and attempt count are
-   * unchanged by that call site existing.
+   * rather than carving out a lockless path.
+   *
+   * Two policies reach here besides the default: `SCHEMA_INIT_RETRY_POLICY` from that one
+   * call site, and `LOST_UPDATE_RETRY_POLICY` from the `CadrePeer` writers that re-read the
+   * row inside their body ({@link updateSelfPeerRecord} directly; {@link reauthorizeCadrePeer},
+   * {@link deleteCadrePeer} and {@link removeMachine} through {@link mutateCadrePeer}'s
+   * policy parameter). Everything else takes the default, whose classifier and attempt count
+   * are unchanged by those call sites existing.
    *
    * `label` names the operation in this loop's debug lines and nothing else
    * ({@link ControlWriteRetryOptions.label}). Every call site in this class supplies one:
@@ -3707,12 +4292,27 @@ export class ControlDatabase {
     token: string,
     sAppId: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string,
+    signMessage: ControlSign,
     options: { expiresAtMs?: number; totalUses?: number; validationUrl?: string; strandId?: string } = {}
   ): Promise<void> {
     this.ensureInitialized();
     log('Inserting formation invite: %s', token);
+    const insert = await this.signFormationInviteInsert(token, sAppId, ownerKey, signMessage, options);
+    await this.execWrite(insert.sql, insert.params, 'formation-invite-insert');
+    log('Formation invite inserted: %s', token);
+  }
 
+  /**
+   * The stamped, owner-signed `FormationInvite` insert that {@link insertFormationInvite} and
+   * {@link insertFoundingRows} run. Reads the engine once, for the canonical `ExpiresAt`.
+   */
+  private async signFormationInviteInsert(
+    token: string,
+    sAppId: string,
+    ownerKey: string,
+    signMessage: ControlSign,
+    options: { expiresAtMs?: number; totalUses?: number; validationUrl?: string; strandId?: string }
+  ): Promise<SignedInsert> {
     const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
 
     // Build each bound field exactly as the deferred CHECK sees it post-coercion:
@@ -3734,26 +4334,27 @@ export class ControlDatabase {
     const message = buildAuthorizationMessage('CadreControl.FormationInvite', 'add', this.config.partyId, [
       token, sAppId, expiresAtField, totalUsesField, validationUrlField, strandIdField, stampId,
     ]);
-    const signature = signMessage(message);
+    const signature = await signMessage(message);
 
     // Persist the canonical ExpiresAt string (datetime parse is idempotent on it) so the
     // signed source-of-truth and the stored value are produced once. StampId is a real,
     // unique column (single-use anti-replay), no longer a context value.
-    await this.execWrite(`
-      insert into CadreControl.FormationInvite (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?, ?, ?)
-    `, [
-      ownerKey, signature,
-      token, sAppId,
-      expiresAtCanonical,
-      options.totalUses ?? null,
-      options.validationUrl ?? null,
-      options.strandId ?? null,
-      stampId,
-    ], 'formation-invite-insert');
-
-    log('Formation invite inserted: %s', token);
+    return {
+      sql: `
+        insert into CadreControl.FormationInvite (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?, ?, ?, ?, ?)
+      `,
+      params: [
+        ownerKey, signature,
+        token, sAppId,
+        expiresAtCanonical,
+        options.totalUses ?? null,
+        options.validationUrl ?? null,
+        options.strandId ?? null,
+        stampId,
+      ],
+    };
   }
 
   /**
@@ -3842,13 +4443,13 @@ export class ControlDatabase {
       await this.inTransaction('redemption', async () => {
         // 1. Strand row — authorised by the FormationUsage branch (no owner sig),
         //    still carrying a fresh unique StampId for the anti-replay column.
-        //    Hard-coded open + keyless + explicit null FounderOwnerKey: the
+        //    Hard-coded open + keyless + explicit null founder columns: the
         //    consent branch admits no other shape (no signature means no
-        //    trustworthy founder machine to record — see the schema's NOTE).
+        //    trustworthy founder machine to record — see the schema's comment).
         await this.db!.exec(`
-          insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey)
+          insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey, FounderPeerId)
             with context OwnerKey = null, Signature = null
-            values (?, 'o', null, ?, null)
+            values (?, 'o', null, ?, null, null)
         `, [strandId, strandStampId]);
 
         // 2. FormationUsage row — authorised by the matching FormationInvite, and
@@ -3876,14 +4477,13 @@ export class ControlDatabase {
    * Use {@link redeemInvitation} instead when the strand must be created by
    * consent atomically with the usage.
    *
-   * The strand's live `StampId` is read first and written onto the usage row:
+   * The strand's live `StampId` is written onto the usage row:
    * `FormationUsage.StrandExists` matches the (id, stamp) PAIR, and
    * `Strand.AuthorizedInsert`'s consent branch reads the same pair back, so a consent
-   * record authorizes exactly the strand ROW it was recorded against. A missing strand
-   * THROWS here rather than being left to the deferred `StrandExists` CHECK — the
-   * ordinary "host strand has not converged yet" case is already reported as `missing`
-   * by {@link ControlFormationUsageRecorder.resolveStrand}, so an absent row at this
-   * point is a genuine race and deserves a named error, not a silent rollback.
+   * record authorizes exactly the strand ROW it was recorded against. A caller that already
+   * read the stamp passes it (`strandStampId`); otherwise it is read here first, and a
+   * missing strand THROWS {@link MissingHostStrandError} rather than being left to the
+   * deferred `StrandExists` CHECK.
    *
    * The row is keyed by the joiner's own nonce (`UsageStampId` is the primary key), so this
    * path — the one production actually races on (a bound invite published by `cadre-web` /
@@ -3918,6 +4518,13 @@ export class ControlDatabase {
      * {@link queryFormationInvite} read; `null` means "no invite row" / unlimited.
      */
     totalUses?: number | null;
+    /**
+     * The host strand's `StampId`, when the caller already read the row
+     * ({@link queryStrandWithStamp}); `undefined` reads it here. A stamp is fixed for the life
+     * of its row, so one read earlier is the stamp `StrandExists` compares, unless the row was
+     * removed (and re-seated) in between, which that CHECK refuses at commit.
+     */
+    strandStampId?: string;
   }): Promise<FormationUsageResult> {
     this.ensureInitialized();
     const {
@@ -3928,7 +4535,7 @@ export class ControlDatabase {
 
