@serfab/cadre-core 1.16.0 → 1.18.0

package/dist/control-database.d.ts

@@ -2,9 +2,12 @@ import { Database } from '@quereus/quereus';
 import type { SqlParameters } from '@quereus/quereus';
 import type { Libp2p } from '@libp2p/interface';
 import type { IRepo } from '@optimystic/db-core';
-import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, SeedPeer, MachineRemovalResult } from './types.js';
-import type { ControlTable, RevocableTable, BoundControlDomain, ControlAction, CadreInviteSignedFields } from './control-authorization.js';
+import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, DeviceTokenRecord, DeviceTokenRow, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, OwnerGrantRow, OwnerGrantUsageRow, OwnerGrantRedemptionResult, OwnerGrantStatus, SeedPeer, MachineRemovalResult } from './types.js';
+import type { ControlTable, RevocableTable, BoundControlDomain, ControlAction, CadreInviteSignedFields, OwnerGrantSignedFields } from './control-authorization.js';
+import type { ControlWriteRetryOptions } from './control-write-retry.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
+import type { TableChangeWatch, TableChangeWatchOptions } from './table-change-watch.js';
+import type { FormationInviteFacts } from './formation-token.js';
 export type { ControlTable, RevocableTable, ControlDomain, ControlAction } from './control-authorization.js';
 /**
  * Generate a unique stamp ID for transaction authorization.
@@ -18,12 +21,11 @@ export declare function generateStampId(peerId: string): string;
  * present locally.
  *
  * Consent is bound to the strand's one-off `StampId` (see the consent branch of
- * `Strand.AuthorizedInsert`), so the writer must read the live row before inserting.
- * The ordinary "host strand has not converged on this responder yet" case is caught
- * earlier and reported as `missing` by `ControlFormationUsageRecorder.resolveStrand`;
- * reaching here means the row vanished between that check and the write, which is a
- * genuine race and is surfaced rather than left to fail the deferred `StrandExists`
- * CHECK at commit (which would drop the write with a far less legible error).
+ * `Strand.AuthorizedInsert`), so a writer not handed the stamp reads the live row before
+ * inserting, and throws this when the row is absent rather than leaving it to fail the
+ * deferred `StrandExists` CHECK at commit (a far less legible error). The formation
+ * responder hands the stamp over from `ControlFormationUsageRecorder.resolveStrand`, which
+ * reports an absent row as `missing`; a row removed after that read fails the CHECK instead.
  */
 export declare class MissingHostStrandError extends Error {
     readonly strandId: string;
@@ -52,22 +54,23 @@ export declare class FormationAbortedError extends Error {
 /**
  * The invitation's seat budget is already spent: the count of recorded usage rows for the
  * invitation has reached its `TotalUses`, so this redemption cannot be given a seat. `token`
- * is the `FormationInvite.Token` or the `CadreInvite.Key`, whichever table the caller
- * redeemed against.
+ * is the `FormationInvite.Token`, the `CadreInvite.Key` or the `OwnerGrant.Key`, whichever
+ * table the caller redeemed against.
  *
  * Raised off the committed-count check ({@link ControlDatabase.assertSeatRemains}) ahead of
  * the write, inside {@link ControlDatabase.redeemInvitation} /
  * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
- * ({@link ControlDatabase.redeemCadreInvite}), and off the unlocked pre-check
- * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
- * pass — and off nothing else. It exists because
+ * ({@link ControlDatabase.redeemCadreInvite}) and an owner grant
+ * ({@link ControlDatabase.redeemOwnerGrant}), and off the unlocked re-check
+ * `ControlFormationUsageRecorder.authorizeUsage` runs after an outside approval, before the
+ * manager issues a membership pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
  * schema's own count-based cap clause, which the manager reports as a retryable
  * `Formation conflict, retry` — telling the joiner to retry something that can never succeed.
  * Two redemptions of one token racing on the SAME node serialize behind the local write
- * queue, so the loser reads the winner's committed row and is refused here by name —
- * `StrandFormationManager.validateToken`'s `isTokenUsed` check cannot catch that, since it
- * ran before either redemption wrote anything.
+ * queue, so the loser reads the winner's committed row and is refused here by name — the
+ * use count `StrandFormationManager.validateToken` reads cannot catch that, since it was
+ * read before either redemption wrote anything.
  */
 export declare class InvitationExhaustedError extends Error {
     readonly token: string;
@@ -89,6 +92,35 @@ export declare class CadreInviteIssuerUnknownError extends Error {
         cause?: unknown;
     });
 }
+/**
+ * {@link ControlDatabase.seatOwnerGrant} was refused by `OwnerGrant.AuthorizedInsert`: the
+ * grant twin of {@link CadreInviteIssuerUnknownError}, for the same two causes (the issuer's
+ * `OwnerKey` row has not replicated here yet or has since been removed; or a tampered row).
+ * Its own class rather than a shared one so a caller that handles invitation and grant
+ * bundles can tell by `instanceof` which credential was refused.
+ */
+export declare class OwnerGrantIssuerUnknownError extends Error {
+    readonly grantKey: string;
+    readonly issuerKey: string;
+    constructor(grantKey: string, issuerKey: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * An issued row (a `CadreInvite` or an `OwnerGrant`) the cadre holds that this node cannot read
+ * yet: {@link ControlDatabase.seatCadreInvite} / {@link ControlDatabase.seatOwnerGrant} had its
+ * insert refused by a cohort member already holding the row, and a refreshed read here still
+ * finds nothing; or the redemption that follows the seat finds no row. It clears once this
+ * node's store catches up, which is why the redemption paths answer it with the retryable
+ * `conflict` code.
+ */
+export declare class IssuedRowNotHereYetError extends Error {
+    readonly table: IssuedTable;
+    readonly key: string;
+    constructor(table: IssuedTable, key: string, options?: {
+        cause?: unknown;
+    });
+}
 /**
  * What a recorded `FormationUsage` row came out as.
  *
@@ -238,15 +270,133 @@ export declare function cadreInviteRedeemMessage(partyId: string, fields: CadreI
  * distinct action tag, so neither signature can stand in for the other.
  */
 export declare function cadreInviteConsentMessage(partyId: string, fields: CadreInviteRedemptionFields): Uint8Array;
+/**
+ * The exact bytes an owner signs to seat an `OwnerGrant` row — the TS mirror of the `'add'`
+ * digest in `OwnerGrant.AuthorizedInsert`, over the whole row in the schema's order with
+ * nullable columns as `''` (`ownerGrantRowFields`, shared with the base64url verifier
+ * `peer-authorization.ts`'s `ownerGrantAddDigest`). `expiresAt` must already be the stored
+ * canonical `datetime` string, as {@link ControlDatabase.insertOwnerGrant} produces it, for
+ * the reason on {@link cadreInviteAddMessage}.
+ */
+export declare function ownerGrantAddMessage(partyId: string, row: OwnerGrantSignedFields): Uint8Array;
+/** The fields both owner-grant redemption signatures cover; see {@link ownerGrantRedeemMessage}. */
+export interface OwnerGrantRedemptionFields {
+    grantKey: string;
+    /** The single-use nonce the holder minted for this redemption (`generateStampId`). */
+    usageStampId: string;
+    /** The owner key being seated (base64url ed25519). */
+    seatedKey: string;
+}
+/**
+ * The exact bytes the HOLDER of an owner grant signs, with the grant's private key, to redeem
+ * it once — the TS mirror of the `'redeem'` digest `OwnerGrantUsage.GrantPossessed` verifies
+ * against the grant's public key. Binding the seated key and the nonce means a captured
+ * redemption can seat no other key and spend no other use.
+ */
+export declare function ownerGrantRedeemMessage(partyId: string, fields: OwnerGrantRedemptionFields): Uint8Array;
+/**
+ * The exact bytes the SEATED key signs, proving the holder holds it — the TS mirror of the
+ * `'consent'` digest `OwnerGrantUsage.OwnerConsented` verifies against `SeatedKey`. Same
+ * fields as {@link ownerGrantRedeemMessage} under a distinct action tag, so neither
+ * signature can stand in for the other.
+ */
+export declare function ownerGrantConsentMessage(partyId: string, fields: OwnerGrantRedemptionFields): Uint8Array;
+/**
+ * A guarded table of owner-issued credentials: signed rows that travel inside a bundle, are
+ * seated verbatim by any member ({@link ControlDatabase.seatCadreInvite},
+ * {@link ControlDatabase.seatOwnerGrant}), and are never deleted (`NoDelete`) because the
+ * rows they admitted prove themselves through them. Withdrawing one is a tombstone alone
+ * ({@link ControlDatabase.withdrawCadreInvite}, {@link ControlDatabase.withdrawOwnerGrant}).
+ */
+type IssuedTable = Extract<RevocableTable, 'CadreInvite' | 'OwnerGrant'>;
+/**
+ * An owner key's label as its row stores it: trimmed, a blank one left out, and refused past
+ * {@link OWNER_KEY_MAX_LABEL} by name rather than by the schema's `LabelLength` check.
+ * Idempotent, so a caller that checks before opening an owner approval can pass the result on.
+ */
+export declare function ownerKeyLabel(label: string | null | undefined): string | null;
+/**
+ * Signs one owner digest's raw bytes (no pre-hash) and returns a base64url Ed25519 signature:
+ * the callback every owner-signed writer takes. An `OwnerSign` from an open
+ * `OwnerSigner.approve` fits it, and so does a synchronous signer.
+ *
+ * NOTE: writers that read the stamp they sign do so inside the write lock, so the lock is held
+ * across these calls, and a `lockedWithRetry` re-run signs again inside the same approval.
+ * Free for a software signer. If a prompting signer ever holds the lock long enough to stall
+ * other control writes, sign outside the lock and re-check the stamp inside it.
+ */
+export type ControlSign = (message: Uint8Array) => string | Promise<string>;
+/**
+ * Signs this node's own address record over its `CadrePeer` row as it stands —
+ * {@link ControlDatabase.updateSelfPeerRecord}'s callback, run inside the locked write body on
+ * every attempt, so the record written is always stamped past the row that was actually read.