     // The host strand is pre-existing and owner-signed; its stamp names the strand ROW the
     // consent record authorizes.
-    const strandStampId = await this.queryStrandStampId(strandId);
+    const strandStampId = params.strandStampId ?? await this.queryStrandStampId(strandId);
     if (strandStampId === null) {
       throw new MissingHostStrandError(strandId, token);
     }
@@ -4072,7 +4679,7 @@ export class ControlDatabase {
    * permissive PRE-check that runs ahead of it, and a transiently short read costs each of
    * them only a worse outcome for the ATTEMPT, never a seat the invitation did not pay for:
    * {@link assertSeatRemains} loses its named exhaustion error and falls back to the CHECK's
-   * generic refusal; `ControlFormationUsageRecorder.isTokenUsed` reports not-used and lets
+   * generic refusal; `ControlFormationUsageRecorder.readToken` reports a seat free and lets
    * the redemption proceed to the CHECK, which decides; {@link hasOutstandingFormationInvite}
    * holds the stranger-admission door open slightly longer.
    *
@@ -4106,12 +4713,12 @@ export class ControlDatabase {
   /**
    * Is any `FormationInvite` row still redeemable — unexpired AND with usage
    * below its `TotalUses`? A null `ExpiresAt` never expires and a null
-   * `TotalUses` is unlimited, matching {@link ControlFormationUsageRecorder}'s
-   * per-token semantics (`isTokenValid` / `isTokenUsed`).
+   * `TotalUses` is unlimited, matching the per-token semantics of `classifyTokenRead`
+   * (`formation-token.ts`).
    *
    * Answers the control-network connection gate's coarse "does this node expect
    * a stranger?" question, which has no token to ask about. The expiry
-   * comparison is `expiresAtMs <= now` — identical to `isTokenValid`'s — so an
+   * comparison is `expiresAtMs <= now` — identical to `isInviteExpired`'s — so an
    * invite the formation handler would reject can never hold the gate open.
    *
    * The scan is deliberately not pushed into SQL: nothing else here compares a
@@ -4180,84 +4787,121 @@ export class ControlDatabase {
    * private half to the invitee out of band. It is never stored here (`Strand.Invite` has the
    * same shape).
    *
-   * @param invite.key - the invitation public key (base64url ed25519), the row's primary key
-   * @param invite.peerId - the device the invitation is for, or null for whoever redeems first
-   * @param invite.grantsOwner - whether redemption also seats an `OwnerKey` row for the device
-   * @param invite.expiresAtMs - epoch ms after which it cannot be redeemed; omit for never
-   * @param invite.totalUses - how many redemptions it allows; omit for unlimited
    * @returns the row as stored, `expiresAt` in its canonical form
    */
-  async insertCadreInvite(
-    invite: {
-      key: string;
-      peerId?: string | null;
-      grantsOwner: boolean;
-      expiresAtMs?: number | null;
-      totalUses?: number | null;
-    },
-    ownerKey: string,
-    signMessage: (message: Uint8Array) => string
-  ): Promise<CadreInviteRow> {
+  async insertCadreInvite(invite: CadreInviteFields, ownerKey: string, signMessage: ControlSign): Promise<CadreInviteRow> {
+    const row = await this.signCadreInvite(invite, ownerKey, signMessage);
+    await this.lockedWithRetry(() => this.execCadreInviteInsert(row), {}, 'cadre-invite-insert');
+    log('Cadre invitation inserted: %s (peer=%s)', row.key, row.peerId ?? 'any');
+    return row;
+  }
+
+  /**
+   * Build and owner-sign a `CadreInvite` row WITHOUT inserting it: the signing half of
+   * {@link insertCadreInvite}, which `CadreNode.joinWithOwnerGrant` uses alone for the
+   * invitation a node issues to itself, since a store that holds no `OwnerKey` row for the
+   * issuer would refuse the local insert and the row is seated at a member from the bundle
+   * instead. `ExpiresAt` is canonicalized by this database's engine, which is a format, not a
+   * store, so the row reads the same wherever it is seated.
+   */
+  async signCadreInvite(invite: CadreInviteFields, ownerKey: string, signMessage: ControlSign): Promise<CadreInviteRow> {
     this.ensureInitialized();
     const key = requireEd25519PublicKeyB64(invite.key, 'cadre invitation key');
     const signed: CadreInviteSignedFields = {
       key,
       peerId: invite.peerId ?? null,
-      grantsOwner: invite.grantsOwner,
       expiresAt: invite.expiresAtMs == null ? null : await canonicalDatetime(this.db!, invite.expiresAtMs),
       totalUses: invite.totalUses ?? null,
       stampId: generateStampId(this.config.libp2pNode.peerId.toString()),
     };
-    const row: CadreInviteRow = {
+    return {
       ...signed,
       issuerKey: ownerKey,
-      issuerSig: signMessage(cadreInviteAddMessage(this.config.partyId, signed)),
+      issuerSig: await signMessage(cadreInviteAddMessage(this.config.partyId, signed)),
     };
-    await this.lockedWithRetry(() => this.execCadreInviteInsert(row), {}, 'cadre-invite-insert');
-    log('Cadre invitation inserted: %s (peer=%s owner=%s)', key, row.peerId ?? 'any', row.grantsOwner);
-    return row;
   }
 
   /**
    * Seat an owner-signed `CadreInvite` row received inside an invitation bundle, under its own
    * stored `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, so a member that
-   * already holds the row (by replication, or from an earlier redemption attempt) is a no-op.
+   * already holds the row (by replication, or from an earlier redemption attempt) is a no-op,
+   * and so is one whose insert the cohort refuses because a member there holds it.
    *
    * @returns `true` when this call inserted the row, `false` when it was already present.
    * @throws {CadreInviteIssuerUnknownError} when `CadreInvite.AuthorizedInsert` refuses it: the
    *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
-   *   not verify. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+   *   not verify. {@link IssuedRowNotHereYetError} when the cohort holds the row and this node
+   *   cannot read it yet. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
    */
   async seatCadreInvite(row: CadreInviteRow): Promise<boolean> {
+    return this.seatIssuedRow('CadreInvite', row.key, () => this.execCadreInviteInsert(row),
+      cause => new CadreInviteIssuerUnknownError(row.key, row.issuerKey, { cause }));
+  }
+
+  /**
+   * Insert-if-absent of an issued row from a bundle's copy, under the write lock: the body of
+   * {@link seatCadreInvite} and {@link seatOwnerGrant}. `exec` runs the bare insert under the
+   * row's own stored issuer pair.
+   *
+   * @returns `true` when this call inserted the row, `false` when it was already present —
+   *   here, or at the cohort member that refused the insert for holding it
+   *   ({@link adoptCohortHeldRow}).
+   * @throws `refuse(cause)` when the table's `AuthorizedInsert` refuses the row;
+   *   {@link IssuedRowNotHereYetError} when the cohort holds the row and this node still cannot
+   *   read it; every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+   */
+  private async seatIssuedRow(table: IssuedTable, key: string, exec: () => Promise<void>, refuse: (cause: unknown) => Error): Promise<boolean> {
     this.ensureInitialized();
     try {
       return await this.lockedWithRetry(async () => {
         // retry: false — inside the locked write body (see queryStampId's NOTE).
-        if (await this.queryStampId('CadreInvite', row.key, false) !== null) {
-          log('CadreInvite %s already seated; seat skipped', row.key);
+        if (await this.queryStampId(table, key, false) !== null) {
+          log('%s %s already seated; seat skipped', table, key);
           return false;
         }
-        await this.execCadreInviteInsert(row);
-        log('Cadre invitation seated from its bundle: %s', row.key);
+        await exec();
+        log('%s seated from its bundle: %s', table, key);
         return true;
-      }, {}, 'cadre-invite-seat');
+      }, {}, `${ISSUED_TABLE_REASON[table]}-seat`);
     } catch (error) {
-      if (errorChainMatches(error, CADRE_INVITE_UNAUTHORIZED)) {
-        throw new CadreInviteIssuerUnknownError(row.key, row.issuerKey, { cause: error });
+      if (errorChainMatches(error, ISSUER_UNAUTHORIZED)) {
+        throw refuse(error);
+      }
+      if (isIssuedRowKeyConflict(error, table)) {
+        return await this.adoptCohortHeldRow(table, key, error);
       }
       throw error;
     }
   }
 
+  /**
+   * The seat's insert was refused because a cohort member already holds a row under `key`, which
+   * this node's guard read missed because its store lags the cohort. A bundle's copy is verbatim
+   * and every column is under the issuer's signature, so the held row is this one: it counts as
+   * seated once a refreshing read (unlocked, so retried as any read) finds it here.
+   *
+   * @throws {IssuedRowNotHereYetError} when the read still does not find it.
+   */
+  private async adoptCohortHeldRow(table: IssuedTable, key: string, conflict: unknown): Promise<false> {
+    // NOTE: while another locked body runs here, this read takes readRowsOnce's committed path,
+    // which does not refresh from the cohort, so it can miss the row and refuse a retryable
+    // `conflict`; if that refusal shows up in practice, wait for the running body before reading.
+    if (await this.queryStampId(table, key) === null) {
+      throw new IssuedRowNotHereYetError(table, key, { cause: conflict });
+    }
+    log('%s %s is held by the cohort; seat skipped', table, key);
+    return false;
+  }
+
   /** Bare `CadreInvite` insert shared by {@link insertCadreInvite} and {@link seatCadreInvite}; the caller holds the lock. */
   private async execCadreInviteInsert(row: CadreInviteRow): Promise<void> {
     await this.db!.exec(`
-      insert into CadreControl.CadreInvite (Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
+      insert into CadreControl.CadreInvite (Key, PeerId, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
         with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?, ?, ?, ?)
+        values (?, ?, ?, ?, ?, ?, ?)
     `, [
       row.issuerKey, row.issuerSig,
-      row.key, row.peerId, row.grantsOwner ? 1 : 0, row.expiresAt, row.totalUses,
+      row.key, row.peerId, row.expiresAt, row.totalUses,
       row.issuerKey, row.issuerSig, row.stampId,
     ]);
   }
@@ -4267,8 +4911,10 @@ export class ControlDatabase {
    * the row is the holder's proof and never goes away; liveness is {@link hasLiveCadreInvite}'s
    * question, and `CadreInviteUsage.Authorized`'s at redemption.
    *
-   * `retry: false` is passed by {@link redeemCadreInvite}, which reads INSIDE its locked write
-   * body — the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
+   * A redemption reads the row once, before its write, and carries it into
+   * {@link isCadreInviteLive} and {@link redeemCadreInvite}. `retry: false` is passed by
+   * {@link redeemCadreInvite} when it was handed none and reads INSIDE its locked write body —
+   * the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
    */
   async queryCadreInvite(key: string, retry = true): Promise<CadreInviteRow | null> {
     this.ensureInitialized();
@@ -4286,23 +4932,16 @@ export class ControlDatabase {
    * {@link queryCadrePeers}' reason.
    */
   async queryCadreInvites(retry = true): Promise<CadreInviteRow[]> {
-    this.ensureInitialized();
-    const rows = await this.readRows(CADRE_INVITE_SELECT_SQL, undefined, 'cadre-invites', retry);
-    return rows.map(cadreInviteRowOf);
+    return (await this.readMembershipRows(this.cadreInviteView, retry)).map(cadreInviteRowOf);
   }
 
   /**
    * Every `CadreInviteUsage` row this node holds — the redemption records the membership
    * predicate verifies invitation-admitted rows against. Same `retry` contract as
-   * {@link queryCadreInvites}.
+   * {@link queryCadreInvites}; both come from their membership views ({@link readMembershipRows}).
    */
   async queryCadreInviteUsages(retry = true): Promise<CadreInviteUsageRow[]> {
-    this.ensureInitialized();
-    const rows = await this.readRows(
-      'select UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig from CadreControl.CadreInviteUsage',
-      undefined, 'cadre-invite-usages', retry
-    );
-    return rows.map(cadreInviteUsageRowOf);
+    return (await this.readMembershipRows(this.cadreInviteUsageView, retry)).map(cadreInviteUsageRowOf);
   }
 
   /**
@@ -4313,9 +4952,13 @@ export class ControlDatabase {
    * `retry: false` is passed by {@link assertCadreInviteSeatRemains}, inside the locked body.
    */
   async countCadreInviteUsage(key: string, retry = true): Promise<number> {
+    return this.countUsageRows('select count(1) as Count from CadreControl.CadreInviteUsage where InviteKey = ?', key, 'cadre-invite-usage-count', retry);
+  }
+
+  /** The one-row count read behind {@link countCadreInviteUsage} and {@link countOwnerGrantUsage}. */
+  private async countUsageRows(sql: string, key: string, label: string, retry: boolean): Promise<number> {
     this.ensureInitialized();
-    const sql = 'select count(1) as Count from CadreControl.CadreInviteUsage where InviteKey = ?';
-    for (const row of await this.readRows(sql, [key], 'cadre-invite-usage-count', retry)) {
+    for (const row of await this.readRows(sql, [key], label, retry)) {
       return (row.Count as number) ?? 0;
     }
     return 0;
@@ -4344,6 +4987,9 @@ export class ControlDatabase {
     // counts make that free today; if a long-lived cadre accumulates thousands and inbound
     // upgrades slow down, add an expiry-ordered index or prune withdrawn/expired rows (which
     // first needs every device they admitted re-vouched, so the chain no longer needs them).
+    // NOTE: this scan reaches storage while queryCadreInvites serves the same rows from the
+    // membership view; if the stranger path's reads ever near the gate's 2 s deadline, walk
+    // queryCadreInvites() here instead.
     const metered: Array<{ key: string; totalUses: number }> = [];
     let unlimitedLive = false;
     for (const row of await this.readRows(
@@ -4351,7 +4997,7 @@ export class ControlDatabase {
       undefined,
       'live-cadre-invites'
     )) {
-      const open = cadreInviteStillOpen(
+      const open = issuedRowStillOpen(
         { stampId: row.StampId as string, issuerKey: row.IssuerKey as string, expiresAt: (row.ExpiresAt as string | null) ?? null },
         withdrawn, owners, nowMs
       );
@@ -4381,24 +5027,42 @@ export class ControlDatabase {
 