+ */
+export type SelfRecordSigner = (current: PeerAddressRecord) => PeerAddressRecord;
+/**
+ * Which owner re-touch {@link ControlDatabase.reauthorizeCadrePeer} makes over a `CadrePeer` row:
+ *
+ * - `'rebroadcast'` — the write-while-alone drain re-emitting a row that committed local-only. It
+ *   bumps `UpdatedAt` so the row goes out as a fresh transaction, and writes only while the row's
+ *   `Sig` is null: once the machine has self-published, the row is its to refresh, and a bump
+ *   without a re-sign would leave its signature unverifiable.
+ * - `'revouch'` — an owner rebinding the row's voucher to its own key before the vouching key is
+ *   removed (`CadreNode.removeOwner`). Written whether or not the machine has self-published, and
+ *   leaves `UpdatedAt` untouched, so a self-signed record stays verifiable.
+ */
+export type CadrePeerRetouchMode = 'rebroadcast' | 'revouch';
+/**
+ * What {@link ControlDatabase.reauthorizeCadrePeer} found and did: the row was re-touched; no
+ * readable row exists (absent, or its stamp retired); or — `'rebroadcast'` only — the machine has
+ * self-published since, so the row is no longer the owner's to re-emit. The two no-write outcomes
+ * are decided over the row as read inside the locked body, so a caller can act on them.
+ */
+export type CadrePeerRetouchOutcome = 'retouched' | 'absent' | 'self-published';
+/** A formation invitation written with a founding ({@link FoundingRows}), bound to the strand founded. */
+export interface FoundingInvite {
+    /** The invitation token, the `FormationInvite` primary key. */
+    token: string;
+    /** The sApp a redeemed strand will use. */
+    sAppId: string;
+    /** Epoch ms after which it cannot be redeemed; omit for never. */
+    expiresAtMs?: number;
+    /** How many redemptions it allows; omit for unlimited. */
+    totalUses?: number;
+    /** Web hook sent the disclosure; a `ValidationKey` then signs off each redemption. */
+    validationUrl?: string;
+}
+/** The control rows one founding writes together; see {@link ControlDatabase.insertFoundingRows}. */
+export interface FoundingRows {
+    strand: {
+        id: string;
+        type: 'o' | 'c';
+        memberPrivateKey?: string;
+    };
+    /** This party's membership identity key for a closed strand; absent for an open strand, or when a stored key is adopted. */
+    partyKey?: string;
+    /** A formation invitation bound to this strand (its `StrandId` is `strand.id`). */
+    formationInvite?: FoundingInvite;
+}
+/** What an owner asks {@link ControlDatabase.insertCadreInvite} (or {@link ControlDatabase.signCadreInvite}) to sign. */
+export interface CadreInviteFields {
+    /** The invitation public key (base64url ed25519), the row's primary key. */
+    key: string;
+    /** The device the invitation is for, or null for whoever redeems first. */
+    peerId?: string | null;
+    /** Epoch ms after which it cannot be redeemed; omit for never. */
+    expiresAtMs?: number | null;
+    /** How many redemptions it allows; omit for unlimited. */
+    totalUses?: number | null;
+}
 /** The control tables keyed by a strand id whose repeat insert a caller may treat as idempotent. */
-type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
+type StrandIdTable = Extract<RevocableTable, 'Strand' | 'StrandPartyKey' | 'JoinedStrand'>;
 /**
  * Did this write to `table` fail because the strand id is already seated there?
  *
  * {@link CadreNode.publishStrand} uses this to tell "my own earlier publish already
  * landed" (re-read, and no-op when the row matches) apart from every other rejection —
  * an unauthorized signer, a retired stamp — which must keep surfacing. For `JoinedStrand`
- * the same test tells "another machine of this party already published this join" apart.
+ * the same test tells "another machine of this party already published this join" apart, and
+ * for `StrandPartyKey` it tells a founding that this party's key for the id is already seated.
  *
  * Matched by TEXT, not by type: the typed engine error does not survive the trip out of
  * optimystic (same constraint the retry classifiers in `control-write-retry.ts` document).
@@ -256,6 +406,13 @@ type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
  * reword reddens there.
  */
 export declare function isStrandIdConflict(error: unknown, table: StrandIdTable): boolean;
+/**
+ * Did a seat of an issued row fail because a cohort member already holds a row under its key?
+ * {@link ControlDatabase.seatCadreInvite} / {@link ControlDatabase.seatOwnerGrant} reach this
+ * on a node whose store lags the cohort: its guard read missed the row, and the member that
+ * checked the commit refused the insert. Text-matched, failing closed, like {@link isStrandIdConflict}.
+ */
+export declare function isIssuedRowKeyConflict(error: unknown, table: IssuedTable): boolean;
 /**
  * Did {@link ControlDatabase.insertJoinRequest} fail because the party already holds a
  * `JoinRequest` row for this invitation? The caller adopts the existing request instead.
@@ -286,35 +443,19 @@ export declare class PendingJoinChangedError extends Error {
     readonly live: PendingJoin | null;
     constructor(id: string, live: PendingJoin | null);
 }
-/**
- * The one `CadreControl.Revocation` row that retires nothing, filed once by an owner
- * ({@link ControlDatabase.openRevocationLedger}) so the table is never a never-written
- * block. The schema's table comment says why that matters and why the row can never read
- * as a retirement; `RowIsGone` pins this exact triple.
- */
-export declare const REVOCATION_LEDGER_MARKER: {
-    readonly tableName: "Revocation";
-    readonly rowKey: "ledger";
-    readonly stampId: "opened";
-};
 /**
  * Project `CadrePeer` rows into the {@link SeedPeer} list a seed, or a cadre invitation
- * redemption reply, carries.
- *
- * Owner identity is sourced from the `OwnerKey` table, not from the transport peer id. An
- * Ed25519 libp2p peer id embeds its public key (identity multihash), so each peer's ed25519
- * key is derivable from its `PeerId`; a peer is an owner iff that derived key is in
- * `ownerKeys`. This makes any owner node markable — not just the local one. A non-Ed25519
- * or unparsable id yields a non-owner rather than failing the whole projection.
+ * redemption reply, carries. `minterPeerId` is the machine minting the seed or answering the
+ * redemption; it contributes an entry only through its own `CadrePeer` row.
  *
- * NOTE: this is the one owner lookup deliberately left on the REPLICATED table rather than
- * the node-local anchor. `SeedPeer.isOwner` is a dial hint — the receiver dials owner-flagged
- * peers first — not a trust decision, and the receiver re-derives real trust from its own
- * anchor. So a polluted table costs at most a wasted dial, while anchoring here would
- * silently drop legitimate co-owners this node never pinned. If `isOwner` ever gates
- * anything the receiver TRUSTS, move it to the anchor.
+ * A peer is `preferred` when it is the minter, the one machine certain to be reachable by the
+ * receiver at that moment, since it is delivering the seed or the reply, or an always-on
+ * machine (`Profile = 'storage'`), the ones that stay dialable. Preference is a dial hint and
+ * reads no `OwnerKey` row: owner keys are not machines, and a receiver derives trust from its
+ * own anchor, never from this list. A `Profile` is self-declared and not checked here, so a
+ * machine misdeclaring one costs the receiver a wasted dial at most.
  */
-export declare function projectSeedPeers(rows: readonly CadrePeerRow[], ownerKeys: ReadonlySet<string>): SeedPeer[];
+export declare function projectSeedPeers(rows: readonly CadrePeerRow[], minterPeerId: string): SeedPeer[];
 /**
  * Guarded tables a node may reap locally once their tombstone has committed — the
  * tables whose `AuthorizedDelete` carries the REAP branch (see the constraint comment on
@@ -326,22 +467,14 @@ export declare function projectSeedPeers(rows: readonly CadrePeerRow[], ownerKey
  * hold, so a reaped row is recoverable by re-forming. `JoinRequest` is reapable for the same
  * reason: the inviting party and the user also hold its invitation. `OwnerKey` has no
  * production removal path and `MinOneOwner` makes an automated owner-key reap a
- * party-bricking hazard. `CadreInvite` is never deleted at all (its tombstone is a
- * withdrawal over a row that stays), so there is nothing to reap.
+ * party-bricking hazard. `CadreInvite` and `OwnerGrant` are never deleted at all (their
+ * tombstones are withdrawals over rows that stay), so there is nothing to reap.
  */
 export declare const REAPABLE_TABLES: readonly ["CadrePeer", "DeviceToken", "ValidationKey", "JoinedStrand", "JoinRequest"];
 export type ReapableTable = (typeof REAPABLE_TABLES)[number];
 /** A `FormationInvite` row as {@link ControlDatabase.queryFormationInvite} reads it. */
-export interface FormationInviteRow {
+export interface FormationInviteRow extends FormationInviteFacts {
     token: string;
-    sAppId: string;
-    /** Parsed epoch ms of the stored `datetime`; null when the invitation never expires. */
-    expiresAtMs: number | null;
-    /** Null is unlimited. */
-    totalUses: number | null;
-    validationUrl: string | null;
-    /** A bound invitation's host strand; null on the responder-provisions path. */
-    strandId: string | null;
 }
 /**
  * Notified after a membership write (a `CadreControl.CadrePeer` or `OwnerKey` row, see
@@ -361,8 +494,6 @@ export type MembershipChangeListener = (reason: string) => Promise<void>;
  * the writer that files the row supplies it.
  */
 export type RevokedRowRef = Pick<RevocationRow, 'tableName' | 'rowKey' | 'stampId'>;
-/** What {@link ControlDatabase.removeMachine} wrote: `CadreNode.removeMachine`'s result, less the re-vouches it made first. */
-export type MachineRemovalWrites = Pick<MachineRemovalResult, 'removedPeer' | 'removedOwnerKey' | 'removedDeviceToken' | 'withdrawnInvitations'>;
 /**
  * Notified after a guarded-table delete — and the `CadreControl.Revocation`
  * tombstone it writes in the same transaction — has COMMITTED.
@@ -400,6 +531,8 @@ export interface ControlDatabaseConfig {
      * Optional path to the control schema file.
      * If not provided, uses the embedded schema for cross-platform compatibility.
      * Only use this if you need to override the default schema (e.g., for testing).
+     * The file has the shape of `schemas/control.qsql`: one `declare schema CadreControl`
+     * followed by one plain `apply schema CadreControl` ({@link controlSchemaFileDeclaration}).