   /**
    * Is this one cadre invitation still redeemable here — the conditions
-   * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is the one this node
-   * holds under `invite.key`; when it holds none, `invite` itself (a bundle's copy, not seated
-   * yet), but only if its issuer signature verifies, because an unsigned copy would otherwise be
-   * judged by whichever owner it names as issuer. A permissive pre-check like
-   * {@link countCadreInviteUsage}: {@link seatCadreInvite} and the redemption's own write are
-   * what enforce every condition.
-   */
-  async isCadreInviteLive(invite: CadreInviteRow, nowMs: number = Date.now()): Promise<boolean> {
+   * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is `held`, the one this
+   * node holds under `invite.key` ({@link queryCadreInvite}, read by the caller); when it holds
+   * none, `invite` itself (a bundle's copy, not seated yet), but only if its issuer signature
+   * verifies, because an unsigned copy would otherwise be judged by whichever owner it names as
+   * issuer. A permissive pre-check like {@link countCadreInviteUsage}: {@link seatCadreInvite}
+   * and the redemption's own write are what enforce every condition.
+   *
+   * The use count read here is read again inside the redemption's write lock
+   * ({@link assertCadreInviteSeatRemains}), on purpose: this one decides whether the device is
+   * pushed the control store before the write, so the holder of a spent invitation is refused
+   * without being sent anything; the in-lock one decides the seat, against a concurrent redemption.
+   */
+  async isCadreInviteLive(invite: CadreInviteRow, held: CadreInviteRow | null, nowMs: number = Date.now()): Promise<boolean> {
     this.ensureInitialized();
-    const row = await this.queryCadreInvite(invite.key) ?? (verifyCadreInviteRow(this.config.partyId, invite) ? invite : null);
+    const row = held ?? (verifyCadreInviteRow(this.config.partyId, invite) ? invite : null);
+    return this.issuedRowLive('CadreInvite', row, nowMs, key => this.countCadreInviteUsage(key));
+  }
+
+  /**
+   * The body of {@link isCadreInviteLive} and {@link isOwnerGrantLive}: is `row` (the one held,
+   * or a verified bundle copy; null for neither) still open and under its use cap?
+   */
+  private async issuedRowLive(
+    table: IssuedTable,
+    row: { key: string; stampId: string; issuerKey: string; expiresAt: string | null; totalUses: number | null } | null,
+    nowMs: number,
+    countUsage: (key: string) => Promise<number>
+  ): Promise<boolean> {
     if (row === null) {
       return false;
     }
-    const [withdrawn, owners] = await Promise.all([this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()]);
-    if (!cadreInviteStillOpen(row, withdrawn, owners, nowMs)) {
+    const [withdrawn, owners] = await Promise.all([this.queryRevokedStamps(table), this.getOwnerKeys()]);
+    if (!issuedRowStillOpen(row, withdrawn, owners, nowMs)) {
       return false;
     }
-    return row.totalUses === null || await this.countCadreInviteUsage(row.key) < row.totalUses;
+    return row.totalUses === null || await countUsage(row.key) < row.totalUses;
   }
 
   /**
@@ -4409,22 +5073,34 @@ export class ControlDatabase {
    * occasional read, not a gate's.
    */
   async listCadreInviteStatuses(nowMs: number = Date.now()): Promise<CadreInviteStatus[]> {
+    const standings = await this.issuedRowStandings('CadreInvite', await this.queryCadreInvites(), nowMs, key => this.countCadreInviteUsage(key));
+    return standings.map(({ row, ...standing }) => ({ invite: row, ...standing }));
+  }
+
+  /**
+   * The body of {@link listCadreInviteStatuses} and {@link listOwnerGrantStatuses}: each of
+   * `rows` with its withdrawal, its recorded uses and whether it is still redeemable.
+   */
+  private async issuedRowStandings<Row extends { key: string; stampId: string; issuerKey: string; expiresAt: string | null; totalUses: number | null }>(
+    table: IssuedTable,
+    rows: readonly Row[],
+    nowMs: number,
+    countUsage: (key: string) => Promise<number>
+  ): Promise<Array<IssuedRowStanding<Row>>> {
     this.ensureInitialized();
-    const [invites, withdrawnStamps, owners] = await Promise.all([
-      this.queryCadreInvites(), this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()
-    ]);
-    const statuses: CadreInviteStatus[] = [];
-    // NOTE: one retried count read per invitation, withdrawn and expired rows included, since
-    // rows are never deleted; if a long-lived cadre's listing ever shows as slow, group the
-    // usage counts in one statement or skip the count for rows that are no longer open.
-    for (const invite of invites) {
-      const usesRecorded = await this.countCadreInviteUsage(invite.key);
-      const withdrawn = withdrawnStamps.has(invite.stampId);
-      const live = cadreInviteStillOpen(invite, withdrawnStamps, owners, nowMs)
-        && (invite.totalUses === null || usesRecorded < invite.totalUses);
-      statuses.push({ invite, live, withdrawn, usesRecorded });
+    const [withdrawnStamps, owners] = await Promise.all([this.queryRevokedStamps(table), this.getOwnerKeys()]);
+    const standings: Array<IssuedRowStanding<Row>> = [];
+    // NOTE: one retried count read per row, withdrawn and expired rows included, since rows
+    // are never deleted; if a long-lived cadre's listing ever shows as slow, group the usage
+    // counts in one statement or skip the count for rows that are no longer open.
+    for (const row of rows) {
+      const usesRecorded = await countUsage(row.key);
+      const withdrawn = withdrawnStamps.has(row.stampId);
+      const live = issuedRowStillOpen(row, withdrawnStamps, owners, nowMs)
+        && (row.totalUses === null || usesRecorded < row.totalUses);
+      standings.push({ row, live, withdrawn, usesRecorded });
     }
-    return statuses;
+    return standings;
   }
 
   /**
@@ -4447,66 +5123,75 @@ export class ControlDatabase {
   async withdrawCadreInvite(
     key: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<boolean> {
+    return this.withdrawIssuedRow('CadreInvite', key, ownerKey, signMessage);
+  }
+
+  /**
+   * The body of {@link withdrawCadreInvite} and {@link withdrawOwnerGrant}: under the write
+   * lock, file the owner-signed tombstone retiring the row's stamp with the row kept, and fire
+   * the guarded-delete listener for it (so a withdrawal made while alone is re-issued).
+   */
+  private async withdrawIssuedRow(table: IssuedTable, key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean> {
     this.ensureInitialized();
     const filed = await this.lockedWithRetry(async (): Promise<RevokedRowRef | null> => {
-      const [withdrawal] = await this.signCadreInviteWithdrawals([key], signMessage);
+      const [withdrawal] = await this.signWithdrawals(table, [key], signMessage);
       if (withdrawal === undefined) {
         return null;
       }
       await this.execTombstone(withdrawal.ref, withdrawal.signature, ownerKey);
       return withdrawal.ref;
-    }, {}, 'cadre-invite-withdraw');
+    }, {}, `${ISSUED_TABLE_REASON[table]}-withdraw`);
     if (filed === null) {
       return false;
     }
-    log('Cadre invitation withdrawn: %s (stamp %s retired, row kept)', key, filed.stampId);
+    log('%s withdrawn: %s (stamp %s retired, row kept)', table, key, filed.stampId);
     this.notifyGuardedDelete(filed);
     return true;
   }
 