      */
     schemaPath?: string;
     /** Libp2p node for the control network (injected) */
@@ -414,6 +547,7 @@ export interface ControlDatabaseConfig {
 export declare class ControlDatabase {
     private db;
     private collectionFactory;
+    private txnBridge;
     private readonly config;
     private initialized;
     private membershipListener;
@@ -421,6 +555,18 @@ export declare class ControlDatabase {
     private controlWriteAbandonedListener;
     /** Tail of the local-write chain — see {@link withWriteLock}. */
     private writeQueue;
+    /** Subscriptions handed out by {@link watchTables}. */
+    private readonly tableWatches;
+    /** The cached membership tables; see {@link readMembershipRows}. */
+    private readonly revocationView;
+    private readonly cadrePeerView;
+    private readonly ownerKeyView;
+    private readonly cadreInviteView;
+    private readonly cadreInviteUsageView;
+    private readonly ownerGrantView;
+    private readonly ownerGrantUsageView;
+    /** Each membership view by the qualified table it copies, for {@link watchMembershipViews}, {@link watchMembershipTables} and {@link invalidateMembershipViews}. */
+    private readonly membershipViews;
     /**
      * Locked write bodies currently running (see {@link runWriteBody}); what
      * {@link readRowsOnce} consults to route an unlocked read around a write that has
@@ -447,7 +593,33 @@ export declare class ControlDatabase {
      * Initialize the database - load schema and register plugins
      */
     initialize(): Promise<void>;
+    /**
+     * Drop a membership view whenever its table changes: a commit made here, or a change this
+     * node's storage takes in from elsewhere. `onInvalidate` is the whole consumer, so the run
+     * does nothing; no backstop, since {@link MEMBERSHIP_VIEW_MAX_AGE_MS} bounds what the
+     * subscription cannot hear. {@link close} disposes it with the rest.
+     */
+    private watchMembershipViews;
+    /**
+     * {@link watchTables} on the membership tables: the seven the membership views copy
+     * (`CadrePeer`, `OwnerKey`, `Revocation`, `CadreInvite`, `CadreInviteUsage`, `OwnerGrant`,
+     * `OwnerGrantUsage`), which are exactly what the membership gate and the owner-anchor sync
+     * read. `CadreNode.start` takes its gate watch here, so the gate hears every table its
+     * reads can depend on and no list of them lives outside this class.
+     */
+    watchMembershipTables(onChange: () => Promise<void>, options: TableChangeWatchOptions): TableChangeWatch;
+    /**
+     * Empty every membership view, so the next read of each loads afresh and no load in
+     * flight installs. Besides {@link initialize} and {@link close}, `CadreNode` calls it when
+     * a sibling becomes reachable (its identify on a new connection): a machine that was offline
+     * while that sibling committed learns of the commit only when it next reads the block from
+     * storage, and dropping the views makes the pass that starts then read now rather than after
+     * `MEMBERSHIP_VIEW_MAX_AGE_MS`.
+     */
+    invalidateMembershipViews(): void;
     private loadSchema;
+    /** Apply the declared control schema, retrying transient cohort failures. */
+    private applyControlSchema;
     /**
      * One UNRETRIED drain of a control read to rows — every read in this class bottoms out
      * here (almost all via {@link readRows}, which adds the transient-failure retry), and
@@ -578,6 +750,39 @@ export declare class ControlDatabase {
      * under-lock callback seam is ever added, audit its read graph the same way.
      */
     private readRows;
+    /**
+     * {@link readRows}, also saying whether the attempt that answered took the committed-read
+     * path — which a {@link MembershipView} load needs, since it may not keep such rows (see
+     * {@link membershipView}).
+     */
+    private readRowsRouted;
+    /**
+     * A view over one membership table, loaded by its full scan `sql` through {@link readRows}'s
+     * funnel. Rows a committed read served are never kept: that read may initialize an untouched
+     * table provisionally, and the Optimystic plugin arms a table's replicated-change bridge only
+     * on its full initialization (`OptimysticTable.initializeForCommittedRead`), so no later change
+     * event would ever drop them.
+     */
+    private membershipView;
+    /**
+     * A membership table's raw rows, from its {@link MembershipView}: `Revocation`, `CadrePeer`
+     * and `OwnerKey`, the tables every membership, owner and peer-record read starts from, and
+     * `CadreInvite`, `CadreInviteUsage`, `OwnerGrant` and `OwnerGrantUsage`, the chains every
+     * membership refresh verifies invitation-admitted machines and grant-seated owner keys through.
+     * Callers build fresh result objects from them and never mutate them.
+     *
+     * Reads the table directly instead when a caller under the write lock (`retry: false`) has an
+     * explicit transaction open: such a read sees the transaction's own uncommitted rows, which
+     * the view does not hold, and a rollback fires no change event, so keeping them would cache
+     * rows that never existed. No reader of these tables runs inside {@link inTransaction} today;
+     * this keeps one added later, or a spec's raw-handle transaction, correct.
+     *
+     * Reads that stay plain SQL on purpose: {@link queryStampId} (sees retired rows), the
+     * schema's CHECK constraints, which read inside the committing transaction, the redemption's
+     * one read of the held credential row ({@link queryCadreInvite},
+     * {@link queryOwnerGrant}), and the indexed usage counts.
+     */
+    private readMembershipRows;
     /**
      * Query all strands from the control database
      */
@@ -589,10 +794,18 @@ export declare class ControlDatabase {
      * validated invitee during provision-then-record formation.
      */
     queryStrand(strandId: string): Promise<StrandRow | null>;
+    /**
+     * {@link queryStrand} plus the row's `StampId`, in one read: the formation responder
+     * resolves a bound invite's host strand with it and later records consent against that
+     * stamp ({@link recordFormationUsage}'s `strandStampId`) without reading the row again.
+     */
+    queryStrandWithStamp(strandId: string): Promise<(StrandRow & {
+        StampId: string;
+    }) | null>;
     /**
      * Every strand this party joined from another party (`CadreControl.JoinedStrand`), shaped
      * as a {@link StrandRow} so a reader can treat it like one of the party's own. A joiner
-     * never founds, so `FounderOwnerKey` is always null. Read raw, like {@link queryStrands}:
+     * never founds, so `FounderOwnerKey` and `FounderPeerId` are always null. Read raw, like {@link queryStrands}:
      * no retired-stamp filter.
      */
     queryJoinedStrands(): Promise<StrandRow[]>;
@@ -634,14 +847,54 @@ export declare class ControlDatabase {
      *
      * Deliberately RAW (no retired-stamp filter, unlike {@link getOwnerKeys}): the genesis
      * insert is refused by the schema whenever any physical row exists, so this must see one.
+     * Served from the `OwnerKey` membership view ({@link readMembershipRows}), which holds every
+     * physical row, so a genesis caller's pre-check and {@link ensureOwnerKey}'s re-check share
+     * one storage read.
      */
     hasOwnerKey(): Promise<boolean>;
     /**
      * Idempotent genesis: insert `key` as the founding owner key only when
      * the party has none yet. Returns true if it inserted, false if an owner
      * key already existed (so a repeat `--owner` start is a no-op).
-     */
-    ensureOwnerKey(key: string): Promise<boolean>;
+     *
+     * Before the insert, gives every control table its empty collection
+     * ({@link commitEmptyControlCollections}). A collection committed while a machine is alone
+     * forks if another machine creates the same collection independently; before genesis the
+     * party has no owner, so no other machine can have been admitted and none can hold any of
+     * its collections. The order makes the step repeatable: a crash between it and the insert
+     * leaves no `OwnerKey` row, so the next start runs genesis again and commits only the
+     * collections still missing, while a founder restart finds the row and commits nothing, so
+     * it can never write an empty second history beside a table another machine has since
+     * written. A failure propagates with nothing inserted.
+     *
+     * @param label - the user's name for the key ({@link insertOwnerKey}).
+     */
+    ensureOwnerKey(key: string, label?: string): Promise<boolean>;
+    /**
+     * Commit an empty collection for every `CadreControl` table, index tree and unique-enforcement
+     * tree that has none, so a read of a table nobody has written is answered from this machine's
+     * storage instead of asking the block's cohort to prove the collection absent — a round trip
+     * per read on a party of several machines, and an error or a wait while they are offline.
+     * Joining machines get these collections the ordinary way, by reading them from the cohort.
+     *
+     * Under the write lock: the helper commits whatever is staged in those collections outside any
+     * SQL transaction, which is sound only while nothing else writes.
+     *
+     * Parties founded before this step, and tables a later control schema version adds, have no
+     * such collections, and nothing creates them later: the start-time schema apply runs on every
+     * machine, possibly alone, where committing one would be exactly the fork genesis avoids.
+     *
+     * NOTE: one `sync()` per collection, in sequence: 32 collections for today's schema (17 tables,
+     * 3 indexes, 12 `unique` columns). Measured 2026-10-20 on a lone `CadreNode` over the network
+     * transactor (started, then `ensureOwnerKey` alone, 3 runs each): 64–105 ms in memory and
+     * 750–820 ms on `FileRawStorage`, about 25 ms per collection on disk, roughly 1/75 of the edge
+     * node's 60 s `DEFAULT_OWNER_GENESIS_TIMEOUT_MS`. Under the whole cadre-core suite's load (151
+     * geneses) it took a median of 159 ms and at most 4.6 s. If genesis latency starts to matter
+     * (phone flash under launch contention runs 50–90 ms per storage operation, see the NOTE in
+     * `initialize`), ask Optimystic for an API that commits them as one batch, the one strand
+     * founding would use too; do not build a private batching path.
+     */
+    private commitEmptyControlCollections;
     /**
      * Collect every owner key (`CadreControl.OwnerKey.Key`) as a set.
      *
@@ -666,8 +919,9 @@ export declare class ControlDatabase {
      */
     getOwnerKeys(retry?: boolean): Promise<Set<string>>;
     /**
-     * Every live `OwnerKey` row with its persisted proof ({@link OwnerKeyRow}) — what the
-     * trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`). Rows whose
+     * Every live `OwnerKey` row with its label and persisted proof ({@link OwnerKeyRow}) — what
+     * the trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`) and the owner-key
+     * listing shows (`CadreNode.listOwnerKeys`). Rows whose
      * `StampId` is retired in `CadreControl.Revocation` are excluded here, as
      * {@link queryCadrePeers} excludes them and for the reason on {@link getOwnerKeys}, which
      * reads through this. A row with no stamp (the schema permits it; no writer produces one)
@@ -679,9 +933,8 @@ export declare class ControlDatabase {
      *
      * @param retired - the retired `OwnerKey` stamps, when the caller has already read the
      *   tombstones (`CadreNode.syncOwnerAnchor` reads {@link queryRevocations} for their
-     *   signers); omitted, they are read here. Before the ledger marker is filed every
-     *   `Revocation` read is a cohort consult, so the sync passing its own set keeps the
-     *   membership refresh at one such read for the anchor.
+     *   signers); omitted, they are read here. Both come from the same `Revocation` view
+     *   ({@link readMembershipRows}), so passing the set saves only the filtering.
      */
     queryOwnerKeyRows(retry?: boolean, retired?: ReadonlySet<string>): Promise<OwnerKeyRow[]>;
     /**
@@ -696,12 +949,8 @@ export declare class ControlDatabase {
      * {@link queryRevokedStamps} rather than inlining the SQL, so tests can interpose on
      * that seam to model the replicated live-row-plus-tombstone merge state.
      *
-     * NOTE: runs a second query (the retired-stamp set) per call, on the membership-gate
-     * refresh path. Its cost is storage consults, not rows (see {@link queryRevokedStamps}):
-     * while `Revocation` has never been written every call consults the cohort about it, and
-     * the ledger marker ({@link openRevocationLedger}) is what makes it a held block. Folding
-     * the exclusion into one statement would not help (it reads the same block), and caching
-     * the set would hide a tombstone arriving by replication.
+     * Both tables come from their membership views ({@link readMembershipRows}), so a call after
+     * the first costs no storage read until one of the two tables changes.
      *
      * NOTE: this filter is HAND-MIRRORED by the gate suites' fake control databases
      * (`test/membership-gate-helpers.ts` and `test/cadre-node-authorized-surface.spec.ts`),
@@ -723,15 +972,15 @@ export declare class ControlDatabase {
     queryCadrePeers(retry?: boolean): Promise<CadrePeerRow[]>;
     /**
      * The cadre's peers as a seed or a redemption reply carries them: every live `CadrePeer`
-     * row with its addresses, each flagged `isOwner` when the key behind its peer id is in
-     * the replicated `OwnerKey` table ({@link projectSeedPeers}).
+     * row with its addresses, the minter and every always-on machine marked preferred
+     * ({@link projectSeedPeers}).
      *
      * Read through {@link queryCadrePeers}, never a raw `CadrePeer` select, so a removed
      * member's addresses are never packed into a seed or handed to a redeeming device as a
      * dial hint: a revoked peer is off the addressable surface everywhere, and this is one of
      * its exits.
      */
-    querySeedPeers(): Promise<SeedPeer[]>;
+    querySeedPeers(minterPeerId: string): Promise<SeedPeer[]>;
     /**
      * Every approver public key currently enrolled in `CadreControl.ValidationKey` — the
      * set a `ValidationUrl` redemption's approval signature must be signed by (see
@@ -762,17 +1011,18 @@ export declare class ControlDatabase {
      * guard. A read retrying there would sleep its backoff HOLDING the write lock
      * (`retryControlWrite`'s contract is that backoff sleeps happen with no lock held), and
      * the write funnel already re-runs the body's reads when it re-runs the body. The
-     * unlocked callers — the public stamp readers, {@link reauthorizeCadrePeer} and
-     * {@link reapRevokedRow}, whose stamp reads run BEFORE their locks are taken — keep the
-     * default retried path. Explicit per call rather than an ambient flag: unlocked reads
-     * run concurrently with a locked body, so `this`-state cannot tell the two apart.
+     * unlocked callers — the public stamp readers and {@link reapRevokedRow}, whose stamp
+     * read runs BEFORE its lock is taken — keep the default retried path. Explicit per call
+     * rather than an ambient flag: unlocked reads run concurrently with a locked body, so
+     * `this`-state cannot tell the two apart. The same flag threads through
+     * {@link findCadrePeerRow} for the two writers that read the whole row inside their body.
      */
     private queryStampId;
     /**
      * `CadrePeer` stamp nonce — read by {@link SeedBootstrapService.removePeer} as its
      * row-present gate before it delegates to {@link deleteCadrePeer}. The in-class
-     * `CadrePeer` writers ({@link insertCadrePeer}, {@link reauthorizeCadrePeer}) go
-     * straight to {@link queryStampId}.
+     * `CadrePeer` writers go straight to {@link queryStampId} ({@link insertCadrePeer}) or read
+     * the whole row ({@link reauthorizeCadrePeer}, through {@link findCadrePeerRow}).
      */
     queryCadrePeerStampId(peerId: string): Promise<string | null>;
     /**
@@ -809,33 +1059,34 @@ export declare class ControlDatabase {
      * ({@link queryCadrePeers}, {@link queryPeerRecord},
      * {@link CadreNode.resolveDeviceToken}) drop any row whose stamp appears here.
      *
-     * NOTE: the per-call cost that matters is the storage layer's, not the row count. While
-     * `Revocation` has never been written, this node does not hold its block, and Optimystic
-     * consults a block's cohort on every read of a block it does not hold: 1 consult per
-     * call (measured), each a round trip to every other member on a multi-machine party. The
-     * ledger marker ({@link openRevocationLedger}) ends that — a held block is re-consulted
-     * at most once per read-repair window (10 s). Do not cache the set instead: a cache
-     * cannot see a tombstone arriving by replication, so it would delay a revocation. The
-     * row count only grows (append-only) but stays small while removals are rare; revisit if
+     * Served from the `Revocation` membership view ({@link readMembershipRows}), dropped by
+     * every change to the table, local or replicated into this node's storage, so a tombstone
+     * arriving by replication is seen on the next call. The cost that matters is the storage
+     * layer's, paid by a cold view's load: while `Revocation` has never been written, this node
+     * does not hold its block, and Optimystic consults a block's cohort on every read of a block
+     * it does not hold, each a round trip to every other member on a multi-machine party. The row
+     * count only grows (append-only) but stays small while removals are rare; revisit if
      * removals become routine and the scan itself shows up in a profile.
      *
      * An isolated node that has never received the `Revocation` block reads it as holding no
-     * revocations instead of throwing — see {@link readRevokedStampRows}.
+     * revocations instead of throwing — see {@link readRevocationRowsOrNone}.
      *
      * `retry: false` is forwarded by {@link queryCadrePeers} for the one caller that reads
      * under the write lock — see that method's note.
      */
     queryRevokedStamps(tableName: RevocableTable, retry?: boolean): Promise<Set<string>>;
     /**
-     * The `Revocation` scan behind {@link queryRevokedStamps}, answering NO ROWS when the read
-     * fails `cohort-unreachable` ({@link isCohortUnreachableRead}): this node does not hold
+     * The `Revocation` rows behind {@link queryRevokedStamps}, answering NO ROWS when the view's
+     * load fails `cohort-unreachable` ({@link isCohortUnreachableRead}): this node does not hold
      * the block and could ask no other cohort member about it. Every other failure rethrows.
      * The retry in {@link readRows} runs first, so a node whose connectivity returns within
-     * the read budget still gets the real answer.
+     * the read budget still gets the real answer. The empty answer is never installed in the
+     * view (a failed load keeps nothing), so the next call asks again.
      *
      * Without this, a machine cut off from every other machine in its party before it ever
-     * received the block — the block does not exist anywhere until the owner files the
-     * ledger marker ({@link openRevocationLedger}) on a connected reconcile pass — cannot
+     * received the block — a joining machine gets it only by reading it from the cohort, and
+     * on a party founded before genesis created every control collection it exists nowhere
+     * until the first tombstone or the marker ({@link REVOCATION_LEDGER_MARKER}) — cannot
      * answer ANY membership, peer-record or device-token lookup, although it holds those
      * rows locally.
      *
@@ -854,12 +1105,12 @@ export declare class ControlDatabase {
      *
      * NOTE: an isolated node pays the whole read retry (up to
      * `CONTROL_READ_RETRY_BUDGET_MS`, plus the slow attempt that exhausted it) before this
-     * answers, and {@link queryPeerRecord} then issues its row scan on top. If an isolated
-     * node's lookups are seen exceeding the admission gate's 2 s deadline
-     * (`ADMISSION_DECISION_TIMEOUT_MS`), skip the retry for this read when the first attempt
-     * fails `cohort-unreachable`.
+     * answers, on every call since the answer is not kept, and {@link queryPeerRecord} may then
+     * load the `CadrePeer` view on top. If an isolated node's lookups are seen exceeding the
+     * admission gate's 2 s deadline (`ADMISSION_DECISION_TIMEOUT_MS`), skip the retry for this
+     * read when the first attempt fails `cohort-unreachable`.
      */
-    private readRevokedStampRows;
+    private readRevocationRowsOrNone;
     /**
      * Every locally-held `CadreControl.Revocation` tombstone — identity triple, its
      * `ReissuedAt` counter and the stored signer pair. Consumed by the cohort-growth re-issue
@@ -868,17 +1119,18 @@ export declare class ControlDatabase {
      * `where`, so the composite-primary-key point-lookup hazard (see the statement comment in
      * {@link reissueRevocations}) does not arise. Unlocked, like every other read.
      *
-     * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}): it retires nothing, so
-     * neither sweep may reap or re-sign it, and skipping it keeps `RevocationRow.tableName`
-     * a {@link RevocableTable}. Filtered on `TableName` alone, in TypeScript: `RowIsGone`
-     * admits no other row under `'Revocation'`.
+     * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}) an older party may hold: it
+     * retires nothing, so neither sweep may reap or re-sign it, and skipping it keeps
+     * `RevocationRow.tableName` a {@link RevocableTable}. Filtered on `TableName` alone, in
+     * TypeScript: `RowIsGone` admits no other row under `'Revocation'`.
      *
      * `retry: false` from a caller that reads under the write lock, for the reason on
      * {@link queryCadrePeers}.
      */
     queryRevocations(retry?: boolean): Promise<RevocationRow[]>;
     /**
-     * Read a single peer's address record (the full `CadrePeer` row) by PeerId.
+     * Read a single peer's address record (the full `CadrePeer` row) by PeerId, found in the
+     * `CadrePeer` membership view ({@link readMembershipRows}).
      *
      * Returns null when no row exists, or when the row's `StampId` is retired in
      * `CadreControl.Revocation` — a revoked peer reads as absent, so the resolver
@@ -894,10 +1146,22 @@ export declare class ControlDatabase {
      * The split `addrs` re-join to the exact stored `Multiaddr` (split-on-`,` is
      * the inverse of join-on-`,`), so the resolver re-verifies over the same bytes
      * the publisher signed.