   /**
-   * The withdrawal tombstones for the `CadreInvite` rows among `keys` that are held here and
-   * not yet withdrawn, signed and ready for {@link execTombstone}: the body
-   * {@link withdrawCadreInvite} files one of and {@link removeMachine} files several of in one
+   * The withdrawal tombstones for the `table` rows among `keys` that are held here and not
+   * yet withdrawn, signed and ready for {@link execTombstone}: the body
+   * {@link withdrawIssuedRow} files one of and {@link removeMachine} files several of in one
    * transaction. Inside the locked body (every read `retry: false`); an absent or already
    * withdrawn key is logged and left out.
    */
-  private async signCadreInviteWithdrawals(
+  private async signWithdrawals(
+    table: IssuedTable,
     keys: readonly string[],
-    signMessage: (message: Uint8Array) => string
+    signMessage: ControlSign
   ): Promise<Array<{ ref: RevokedRowRef; signature: string }>> {
     if (keys.length === 0) {
       return [];
     }
-    const withdrawn = await this.queryRevokedStamps('CadreInvite', false);
+    const withdrawn = await this.queryRevokedStamps(table, false);
     const withdrawals: Array<{ ref: RevokedRowRef; signature: string }> = [];
     for (const key of keys) {
-      const stampId = await this.queryStampId('CadreInvite', key, false);
+      const stampId = await this.queryStampId(table, key, false);
       if (stampId === null) {
-        log('withdrawCadreInvite: no CadreInvite row for %s (nothing to withdraw)', key);
+        log('withdraw %s: no row for %s (nothing to withdraw)', table, key);
         continue;
       }
       if (withdrawn.has(stampId)) {
-        log('withdrawCadreInvite: %s already withdrawn (stamp %s retired)', key, stampId);
+        log('withdraw %s: %s already withdrawn (stamp %s retired)', table, key, stampId);
         continue;
       }
-      const ref: RevokedRowRef = { tableName: 'CadreInvite', rowKey: key, stampId };
-      withdrawals.push({ ref, signature: signMessage(revocationTombstoneMessage(this.config.partyId, ref)) });
+      const ref: RevokedRowRef = { tableName: table, rowKey: key, stampId };
+      withdrawals.push({ ref, signature: await signMessage(revocationTombstoneMessage(this.config.partyId, ref)) });
     }
     return withdrawals;
   }
 
   /**
-   * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member and,
-   * when the invitation grants ownership, as an owner — with NO owner signature. One
-   * transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`), the
-   * `OwnerKey` row when granted (consent branch of `Authorized`), and last the
-   * `CadreInviteUsage` row that authorizes both; the usage row's own checks (`PeerExists`,
-   * `OwnerExists`) read the rows back, so the three are mutually bound to this exact
-   * redemption and none can be held in reserve. The invitation must already be committed
-   * ({@link seatCadreInvite}): every consent branch reads `committed.CadreInvite`.
+   * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member —
+   * with NO owner signature, and as a machine only (ownership is {@link redeemOwnerGrant}'s).
+   * One transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`) and then
+   * the `CadreInviteUsage` row that authorizes it; the usage row's own check (`PeerExists`)
+   * reads the peer row back, so the two are mutually bound to this exact redemption and
+   * neither can be held in reserve. The invitation must already be committed
+   * ({@link seatCadreInvite}): the consent branch reads `committed.CadreInvite`.
    *
    * The two signatures are the holder's and the device's, minted on the device over
    * {@link cadreInviteRedeemMessage} / {@link cadreInviteConsentMessage}; this machine only
@@ -4515,26 +5200,41 @@ export class ControlDatabase {
    * (`verifyInvitationAdmission`) — a mismatched pair is written and then never trusted.
    *
    * Idempotent for a retry after a dropped reply: when the device's row is already present
-   * (and its `OwnerKey` row too, when granted) nothing is written and no seat is spent —
-   * `alreadyMember: true`. A present row whose `OwnerKey` row is missing under an
-   * owner-granting invitation is completed: the usage row then names the existing peer stamp.
-   * The seat check ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a
-   * single-use redemption is answered `alreadyMember` rather than refused as exhausted.
+   * nothing is written and no seat is spent — `alreadyMember: true`. The seat check
+   * ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a single-use
+   * redemption is answered `alreadyMember` rather than refused as exhausted.
    *
    * Through {@link mutateCadrePeer}, so the membership hub is notified; inside the locked body
    * every read passes `retry: false` and every stamp is minted per attempt, so a
    * {@link lockedWithRetry} re-run starts clean.
    *
    * @throws {InvitationExhaustedError} when the invitation's seats are all spent (by name,
-   *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains}).
+   *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains});
+   *   {@link IssuedRowNotHereYetError} when no `CadreInvite` row is readable here.
    */
   async redeemCadreInvite(params: {
     inviteKey: string;
+    /**
+     * The row this node holds under `inviteKey`, read before the call ({@link queryCadreInvite});
+     * omitted, it is read inside the locked body. Never a bundle's copy: the requester chooses a
+     * copy's `TotalUses` and `IssuerKey`, and the seat check must judge the stored cap. The
+     * schema refuses every update and delete of the row (`NoUpdate`, `NoDelete`), so the earlier
+     * read is the row a locked read would return; withdrawal is a `Revocation` row, which the schema's
+     * `NotRevoked` and `Authorized` checks still read at commit.
+     */
+    held?: CadreInviteRow;
     peerId: string;
     /** The device's ed25519 public key (base64url); `peerId` is its identity multihash. */
     peerKey: string;
     /** The device's dialable addresses, if known; stored comma-joined as `authorizePeer` does. */
     multiaddrs?: string[];
+    /**
+     * The rest of the device's own signed address record over `multiaddrs`, already verified by
+     * the caller (`admittedRecord` in `cadre-invite-protocol.ts`): stored as the row's
+     * `UpdatedAt`, `Sig` and `Profile`, so the row resolves to the device's addresses from its
+     * admission. Omitted, the row is written unsigned, `UpdatedAt` at this machine's clock.
+     */
+    record?: Pick<PeerAddressRecord, 'updatedAt' | 'profile' | 'sig'>;
     /** Single-use nonce minted by the device; both signatures cover it. */
     usageStampId: string;
     /** The holder's signature with the invitation private key over the `'redeem'` digest. */
@@ -4544,72 +5244,48 @@ export class ControlDatabase {
     nowMs?: number;
   }): Promise<CadreInviteRedemptionResult> {
     this.ensureInitialized();
-    const { inviteKey, peerId, peerKey, usageStampId, inviteSig, peerSig } = params;
+    const { inviteKey, peerId, peerKey, record, usageStampId, inviteSig, peerSig } = params;
     const nowMs = params.nowMs ?? Date.now();
     const multiaddr = params.multiaddrs?.length ? params.multiaddrs.join(',') : '';
     log('Redeeming cadre invitation %s for %s', inviteKey, peerId);
 
     return this.mutateCadrePeer('cadre-invite-redeem', async () => {
-      const invite = await this.queryCadreInvite(inviteKey, false);
+      const invite = params.held ?? await this.queryCadreInvite(inviteKey, false);
       if (invite === null) {
-        throw new Error(`Cannot redeem cadre invitation ${inviteKey}: no CadreInvite row is seated on this node (seatCadreInvite first)`);
+        throw new IssuedRowNotHereYetError('CadreInvite', inviteKey);
       }
-      const seated = await this.readSeatedAdmission(peerId, peerKey, invite.grantsOwner);
-      if (seated.peerStampId !== null && (!invite.grantsOwner || seated.ownerStampId !== null)) {
+      // A raw stamp read (queryStampId), so a physically present row counts; inside the locked
+      // body, so never retried.
+      const seatedPeerStampId = await this.queryStampId('CadrePeer', peerId, false);
+      if (seatedPeerStampId !== null) {
         log('redeemCadreInvite: %s already admitted; nothing written', peerId);
-        return { alreadyMember: true, peerStampId: seated.peerStampId, ownerStampId: seated.ownerStampId };
+        return { alreadyMember: true, peerStampId: seatedPeerStampId };
       }
       await this.assertCadreInviteSeatRemains(invite);
 