+     *
+     * `retry: false` from the one caller that reads under the write lock,
+     * {@link updateSelfPeerRecord}'s body, for the reason on {@link queryCadrePeers}.
+     */
+    queryPeerRecord(peerId: string, retry?: boolean): Promise<PeerAddressRecord | null>;
+    /**
+     * One readable `CadrePeer` row by PeerId from the membership view, or null when no row exists
+     * or its stamp is retired in `Revocation` — the single-row read behind {@link queryPeerRecord}
+     * and the two writers that decide over the row inside their locked body
+     * ({@link updateSelfPeerRecord}, {@link reauthorizeCadrePeer}). Same retired-stamp rule as
+     * {@link queryCadrePeers}, and the same `retry` contract.
      */
-    queryPeerRecord(peerId: string): Promise<PeerAddressRecord | null>;
+    private findCadrePeerRow;
     /**
-     * Apply a peer's own self-signed address-record update to an existing row.
+     * Apply a peer's own self-signed address-record update to its existing row: read the row
+     * under the write lock, have `sign` build the record over it, and write that record.
      *
      * Authorization is carried entirely by the record: the `Sig` column (verified
      * by the `AuthorizedUpdate` self-branch against the stored `PublicKey`) plus
@@ -906,6 +1170,21 @@ export declare class ControlDatabase {
      * exists. `PublicKey` is intentionally not in the SET list (it is immutable on
      * self-update and the constraint enforces `new.PublicKey = old.PublicKey`).
      *
+     * The read, the decision and the signature all run INSIDE the locked body, which is what
+     * lets it opt into {@link LOST_UPDATE_RETRY_POLICY}: the row has a second writer, the owner's
+     * re-touch ({@link reauthorizeCadrePeer}), and the two fire together while a cadre starts.
+     * When this write loses that race the commit is refused as a lost update and re-run, and the
+     * re-run reads the row the rival left — including its bumped `UpdatedAt`, which a record
+     * signed before the race could no longer exceed — and signs past it. A record signed outside
+     * the body would be re-presented unchanged and refused again, this time by the schema's
+     * monotonic rule, which is correctly never retried. The row's read inside is `retry: false`
+     * (see {@link queryStampId}'s NOTE).
+     *
+     * Returns the record actually written, so the caller's bookkeeping describes the row rather
+     * than the first record it signed; null, and nothing written, when no readable row exists:
+     * the row is absent, or its stamp is retired in `Revocation` (a revoked node reads its own row
+     * as absent every heartbeat, and must not refresh it).
+     *
      * Deliberately NOT wrapped in {@link mutateCadrePeer}, the one `CadrePeer` mutator that
      * is not: it only ever touches THIS node's own row (sole caller
      * `CadreNode.publishSelfRecord`), and `CadreNode.listAuthorizedMembers` filters self out
@@ -918,8 +1197,11 @@ export declare class ControlDatabase {
      * row, and a self insert happens once at startup, so the wasted refresh is a single read
      * — cheaper than a conditional carve-out inside the shared writer. Only the repeating
      * path is worth exempting.
+     *
+     * @param peerId - the row to refresh: this node's own.
+     * @param sign - builds the signed record over the row as read; called once per attempt.
      */
-    updateSelfPeerRecord(record: PeerAddressRecord): Promise<void>;
+    updateSelfPeerRecord(peerId: string, sign: SelfRecordSigner): Promise<PeerAddressRecord | null>;
     /**
      * Read a single peer's device push token (the full `DeviceToken` row) by PeerId.
      *
@@ -948,19 +1230,34 @@ export declare class ControlDatabase {
     updateSelfDeviceToken(record: DeviceTokenRecord): Promise<void>;
     /**
      * Insert the initial owner key (bootstrap - no existing owners required)
+     *
+     * @param label - the user's name for the key, at most {@link OWNER_KEY_MAX_LABEL}
+     *   characters once trimmed; blank is stored as none.
      */
-    insertOwnerKey(key: string): Promise<void>;
+    insertOwnerKey(key: string, label?: string): Promise<void>;
     /**
      * Owner-signed INSERT of a further `OwnerKey` row, notifying the membership listener once
      * it has committed. The signed-add branch of `OwnerKey.Authorized`: the signer must be an
      * owner in the pre-transaction snapshot, its signature covers the `'add'` digest over
-     * (Key, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a reader
-     * can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
+     * (Key, Label, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a
+     * reader can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
      *
      * Through {@link mutateCadrePeer}, the membership hub. The liveness read, the stamp and the
      * signature all sit inside the locked body: a {@link lockedWithRetry} re-run starts over a
      * rolled-back attempt with a fresh stamp, as {@link redeemCadreInvite} does.
      *
+     * @param label - the user's name for the key, as {@link insertOwnerKey}'s.
+     * @returns `true` when this call seated the row, `false` when `key` is already a live owner
+     *   here (nothing written, whatever its label).
+     * @throws when this node holds `key`'s row under a retired stamp
+     *   ({@link liveOwnerKeyStamp}), or when the schema refuses the signer.
+     */
+    insertOwnerKeyVouched(key: string, ownerKey: string, signMessage: ControlSign, label?: string | null): Promise<boolean>;
+    /**
+     * The stamp of `key`'s live `OwnerKey` row here, or null when this node holds none: the
+     * insert-if-absent read of {@link insertOwnerKeyVouched} and {@link redeemOwnerGrant}. Inside
+     * the locked body (both reads `retry: false`; see queryStampId's NOTE).
+     *
      * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
      * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
      * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
@@ -968,12 +1265,15 @@ export declare class ControlDatabase {
      * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
      * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
      *
-     * @returns `true` when this call seated the row, `false` when `key` is already a live owner
-     *   here (nothing written).
-     * @throws when this node holds `key`'s row under a retired stamp (above), or when the
-     *   schema refuses the signer.
+     * @throws when this node holds `key`'s row under a retired stamp (above).
      */
-    insertOwnerKeyVouched(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    private liveOwnerKeyStamp;
+    /**
+     * The signed-add statement of {@link insertOwnerKeyVouched} and {@link revouchOwnerKey}, the
+     * stored voucher being the signing pair. Bare `exec`: callers hold the write lock, which is
+     * NOT re-entrant.
+     */
+    private execOwnerKeyVouchedInsert;
     /**
      * Owner-signed removal of one `OwnerKey` row plus the `Revocation` tombstone retiring its
      * stamp, notifying the membership listener once it has committed. The remove branch of
@@ -991,56 +1291,58 @@ export declare class ControlDatabase {
      *   (nothing written, no tombstone).
      * @throws when `key` is `ownerKey`, or is the only live owner.
      */
-    deleteOwnerKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteOwnerKey(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Re-vouch a live `OwnerKey` row under this owner's signature: in ONE transaction, the
      * current row's guarded delete plus tombstone ({@link deleteOwnerKey}'s body) and an insert
-     * of the same key under a fresh stamp, signed by `ownerKey` ({@link insertOwnerKeyVouched}'s
-     * body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
+     * of the same key and label under a fresh stamp, signed by `ownerKey`
+     * ({@link insertOwnerKeyVouched}'s body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
      * this is the only way to rebind a row's voucher; the anchor derivation lets the re-add
      * under a fresh stamp beat the older tombstone (`deriveOwnerAnchor`). For
-     * {@link removeMachine}: the owners a machine being removed had added keep their anchor
-     * place everywhere once their row stands on a remaining owner's signature.
+     * `CadreNode.removeOwner`: the owners a key being removed had added keep their anchor place
+     * everywhere once their row stands on a remaining owner's signature.
      *
-     * Through {@link mutateCadrePeer}, the membership hub. The stamp read runs inside the locked
+     * Through {@link mutateCadrePeer}, the membership hub. The row read runs inside the locked
      * body; a row whose stamp is already retired (held without its delete) is reported as absent
      * rather than tombstoned twice.
      *
      * @returns `true` when the row was re-vouched, `false` when `key` is not a live owner here.
      * @throws when `key` is `ownerKey` (an owner cannot sign its own row's removal).
      */
-    revouchOwnerKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    revouchOwnerKey(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
-     * Remove one machine completely, in ONE transaction: its `CadrePeer` row, its `OwnerKey`
-     * row when `target.ownerKey` names one, its `DeviceToken` row when it has one, each with
-     * the `Revocation` tombstone retiring its stamp ({@link deleteGuardedRow}'s statement pair,
-     * composed bare as {@link deleteStrandAndPartyKey} composes it), plus a withdrawal tombstone
-     * for every `CadreInvite` in `target.inviteKeys` that is still live here
-     * ({@link withdrawCadreInvite}'s body). One transaction so no reader sees the machine half
-     * removed: a row gone but its push token resolvable, or its owner key gone but an invitation
-     * it could redeem again still open.
+     * Remove one machine completely, in ONE transaction: its `CadrePeer` row and its
+     * `DeviceToken` row when it has one, each with the `Revocation` tombstone retiring its stamp
+     * ({@link deleteGuardedRow}'s statement pair, composed bare as {@link deleteStrandAndPartyKey}
+     * composes it), plus a withdrawal tombstone for every `CadreInvite` in `target.inviteKeys`
+     * that is still live here ({@link withdrawCadreInvite}'s body). One transaction so no reader
+     * sees the machine half removed: a row gone but its push token resolvable, or an invitation
+     * it could redeem again still open. Owner keys are never touched: they are the person's, and
+     * removing one is {@link deleteOwnerKey}.
      *
      * Through {@link mutateCadrePeer}, the membership hub. Every stamp is read inside the locked
      * body, and a row whose stamp is already retired (held without its delete) is skipped rather
-     * than tombstoned twice. The by-name owner refusals of {@link deleteOwnerKey} apply to the
-     * owner-key arm. Nothing to remove writes nothing and returns all false.
+     * than tombstoned twice. Nothing to remove writes nothing and returns all false.
      *
-     * The caller decides WHAT to remove, which owner key is the machine's and which invitations
-     * it could use, from its plan (`CadreNode.planMachineRemoval`); this method only refuses to
-     * write an inconsistent set.