-      // Stamps minted from the ADMITTED device's id, as insertCadrePeer does: the nonce names
-      // the row it seats. Minted inside the body, so a re-run mints afresh over a rolled-back
-      // attempt rather than re-presenting a stamp the usage row may already name.
-      const peerStampId = seated.peerStampId ?? generateStampId(peerId);
-      const ownerStampId = invite.grantsOwner ? (seated.ownerStampId ?? generateStampId(peerId)) : null;
+      // The stamp is minted from the ADMITTED device's id, as insertCadrePeer does: the nonce
+      // names the row it seats. Minted inside the body, so a re-run mints afresh over a
+      // rolled-back attempt rather than re-presenting a stamp the usage row may already name.
+      const peerStampId = generateStampId(peerId);
       const nowCanonical = await canonicalDatetime(this.db!, nowMs);
       await this.inTransaction('cadre-invite-redeem', async () => {
-        if (seated.peerStampId === null) {
-          await this.db!.exec(`
-            insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig, VouchUsage)
-              with context OwnerKey = null, Signature = null
-              values (?, ?, ?, ?, null, ?, ?, null, ?)
-          `, [peerId, peerKey, multiaddr, nowMs, peerStampId, invite.issuerKey, usageStampId]);
-        }
-        if (ownerStampId !== null && seated.ownerStampId === null) {
-          await this.db!.exec(`
-            insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig, VouchUsage)
-              with context OwnerKey = null, Signature = null
-              values (?, ?, ?, null, ?)
-          `, [peerKey, ownerStampId, invite.issuerKey, usageStampId]);
-        }
         await this.db!.exec(`
-          insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig)
+          insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, Profile, StampId, VouchOwner, VouchSig, VouchUsage)
+            with context OwnerKey = null, Signature = null
+            values (?, ?, ?, ?, ?, ?, ?, ?, null, ?)
+        `, [peerId, peerKey, multiaddr, record?.updatedAt ?? nowMs, record?.sig ?? null, record?.profile ?? null,
+          peerStampId, invite.issuerKey, usageStampId]);
+        await this.db!.exec(`
+          insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, InviteSig, PeerSig)
             with context Now = ?
-            values (?, ?, ?, ?, ?, ?, ?, ?)
-        `, [nowCanonical, usageStampId, inviteKey, peerId, peerKey, peerStampId, ownerStampId, inviteSig, peerSig]);
+            values (?, ?, ?, ?, ?, ?, ?)
+        `, [nowCanonical, usageStampId, inviteKey, peerId, peerKey, peerStampId, inviteSig, peerSig]);
       });
-      log('Redeemed cadre invitation %s: %s admitted (owner=%s, usage %s)', inviteKey, peerId, ownerStampId !== null, usageStampId);
-      return { alreadyMember: false, peerStampId, ownerStampId };
+      log('Redeemed cadre invitation %s: %s admitted (usage %s)', inviteKey, peerId, usageStampId);
+      return { alreadyMember: false, peerStampId };
     });
   }
 