+     * Opted into {@link LOST_UPDATE_RETRY_POLICY} for the reason on {@link deleteCadrePeer}: every
+     * stamp and signature is minted inside the body, and the invitation keys come from the
+     * caller's plan, which a self-publish does not touch (a withdrawal of an invitation withdrawn
+     * since collides on `Revocation`'s primary key — a constraint failure, never retried, as
+     * before). A lost update after a sibling tree of the transaction already synced arrives as a
+     * partial commit and stays declined.
      *
-     * @throws when `target.ownerKey` is `ownerKey`, or is the only live owner here.
+     * The caller decides which invitations the machine could use, from its plan
+     * (`CadreNode.planMachineRemoval`).
      */
     removeMachine(target: {
         peerId: string;
-        ownerKey: string | null;
         inviteKeys: readonly string[];
-    }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<MachineRemovalWrites>;
+    }, ownerKey: string, signMessage: ControlSign): Promise<MachineRemovalResult>;
     /**
      * The guarded removals {@link removeMachine} runs, signed over each row's current stamp:
-     * the `CadrePeer` row, the `OwnerKey` row when named, the `DeviceToken` row when present.
-     * Inside the locked body (every read `retry: false`); one `Revocation` scan serves the
-     * retired-stamp check for all three tables and the last-owner refusal.
+     * the `CadrePeer` row and the `DeviceToken` row, each when present. Inside the locked body
+     * (every read `retry: false`); one `Revocation` scan serves the retired-stamp check for both
+     * tables.
      */
     private signMachineRemovals;
     /**
@@ -1062,7 +1364,29 @@ export declare class ControlDatabase {
      *   with the owner's private key, returning a base64url signature
      * @param memberPrivateKey - Optional private key for membership in closed strands
      */
-    insertStrand(strandId: string, type: 'o' | 'c', ownerKey: string, signMessage: (message: Uint8Array) => string, memberPrivateKey?: string): Promise<void>;
+    insertStrand(strandId: string, type: 'o' | 'c', ownerKey: string, signMessage: ControlSign, memberPrivateKey?: string): Promise<void>;
+    /** The stamped, owner-signed `Strand` insert that {@link insertStrand} and {@link insertFoundingRows} run. */
+    private signStrandInsert;
+    /**
+     * Insert one founding's control rows — the `Strand` row, a closed strand's `StrandPartyKey`
+     * row, and a formation invitation bound to the strand — in ONE transaction: one commit, and
+     * never a strand row without the key or invitation written beside it.
+     *
+     * Each row is stamped and signed exactly as its single-row writer ({@link insertStrand},
+     * {@link insertStrandPartyKey}, {@link insertFormationInvite}) does it, and all of that — the
+     * invitation's {@link canonicalDatetime} read included — happens BEFORE the write lock is
+     * taken: signing may prompt the user, and the lock held across a prompt would stall every
+     * other control write. A {@link lockedWithRetry} re-run re-presents the same signed rows.
+     *
+     * No row's `AuthorizedInsert` reads another of these rows (`StrandPartyKey` and
+     * `FormationInvite` check only `OwnerKey` and `Revocation`), so their order is free; the
+     * `Strand` row goes first, so a founding repeated over a stored row is refused on `Strand.Id`.
+     *
+     * A uniqueness rejection rolls the whole transaction back. The caller resolves it and writes
+     * again: a `Strand.Id` conflict is another founder's row, a `StrandPartyKey.Id` conflict a key
+     * stored with no strand row ({@link isStrandIdConflict}; see `CadreNode.publishStrand`).
+     */
+    insertFoundingRows(rows: FoundingRows, ownerKey: string, signMessage: ControlSign): Promise<void>;
     /**
      * Delete a strand from the control database using an owner signature.
      *
@@ -1090,7 +1414,7 @@ export declare class ControlDatabase {
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
      */
-    deleteStrand(strandId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteStrand(strandId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * The locked body of {@link deleteStrand}: the `Strand` delete + tombstone, plus — when
      * one exists — the strand's `StrandPartyKey` delete + tombstone, all in ONE
@@ -1120,7 +1444,9 @@ export declare class ControlDatabase {
      * @param signMessage - Function that ed25519-signs the raw message bytes (no pre-hash)
      *   with the owner's private key, returning a base64url signature.
      */
-    insertStrandPartyKey(strandId: string, privateKey: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<void>;
+    insertStrandPartyKey(strandId: string, privateKey: string, ownerKey: string, signMessage: ControlSign): Promise<void>;
+    /** The stamped, owner-signed `StrandPartyKey` insert that {@link insertStrandPartyKey} and {@link insertFoundingRows} run. */
+    private signStrandPartyKeyInsert;
     /**
      * Owner-signed removal of one `StrandPartyKey` row — the party's own membership
      * identity for that strand, stored nowhere else, so this is as destructive as
@@ -1133,7 +1459,7 @@ export declare class ControlDatabase {
      * `Revocation` tombstone in the same transaction. A no-op (no throw, no tombstone)
      * when the row does not exist — `false` then, `true` when a row was actually removed.
      */
-    deleteStrandPartyKey(strandId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteStrandPartyKey(strandId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Record, party-wide, a strand this party joined from another party (`JoinedStrand` row),
      * using an owner signature.
@@ -1146,14 +1472,14 @@ export declare class ControlDatabase {
      * Fails with a `JoinedStrand.Id` uniqueness violation when the id is already recorded;
      * `isStrandIdConflict(error, 'JoinedStrand')` identifies that case.
      */
-    insertJoinedStrand(row: Pick<StrandRow, 'Id' | 'Type' | 'MemberPrivateKey'>, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<void>;
+    insertJoinedStrand(row: Pick<StrandRow, 'Id' | 'Type' | 'MemberPrivateKey'>, ownerKey: string, signMessage: ControlSign): Promise<void>;
     /**
      * Owner-signed removal of one `JoinedStrand` row. Mirrors {@link deleteStrandPartyKey}:
      * `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same
      * transaction. A no-op (no throw, no tombstone) when the row does not exist — `false`
      * then, `true` when a row was actually removed.
      */
-    deleteJoinedStrand(strandId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteJoinedStrand(strandId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Record, party-wide, a join this party asked for: a `JoinRequest` row under a fresh stamp,
      * owner-signed over every column. Returns the pending join as written.
@@ -1161,7 +1487,7 @@ export declare class ControlDatabase {
      * Fails with a `JoinRequest.Id` uniqueness violation when the party already holds a request
      * for this invitation; {@link isPendingJoinConflict} identifies that case.
      */
-    insertJoinRequest(request: JoinRequestFields, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
+    insertJoinRequest(request: JoinRequestFields, ownerKey: string, signMessage: ControlSign): Promise<PendingJoin>;
     /**
      * Record the outcome of the pending join `expected`: its owner-signed `JoinSuccess` /
      * `JoinFailure` row, keyed by the request's stamp. A join recorded over a failure deletes the
@@ -1175,7 +1501,7 @@ export declare class ControlDatabase {
      * transaction instead (its outcome row collides on the primary key, or its tombstone retires
      * the stamp), and the caller re-reads either way.
      */
-    recordJoinOutcome(expected: PendingJoin, outcome: JoinOutcome, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
+    recordJoinOutcome(expected: PendingJoin, outcome: JoinOutcome, ownerKey: string, signMessage: ControlSign): Promise<PendingJoin>;
     /**
      * Re-write the pending join `next` (request and outcome) under a fresh stamp, retiring the
      * live request incarnation `expectedStampId`: how a finished request is asked for again, and
@@ -1190,14 +1516,14 @@ export declare class ControlDatabase {
      * that committed but reported failure throws {@link PendingJoinChangedError} whose live join
      * carries the returned stamp, so a caller that re-reads finds its write.
      */
-    rewritePendingJoin(expectedStampId: string, next: PendingJoinFields, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
+    rewritePendingJoin(expectedStampId: string, next: PendingJoinFields, ownerKey: string, signMessage: ControlSign): Promise<PendingJoin>;
     /**
      * Owner-signed removal of one pending join, as {@link deleteJoinedStrand} removes its row:
      * `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same transaction,
      * and the request's outcome row with it. A no-op (no throw, no tombstone) when there is no
      * request — `false` then, `true` when one was actually removed.
      */
-    deletePendingJoin(id: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deletePendingJoin(id: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Mint a fresh stamp for `request` and the owner signature `JoinRequest.AuthorizedInsert`
      * verifies, returning the row as it will be written and its insert.
@@ -1224,7 +1550,7 @@ export declare class ControlDatabase {
      * @param signMessage - Function that ed25519-signs the raw message bytes (no pre-hash)
      *   with the owner's private key, returning a base64url signature
      */
-    insertValidationKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<void>;
+    insertValidationKey(key: string, ownerKey: string, signMessage: ControlSign): Promise<void>;
     /**
      * Delete a validation key from the control database using an owner signature.
      *
@@ -1241,7 +1567,7 @@ export declare class ControlDatabase {
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
      */
-    deleteValidationKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteValidationKey(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Owner-vouched INSERT of one `CadrePeer` membership row, notifying the membership
      * listener once it has committed.
@@ -1286,34 +1612,46 @@ export declare class ControlDatabase {
         updatedAt: number;
         sig: string | null;
         profile: NodeProfile | null;
-    }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
-    /**
-     * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
-     * rewrite `VouchOwner`/`VouchSig` under the owner branch of `CadrePeer.AuthorizedUpdate`
-     * (a signature over the SAME `'vouch'`-tagged digest {@link insertCadrePeer} builds), so
-     * the row is re-emitted as a fresh, broadcasting transaction.
-     *
-     * This is the write-while-alone re-replication primitive: a membership row that committed
-     * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it grows, by
-     * re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because the row
-     * already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness stamp
-     * and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact (the
-     * owner branch requires them kept: they are the machine's own claim) — so it is safe
-     * over a row whose peer has not self-published (`Sig` null); the caller must skip a row
-     * that already carries a self-`Sig` (that row is the owning peer's to refresh, and bumping
-     * `UpdatedAt` without re-signing would invalidate its self-signature).
-     *
-     * Signs over the row's CURRENT `StampId` (unchanged by the re-touch), read BEFORE the lock
-     * is taken. An absent row returns `false` WITHOUT notifying: nothing was written, so the
-     * membership snapshot cannot have changed.