-  /**
-   * The rows a redemption would seat that are already present: the device's `CadrePeer`
-   * stamp, and — only when the invitation grants ownership — its `OwnerKey` stamp. Raw stamp
-   * reads ({@link queryStampId}), so a physically present row counts; inside the locked
-   * body, so never retried.
-   */
-  private async readSeatedAdmission(
-    peerId: string,
-    peerKey: string,
-    grantsOwner: boolean
-  ): Promise<{ peerStampId: string | null; ownerStampId: string | null }> {
-    return {
-      peerStampId: await this.queryStampId('CadrePeer', peerId, false),
-      ownerStampId: grantsOwner ? await this.queryStampId('OwnerKey', peerKey, false) : null,
-    };
-  }
-
   /**
    * Refuse a redemption that would consume a seat the cadre invitation does not have, by
    * name ({@link InvitationExhaustedError}) — the cadre-invitation twin of
@@ -4617,20 +5293,267 @@ export class ControlDatabase {
    * generic `Authorized` failure a caller would otherwise report as retryable. Reads the
    * committed count inside the locked body, so on a same-node race the loser is refused here.
    */
-  private async assertCadreInviteSeatRemains(invite: CadreInviteRow): Promise<void> {
-    if (invite.totalUses === null) {
+  private assertCadreInviteSeatRemains(invite: CadreInviteRow): Promise<void> {
+    return this.assertIssuedSeatRemains(invite, key => this.countCadreInviteUsage(key, false));
+  }
+
+  /** The body of {@link assertCadreInviteSeatRemains} and {@link assertOwnerGrantSeatRemains}; `countUsage` reads inside the locked body. */
+  private async assertIssuedSeatRemains(row: { key: string; totalUses: number | null }, countUsage: (key: string) => Promise<number>): Promise<void> {
+    if (row.totalUses === null) {
       return;
     }
-    const used = await this.countCadreInviteUsage(invite.key, false);
-    if (used >= invite.totalUses) {
-      throw new InvitationExhaustedError(invite.key, used, invite.totalUses);
+    const used = await countUsage(row.key);
+    if (used >= row.totalUses) {
+      throw new InvitationExhaustedError(row.key, used, row.totalUses);
+    }
+  }
+
+  // ── Owner grants (OwnerGrant / OwnerGrantUsage) ─────────────────────────────────────────
+
+  /**
+   * Mint and insert an owner-signed `OwnerGrant`: a grant of ownership to whoever holds the
+   * grant's private half, redeemable through any member machine ({@link redeemOwnerGrant})
+   * to seat an owner key the holder generates or already holds. No machine is admitted and no
+   * peer id is named. The grant twin of {@link insertCadreInvite}: the owner signs the whole
+   * row ({@link ownerGrantAddMessage}), `ExpiresAt` through {@link canonicalDatetime}, and
+   * the returned row is what the grant bundle carries, re-inserted verbatim by
+   * {@link seatOwnerGrant} on a member that has not received it by replication.
+   *
+   * @param grant.key - the grant's ed25519 PUBLIC key (base64url), the row's primary key; the
+   *   caller minted the pair and hands the private half to the holder out of band
+   * @param grant.label - the label every key this grant seats will carry
+   *   ({@link ownerKeyLabel}'s rule: trimmed, at most 64 characters, blank meaning none); the
+   *   issuer's choice, which the holder cannot change
+   * @param grant.expiresAtMs - epoch ms after which it cannot be redeemed; omit or null for
+   *   never. The short default lifetime is the node API's to apply, not this writer's.
+   * @param grant.totalUses - how many redemptions it allows; omit for unlimited
+   * @returns the row as stored, `expiresAt` in its canonical form
+   */
+  async insertOwnerGrant(
+    grant: { key: string; label?: string | null; expiresAtMs?: number | null; totalUses?: number | null },
+    ownerKey: string,
+    signMessage: ControlSign
+  ): Promise<OwnerGrantRow> {
+    this.ensureInitialized();
+    const key = requireEd25519PublicKeyB64(grant.key, 'owner grant key');
+    const signed: OwnerGrantSignedFields = {
+      key,
+      label: ownerKeyLabel(grant.label),
+      expiresAt: grant.expiresAtMs == null ? null : await canonicalDatetime(this.db!, grant.expiresAtMs),
+      totalUses: grant.totalUses ?? null,
+      stampId: generateStampId(this.config.libp2pNode.peerId.toString()),
+    };
+    const row: OwnerGrantRow = {
+      ...signed,
+      issuerKey: ownerKey,
+      issuerSig: await signMessage(ownerGrantAddMessage(this.config.partyId, signed)),
+    };
+    await this.lockedWithRetry(() => this.execOwnerGrantInsert(row), {}, 'owner-grant-insert');
+    log('Owner grant inserted: %s (label=%s)', key, row.label ?? 'none');
+    return row;
+  }
+
+  /**
+   * Seat an owner-signed `OwnerGrant` row received inside a grant bundle, under its own stored
+   * `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, as {@link seatCadreInvite}.
+   *
+   * @returns `true` when this call inserted the row, `false` when it was already present.
+   * @throws {OwnerGrantIssuerUnknownError} when `OwnerGrant.AuthorizedInsert` refuses it: the
+   *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
+   *   not verify. {@link IssuedRowNotHereYetError} when the cohort holds the row and this node
+   *   cannot read it yet. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+   */
+  async seatOwnerGrant(row: OwnerGrantRow): Promise<boolean> {
+    return this.seatIssuedRow('OwnerGrant', row.key, () => this.execOwnerGrantInsert(row),
+      cause => new OwnerGrantIssuerUnknownError(row.key, row.issuerKey, { cause }));
+  }
+
+  /** Bare `OwnerGrant` insert shared by {@link insertOwnerGrant} and {@link seatOwnerGrant}; the caller holds the lock. */
+  private async execOwnerGrantInsert(row: OwnerGrantRow): Promise<void> {
+    await this.db!.exec(`
+      insert into CadreControl.OwnerGrant (Key, Label, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?, ?, ?)
+    `, [
+      row.issuerKey, row.issuerSig,
+      row.key, row.label, row.expiresAt, row.totalUses,
+      row.issuerKey, row.issuerSig, row.stampId,
+    ]);
+  }
+
+  /**
+   * Read one `OwnerGrant` row by key, or null when absent. Withdrawn rows are returned too,
+   * as {@link queryCadreInvite} returns them: the row is the holder's proof and never goes
+   * away. Read once per redemption and carried into {@link isOwnerGrantLive} and
+   * {@link redeemOwnerGrant}; `retry: false` is passed by {@link redeemOwnerGrant} when it was
+   * handed none and reads inside its locked body.
+   */
+  async queryOwnerGrant(key: string, retry = true): Promise<OwnerGrantRow | null> {
+    this.ensureInitialized();
+    for (const row of await this.readRows(`${OWNER_GRANT_SELECT_SQL} where Key = ?`, [key], 'owner-grant', retry)) {
+      return ownerGrantRowOf(row);
     }
+    return null;
+  }
+
+  /**
+   * Every `OwnerGrant` row this node holds, withdrawn and expired ones included. Read by the
+   * anchor sync when at least one `OwnerKey` row is consent-seated (`CadreNode.loadOwnerGrantChain`);
+   * `retry: false` is forwarded from the membership-gate refresh for {@link queryCadrePeers}' reason.
+   */
+  async queryOwnerGrants(retry = true): Promise<OwnerGrantRow[]> {
+    return (await this.readMembershipRows(this.ownerGrantView, retry)).map(ownerGrantRowOf);
+  }
+
+  /** Every `OwnerGrantUsage` row this node holds — the redemption records a grant-seated `OwnerKey` row is verified against. Same `retry` contract as {@link queryOwnerGrants}; both come from their membership views ({@link readMembershipRows}). */
+  async queryOwnerGrantUsages(retry = true): Promise<OwnerGrantUsageRow[]> {
+    return (await this.readMembershipRows(this.ownerGrantUsageView, retry)).map(ownerGrantUsageRowOf);
+  }
+
+  /**
+   * How many times an owner grant has been redeemed (its `OwnerGrantUsage` rows), served
+   * through the `OwnerGrantUsageByGrant` index. A permissive PRE-check like
+   * {@link countCadreInviteUsage}: the cap is `OwnerGrantUsage.Authorized`'s own committed count.
+   */
+  async countOwnerGrantUsage(key: string, retry = true): Promise<number> {
+    return this.countUsageRows('select count(1) as Count from CadreControl.OwnerGrantUsage where GrantKey = ?', key, 'owner-grant-usage-count', retry);
+  }
+
+  /**
+   * Is this one owner grant still redeemable here — not withdrawn, unexpired, uses left, issuer
+   * still an owner — judged as {@link isCadreInviteLive} judges an invitation: by `held`, the row
+   * this node holds under `grant.key` ({@link queryOwnerGrant}, read by the caller), else by
+   * `grant` itself (a bundle's copy, not seated yet) when its issuer signature verifies. A