-     *
-     * NOTE: that stamp read is outside the lock, same as {@link deleteGuardedRow}'s. A writer
-     * that removes the row in between makes the `update` match nothing, and this still returns
-     * `true` and notifies — harmless today (the sole caller, the write-while-alone drain, only
-     * logs the result, and a spurious notify just re-reads the member set), and a remove-then-
-     * re-add in the same window fails loudly instead, since the signature binds the retired
-     * stamp. If a caller ever acts on `true` as proof the row was written, fold the stamp read
-     * into the locked body.
+    }, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
+    /**
+     * Owner "re-touch" of an existing `CadrePeer` membership row: rewrite `VouchOwner`/`VouchSig`
+     * (and, re-broadcasting, bump `UpdatedAt`) under the owner branch of
+     * `CadrePeer.AuthorizedUpdate` — a signature over the SAME `'vouch'`-tagged digest
+     * {@link insertCadrePeer} builds — so the row is re-emitted as a fresh, broadcasting
+     * transaction, or stands on a different owner's voucher.
+     *
+     * Re-broadcasting is the write-while-alone re-replication primitive: a membership row that
+     * committed local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it
+     * grows, by re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because
+     * the row already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness
+     * stamp and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact
+     * (the owner branch requires them kept: they are the machine's own claim) — so it is safe
+     * over a row whose peer has not self-published (`Sig` null), and this method itself skips a
+     * row that already carries a self-`Sig` (that row is the owning peer's to refresh, and
+     * bumping `UpdatedAt` without re-signing would invalidate its self-signature).
+     *
+     * The two modes ({@link CadrePeerRetouchMode}) differ in what they write: `'rebroadcast'`
+     * bumps `UpdatedAt` to `max(now, current + 1)` from the row read inside the body and writes
+     * only while the row's `Sig` is null; `'revouch'` leaves `UpdatedAt` out of the `set` list and
+     * writes whether or not the machine has self-published (the owner branch has no monotonic
+     * rule, so the column simply keeps its value).
+     *
+     * The row read (stamp, `Sig`, `UpdatedAt`), the mode's decision and the signature over the
+     * row's CURRENT `StampId` (unchanged by the re-touch) all run INSIDE the locked body, which is
+     * what lets both modes opt into {@link LOST_UPDATE_RETRY_POLICY}: the row's other writer is
+     * the machine's own publish ({@link updateSelfPeerRecord}), and the drain's re-broadcast fires
+     * at the moment that publish does. A re-run after losing to it reads the self-signed row and
+     * reports `'self-published'` instead of writing the owner branch over it — which would rewrite
+     * `UpdatedAt` under a `Sig` signed over the old value and make the record unverifiable to
+     * resolvers until the machine's next heartbeat. The decision has to be the body's for that;
+     * a caller's pre-check outside the lock is only a fast path (see below).
+     *
+     * An absent row — none, or its stamp retired, or a stampless row no writer produces — is
+     * `'absent'`. Checked once outside the lock too, as `'self-published'` is: the common case
+     * writes nothing, takes no lock and does NOT notify, so an absent target stays quiet
+     * ({@link SeedBootstrapService.removePeer} keeps the same gate for the same reason). The
+     * in-body re-check covers the race; a no-write outcome reached there notifies spuriously,
+     * which only re-reads the member set.
      *
      * Notifies like the insert/remove paths even though this is "only" a re-touch: it rewrites
      * VouchOwner/VouchSig, which the authorized-membership predicate judges on, so it CAN
@@ -1327,21 +1665,22 @@ export declare class ControlDatabase {
      *
      * NOTE: this rebinds VouchOwner to the CALLING owner's key, and the authorized-membership
      * predicate (`CadreNode.listAuthorizedMembers`) now judges rows by that column against each
-     * reader's node-local anchor. Benign today because the only caller — the write-while-alone
-     * drain — re-touches solely rows this node itself authored (`pendingPeerWrites`), so the
-     * voucher is rewritten to the key that already signed it. If a future path ever lets one
-     * owner re-touch a row a DIFFERENT owner vouched, the voucher silently flips: readers that
-     * anchor the original owner but not this one would drop a legitimate member. Such a path
-     * must re-vouch deliberately (or preserve the existing VouchOwner/VouchSig) rather than
-     * inherit this rebinding.
+     * reader's node-local anchor. The two callers rebind on purpose: the write-while-alone drain
+     * re-touches solely rows this node itself authored (`pendingPeerWrites`), so the voucher is
+     * rewritten to the key that already signed it, and `CadreNode.removeOwner` moves rows off a
+     * key it is about to remove. A new caller that re-touches a row a DIFFERENT owner vouched
+     * flips the voucher silently: readers that anchor the original owner but not this one would
+     * drop a legitimate member. It must re-vouch deliberately (or preserve the existing
+     * VouchOwner/VouchSig) rather than inherit this rebinding.
      *
      * @param peerId - the membership row to re-touch.
-     * @param updatedAt - the strictly-increasing freshness stamp to write.
+     * @param mode - re-broadcast or re-vouch ({@link CadrePeerRetouchMode}).
      * @param ownerKey - public key of the re-vouching owner, rewritten into `VouchOwner`.
-     * @param signMessage - ed25519-signs the raw message bytes with that owner's private key.
-     * @returns `true` when the row was re-touched, `false` when no row exists (no notify).
+     * @param signMessage - ed25519-signs the raw message bytes with that owner's private key;
+     *   called inside the lock, once per attempt (the NOTE on {@link ControlSign}).
+     * @returns what was found and done ({@link CadrePeerRetouchOutcome}).
      */
-    reauthorizeCadrePeer(peerId: string, updatedAt: number, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    reauthorizeCadrePeer(peerId: string, mode: CadrePeerRetouchMode, ownerKey: string, signMessage: ControlSign): Promise<CadrePeerRetouchOutcome>;
     /**
      * Owner-signed removal of one `CadrePeer` membership row, notifying the membership
      * listener once it has committed.
@@ -1361,8 +1700,14 @@ export declare class ControlDatabase {
      *
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
+     *
+     * Opted into {@link LOST_UPDATE_RETRY_POLICY}: the row's machine may publish its own record
+     * at the moment of the removal (its first publish lands about a second after it starts), and
+     * the removal that loses is refused as a lost update. {@link deleteGuardedRow} reads the stamp
+     * and signs inside the body, and a self-publish never changes the stamp the `'remove'` digest
+     * binds, so the re-run reads the published row and removes it.
      */
-    deleteCadrePeer(peerId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteCadrePeer(peerId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Owner-signed removal of one peer's `DeviceToken` row (logout / token invalidation).
      *
@@ -1376,7 +1721,7 @@ export declare class ControlDatabase {
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
      */
-    deleteDeviceToken(peerId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteDeviceToken(peerId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Owner-signed delete of one guarded row plus the `Revocation` tombstone retiring its
      * stamp, in ONE transaction. The single body behind EVERY guarded delete —
@@ -1421,10 +1766,9 @@ export declare class ControlDatabase {
     private execGuardedRemoval;
     /**
      * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
-     * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of a
-     * `CadreInvite` withdrawal ({@link withdrawCadreInvite}), whose row stays — or the ledger
-     * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
-     * lock and, where one is needed, the transaction.
+     * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of an
+     * issued row's withdrawal ({@link withdrawIssuedRow}), whose row stays. The caller
+     * supplies the lock and, where one is needed, the transaction.
      *
      * `ReissuedAt` is named explicitly at 0 (the only value `FreshTombstone` accepts) rather
      * than leaning on the column default — the seat-at-zero rule is load-bearing for
@@ -1462,9 +1806,10 @@ export declare class ControlDatabase {
      * statement, and without the clause the reap would delete the owner's brand-new row.
      * With it the statement matches nothing and the reap is a silent no-op (the schema
      * branch would also refuse that delete, but as a constraint error thrown into a
-     * background sweep — matched-nothing is the better failure mode). Like
-     * {@link reauthorizeCadrePeer}, a race lost AFTER the guard still returns `true`;
-     * harmless — nothing was deleted, and the next sweep re-reads.
+     * background sweep — matched-nothing is the better failure mode). A race lost AFTER the
+     * guard still returns `true` here (unlike {@link reauthorizeCadrePeer}, which reads inside
+     * its lock and reports what it found); harmless — nothing was deleted, and the next sweep
+     * re-reads.
      *
      * Writes NOTHING to `Revocation`: `RevocationRecorded` is satisfied by the same
      * committed tombstone that authorizes the reap, so a reap files no second tombstone.
@@ -1491,7 +1836,7 @@ export declare class ControlDatabase {
      * present clause are the shape {@link redeemInvitation}'s consent-branch insert ships).
      *
      * Driven automatically by {@link reapRevokedRows}, which the periodic control-cohort
-     * reconcile pass runs while the node has at least one control connection.
+     * reconcile pass runs while a sibling is reachable (`CadreNode.hasReachableControlSibling`).
      */
     reapRevokedRow(table: ReapableTable, rowKey: string, stampId: string): Promise<boolean>;
     /**
@@ -1502,8 +1847,8 @@ export declare class ControlDatabase {
      * carry the delete (replaying a delete of an already-absent row is a no-op), so a node
      * that converged on a removal while holding the removed row keeps that row as inert
      * garbage until something walks the tombstones and drops it. `CadreNode`'s periodic
-     * control-cohort reconcile pass is that something, gated on the node having at least one
-     * control connection (a reap is a write, and a write committed alone is local-only).
+     * control-cohort reconcile pass is that something, gated on a sibling being reachable
+     * (a reap is a write, and a write committed alone is local-only).
      *
      * Enumerated UNLOCKED, deleted per-row LOCKED: {@link reapRevokedRow} takes the write
      * lock itself (via {@link mutateCadrePeer} / {@link execWrite}) and the lock is not
@@ -1536,12 +1881,11 @@ export declare class ControlDatabase {
      *
      * NOTE: cost is O(tombstones), not O(live rows) — one {@link queryRevocations} scan plus
      * one {@link queryStampId} point lookup per tombstone, and the empty early return makes
-     * the common case (a party that has never revoked anyone; {@link queryRevocations} skips
-     * the ledger marker) a single scan per pass. That scan consults the cohort on every pass
-     * only while `Revocation` has never been written; the ledger marker
-     * ({@link openRevocationLedger}), filed by the same connected pass, makes it a held block.
+     * the common case (a party that has never revoked anyone) a single scan per pass, served
+     * from the `Revocation` membership view
+     * ({@link readMembershipRows}) unless the table changed since the last read.