+   * permissive pre-check; {@link seatOwnerGrant} and the redemption's own write enforce every
+   * condition. Its use count is read again inside the write lock, for
+   * {@link isCadreInviteLive}'s reason.
+   */
+  async isOwnerGrantLive(grant: OwnerGrantRow, held: OwnerGrantRow | null, nowMs: number = Date.now()): Promise<boolean> {
+    this.ensureInitialized();
+    const row = held ?? (verifyOwnerGrantRow(this.config.partyId, grant) ? grant : null);
+    return this.issuedRowLive('OwnerGrant', row, nowMs, key => this.countOwnerGrantUsage(key));
+  }
+
+  /**
+   * Every `OwnerGrant` row this node holds with its standing — recorded redemptions, withdrawal,
+   * and whether it is still redeemable — for an owner's listing, as {@link listCadreInviteStatuses}.
+   */
+  async listOwnerGrantStatuses(nowMs: number = Date.now()): Promise<OwnerGrantStatus[]> {
+    const standings = await this.issuedRowStandings('OwnerGrant', await this.queryOwnerGrants(), nowMs, key => this.countOwnerGrantUsage(key));
+    return standings.map(({ row, ...standing }) => ({ grant: row, ...standing }));
+  }
+
+  /**
+   * Owner-signed WITHDRAWAL of an owner grant: file the `Revocation` tombstone retiring its
+   * stamp, with the row kept, exactly as {@link withdrawCadreInvite} withdraws an invitation
+   * and for the same reason (every key the grant seated proves itself through the row;
+   * `OwnerGrant.NoDelete`, `Revocation.RowIsGone`). Afterwards `OwnerGrantUsage.Authorized`
+   * refuses every further redemption and `OwnerGrant.NotRevoked` refuses re-seating the
+   * holder's copy on any node holding the tombstone. Keys already seated stay owners;
+   * removing one is {@link deleteOwnerKey}.
+   *
+   * Idempotent: `false` (nothing written) when the row is absent here or already withdrawn,
+   * `true` when this call filed the tombstone. Fires the guarded-delete listener, so a
+   * withdrawal committed while alone is re-issued on cohort growth.
+   */
+  async withdrawOwnerGrant(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean> {
+    return this.withdrawIssuedRow('OwnerGrant', key, ownerKey, signMessage);
+  }
+
+  /**
+   * Redeem a seated `OwnerGrant` on the issuer's behalf: seat `seatedKey` as an owner with NO
+   * owner signature. One transaction writes the `OwnerKey` row (the grant branch of
+   * `Authorized`: `VouchOwner` the issuer, `VouchSig` null, `VouchUsage` the usage stamp,
+   * `Label` the grant's) and then the `OwnerGrantUsage` row that authorizes it; the usage
+   * row's `SeatedExists` reads the owner row back, so the two are bound to this exact
+   * redemption and neither can be held in reserve. The grant must already be committed
+   * ({@link seatOwnerGrant}): both consent reads are of `committed.OwnerGrant`. No machine is
+   * admitted and no peer id is named.
+   *
+   * The two signatures are minted where the private keys are (the grant's and the seated
+   * key's), over {@link ownerGrantRedeemMessage} / {@link ownerGrantConsentMessage}; this
+   * machine only verifies them, by writing the row.
+   *
+   * Idempotent, and a no-op for a key that is already an owner: when `seatedKey` has a live
+   * `OwnerKey` row here nothing is written and no use is spent — `alreadyOwner: true` with
+   * that row's stamp. The seat check ({@link assertOwnerGrantSeatRemains}) runs after that, so
+   * the retry of a single-use redemption is answered `alreadyOwner` rather than refused as
+   * exhausted. A key removed earlier is seated afresh under a new stamp (`NotRevoked` passes),
+   * except on a machine that still holds its retired row, which refuses by name
+   * ({@link liveOwnerKeyStamp}).
+   *
+   * Through {@link mutateCadrePeer}, so the membership hub is notified and the anchors follow;
+   * inside the locked body every read passes `retry: false` and the stamp is minted per
+   * attempt, so a {@link lockedWithRetry} re-run starts clean.
+   *
+   * @throws {InvitationExhaustedError} when the grant's uses are all spent (by name, ahead of
+   *   the schema's generic `Authorized` refusal); its `token` is the grant key.
+   *   {@link IssuedRowNotHereYetError} when no `OwnerGrant` row is readable here.
+   */
+  async redeemOwnerGrant(params: {
+    grantKey: string;
+    /** The row this node holds under `grantKey`, read before the call; omitted, it is read inside the locked body. Never a bundle's copy, for {@link redeemCadreInvite}'s reason. */
+    held?: OwnerGrantRow;
+    /** The owner key to seat (base64url ed25519): the holder generated it, or already holds it. */
+    seatedKey: string;
+    /** Single-use nonce minted by the holder; both signatures cover it. */
+    usageStampId: string;
+    /** The holder's signature with the grant private key over the `'redeem'` digest. */
+    grantSig: string;
+    /** The seated key's signature over the `'consent'` digest. */
+    ownerSig: string;
+    nowMs?: number;
+  }): Promise<OwnerGrantRedemptionResult> {
+    this.ensureInitialized();
+    const { grantKey, seatedKey, usageStampId, grantSig, ownerSig } = params;
+    const nowMs = params.nowMs ?? Date.now();
+    log('Redeeming owner grant %s for %s', grantKey, seatedKey);
+
+    return this.mutateCadrePeer('owner-grant-redeem', async () => {
+      const grant = params.held ?? await this.queryOwnerGrant(grantKey, false);
+      if (grant === null) {
+        throw new IssuedRowNotHereYetError('OwnerGrant', grantKey);
+      }
+      const heldStamp = await this.liveOwnerKeyStamp(seatedKey);
+      if (heldStamp !== null) {
+        log('redeemOwnerGrant: %s is already an owner; nothing written', seatedKey);
+        return { alreadyOwner: true, seatedStampId: heldStamp };
+      }
+      await this.assertOwnerGrantSeatRemains(grant);
+
+      // Minted inside the body, so a re-run mints afresh over a rolled-back attempt rather
+      // than re-presenting a stamp the usage row may already name.
+      const seatedStampId = generateStampId(this.config.libp2pNode.peerId.toString());
+      const nowCanonical = await canonicalDatetime(this.db!, nowMs);
+      await this.inTransaction('owner-grant-redeem', async () => {
+        await this.db!.exec(`
+          insert into CadreControl.OwnerKey (Key, Label, StampId, VouchOwner, VouchSig, VouchUsage)
+            with context OwnerKey = null, Signature = null
+            values (?, ?, ?, ?, null, ?)
+        `, [seatedKey, grant.label, seatedStampId, grant.issuerKey, usageStampId]);
+        await this.db!.exec(`
+          insert into CadreControl.OwnerGrantUsage (UsageStampId, GrantKey, SeatedKey, SeatedStampId, GrantSig, OwnerSig)
+            with context Now = ?
+            values (?, ?, ?, ?, ?, ?)
+        `, [nowCanonical, usageStampId, grantKey, seatedKey, seatedStampId, grantSig, ownerSig]);
+      });
+      log('Redeemed owner grant %s: %s seated as an owner (usage %s)', grantKey, seatedKey, usageStampId);
+      return { alreadyOwner: false, seatedStampId };
+    });
+  }
+
+  /** {@link assertCadreInviteSeatRemains} for an owner grant: refuse an exhausted grant by name, ahead of the write. */
+  private assertOwnerGrantSeatRemains(grant: OwnerGrantRow): Promise<void> {
+    return this.assertIssuedSeatRemains(grant, key => this.countOwnerGrantUsage(key, false));
   }
 
   /**
    * Close the database and cleanup resources.
    *
-   * Drains the local-write chain first: {@link withWriteLock} can park a write behind
+   * Disposes every {@link watchTables} subscription before anything else, so a commit that
+   * lands while the write chain drains schedules no run, and again before dropping the handle.
+   *
+   * Then drains the local-write chain: {@link withWriteLock} can park a write behind
    * others across an await, and a queued closure evaluates `this.db!` only when it
    * finally runs — so nulling the handle out from under it would throw a TypeError on a
    * null handle instead of committing. The tail never rejects (it swallows both
@@ -4641,11 +5564,17 @@ export class ControlDatabase {
    * deadline) if a write can ever hang.
    */
   async close(): Promise<void> {
+    this.tableWatches.disposeAll();
     await this.writeQueue;
     if (this.collectionFactory) {
       await this.collectionFactory.shutdown();
       this.collectionFactory = null;
     }
+    this.txnBridge = null;
+    // Again: a subscription taken during the awaits above would keep its timers past close.
+    this.tableWatches.disposeAll();
+    // Here, not first: a read started during the awaits above must not install either.
+    this.invalidateMembershipViews();
     if (this.db) {
       void this.db.close();
       this.db = null;