      * But `Revocation` is append-only and unbounded, so this is O(all tombstones ever) point
-     * lookups on every reconcile tick. Fine while revocations stay rare for a cadre-sized
+     * lookups on every connected reconcile pass. Fine while revocations stay rare for a cadre-sized
      * party; if the table ever grows, persist a node-local high-water mark of what has
      * already been reaped instead of re-scanning everything (the same bound the sweep in
      * `CadreNode.drainPendingRevocations` wants).
@@ -1575,45 +1919,7 @@ export declare class ControlDatabase {
      *
      * Returns how many UPDATE statements ran (`rows.length` on success).
      */
-    reissueRevocations(rows: readonly RevocationRow[], reissuedAt: number, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<number>;
-    /**
-     * Owner-signed filing of the singleton `Revocation` ledger marker
-     * ({@link REVOCATION_LEDGER_MARKER}), the one row in that table that retires nothing.
-     *
-     * Why it exists: while `Revocation` has never been written, this node does not hold its
-     * block, and Optimystic consults a block's cohort on EVERY read of a block it does not
-     * hold — and every membership lookup, and every guarded insert's `NotRevoked` check,
-     * reads this table. Once any row exists the block is held and re-checked at most once per
-     * read-repair window, like every other populated table. The schema's table comment says
-     * why the row can never read as a retirement.
-     *
-     * Insert-if-absent, shaped like {@link reissueRevocations}: the signature is minted
-     * OUTSIDE the locked body so a retried attempt re-presents the same one, and the guard
-     * runs INSIDE it so it sees a concurrent local writer's committed row. The guard scans
-     * the `'Revocation'` rows and compares the stamp in TypeScript rather than seeking the
-     * full composite primary key, which is served as a point lookup that can miss an existing
-     * row on a networked database (tickets/backlog/debt-composite-pk-point-lookup-unreliable-untracked).
-     *
-     * Two owners filing at once: the loser either sees the marker in its guard or is refused
-     * on the primary key, and both answer `'already-open'`.
-     *
-     * The caller decides WHEN. A marker committed while the node is alone is local-only and
-     * can fork the collection, so {@link CadreNode} files it only while connected; this
-     * method does not look at connectivity.
-     *
-     * @param ownerKey - owner public key for the write context (`Revocation.Authorized`).
-     * @param signMessage - ed25519-signs the raw message bytes (no pre-hash) with that owner's
-     *   private key, returning a base64url signature.
-     * @returns `'opened'` when this call filed the marker, `'already-open'` when it was
-     *   already there.
-     */
-    openRevocationLedger(ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<RevocationLedgerOpenResult>;
-    /**
-     * Whether the ledger marker is present locally: a scan of the `'Revocation'` rows with the
-     * stamp compared in TypeScript (see {@link openRevocationLedger} for why not a seek).
-     * Called only inside the locked write body, so never retried (see queryStampId's NOTE).
-     */
-    private revocationLedgerFiled;
+    reissueRevocations(rows: readonly RevocationRow[], reissuedAt: number, ownerKey: string, signMessage: ControlSign): Promise<number>;
     /**
      * Run `body` between `beginTransaction` and `commit`, rolling back on failure.
      *
@@ -1645,8 +1951,21 @@ export declare class ControlDatabase {
      * {@link CadreNode}, which wires this in `start()` and clears it on teardown. A
      * second call replaces the first rather than fanning out, so a stale node can
      * never keep receiving notifications for a database it no longer owns.
+     *
+     * Only this database's own writes notify here, awaited inside the write so the gate is
+     * current before the write returns. A membership change replicated in from another
+     * machine reaches the gate through the subscription `CadreNode.start` takes on the
+     * membership tables ({@link watchTables}), a coalesced run up to 50 ms after the change
+     * lands in storage; one storage never hears of waits for the reconcile pass's backstop.
      */
     setMembershipChangeListener(listener: MembershipChangeListener | null): void;
+    /**
+     * Subscribe `onChange` to changes in control tables (`'CadreControl.Strand'`, …): commits
+     * made here and changes replicated into this node's storage alike, on the single-flight
+     * schedule `table-change-watch.ts` describes. {@link close} disposes every subscription
+     * still live before it drains the write queue.
+     */
+    watchTables(tables: readonly string[], onChange: () => Promise<void>, options: TableChangeWatchOptions): TableChangeWatch;
     /**
      * Wire (or clear, with null) the single listener notified after every committed
      * guarded-table delete. Same ownership contract as
@@ -1672,8 +1991,9 @@ export declare class ControlDatabase {
      * Covers every write that can change who is a member or an owner: EVERY `CadrePeer`
      * writer, with one documented exception ({@link updateSelfPeerRecord}, which cannot
      * change the snapshot), the `OwnerKey` writers ({@link insertOwnerKeyVouched},
-     * {@link deleteOwnerKey}) and the invitation redemption ({@link redeemCadreInvite}),
-     * which seats both. That is what makes the party-membership snapshot refresh automatic
+     * {@link deleteOwnerKey}), the invitation redemption ({@link redeemCadreInvite}), which
+     * seats both, and the owner-grant redemption ({@link redeemOwnerGrant}). That is what
+     * makes the party-membership snapshot refresh automatic
      * rather than a caller obligation. The name predates the `OwnerKey` writers. A
      * writer necessarily holds the target node's ControlDatabase (the `SeedBootstrapService`'s
      * event callbacks are NOT a viable seam: the temp service `CadreNode.applySeed`
@@ -1700,8 +2020,11 @@ export declare class ControlDatabase {
      * exhaustion.
      *
      * @param reason - Label for the log line only (e.g. `'peer-insert'`).
+     * @param policy - The retry policy, default unless the body has earned a wider one: the three
+     *   `CadrePeer` writers whose bodies re-read the row and decide inside pass
+     *   `LOST_UPDATE_RETRY_POLICY` (its `NOTE:` names them and the rule).
      */
-    mutateCadrePeer<T>(reason: string, body: () => Promise<T>): Promise<T>;
+    mutateCadrePeer<T>(reason: string, body: () => Promise<T>, policy?: ControlWriteRetryOptions): Promise<T>;
     /**
      * Run one local write under the database-wide write lock, serializing it against
      * every other local writer on this ControlDatabase.
@@ -1714,8 +2037,8 @@ export declare class ControlDatabase {
      * class: every public write method of this class runs its statement(s) under it, and
      * `SeedBootstrapService` reaches it through {@link execWrite} rather than touching the
      * `Database` directly, so it is covered too. The race is
-     * real, not theoretical: the background self-record publish on a control connection
-     * opening (`CadreNode.drainPendingControlReplication` → `registerSelf`) collided with
+     * real, not theoretical: the background self-record publish when a sibling becomes
+     * reachable (`CadreNode.drainPendingControlReplication` → `registerSelf`) collided with
      * a foreground `authorizePeer` — both `CadrePeer` inserts — and tripped the boundary
      * assert.
      *
@@ -1739,6 +2062,11 @@ export declare class ControlDatabase {
      * re-runnable means a retry re-runs the body's reads too, which is what makes it safe.
      * Signatures and stamp ids minted OUTSIDE the body are deliberately NOT re-minted per
      * attempt: a retry re-presents the exact signed message the first attempt presented.
+     * A body opted into `LOST_UPDATE_RETRY_POLICY` is the exception, and must mint INSIDE:
+     * its re-run is a re-decision over a row another writer changed, not a re-presentation of
+     * the same write, so its read of the row, its decision and its signature all run in the
+     * body ({@link updateSelfPeerRecord}, {@link reauthorizeCadrePeer}, {@link deleteGuardedRow}
+     * under {@link deleteCadrePeer}, {@link removeMachine}).
      */
     withWriteLock<T>(fn: () => Promise<T>): Promise<T>;
     /**
@@ -1760,13 +2088,18 @@ export declare class ControlDatabase {
      * backoff never stalls the other local writers queued behind it. Safe because every
      * locked body is atomic and re-runnable (the contract on {@link withWriteLock}).
      *
-     * Also carries {@link loadSchema}'s distributed DDL, the one caller that runs BEFORE
+     * Also carries {@link applyControlSchema}'s distributed DDL, the one caller that runs BEFORE
      * `initialized` is set — so it reaches this method directly rather than through
      * {@link execWrite}, whose {@link ensureInitialized} would reject it. The write queue is
      * necessarily empty at that point, so the lock is uncontended there; it is taken anyway
-     * rather than carving out a lockless path. It is also the ONLY caller that passes a
-     * `policy` — everything else takes the default, whose classifier and attempt count are
-     * unchanged by that call site existing.
+     * rather than carving out a lockless path.
+     *
+     * Two policies reach here besides the default: `SCHEMA_INIT_RETRY_POLICY` from that one
+     * call site, and `LOST_UPDATE_RETRY_POLICY` from the `CadrePeer` writers that re-read the
+     * row inside their body ({@link updateSelfPeerRecord} directly; {@link reauthorizeCadrePeer},
+     * {@link deleteCadrePeer} and {@link removeMachine} through {@link mutateCadrePeer}'s
+     * policy parameter). Everything else takes the default, whose classifier and attempt count
+     * are unchanged by those call sites existing.
      *
      * `label` names the operation in this loop's debug lines and nothing else
      * ({@link ControlWriteRetryOptions.label}). Every call site in this class supplies one:
@@ -1863,12 +2196,17 @@ export declare class ControlDatabase {
      * @param options - Optional `expiresAtMs` (epoch ms), `totalUses`, `validationUrl`,
      *   `strandId` (bind to a pre-existing host strand for provision-then-record)
      */
-    insertFormationInvite(token: string, sAppId: string, ownerKey: string, signMessage: (message: Uint8Array) => string, options?: {
+    insertFormationInvite(token: string, sAppId: string, ownerKey: string, signMessage: ControlSign, options?: {
         expiresAtMs?: number;
         totalUses?: number;
         validationUrl?: string;
         strandId?: string;
     }): Promise<void>;
+    /**
+     * The stamped, owner-signed `FormationInvite` insert that {@link insertFormationInvite} and
+     * {@link insertFoundingRows} run. Reads the engine once, for the canonical `ExpiresAt`.
+     */
+    private signFormationInviteInsert;
     /**
      * Redeem a `FormationInvite` by inserting the `Strand` row and a matching
      * `FormationUsage` row **atomically, in one transaction**.
@@ -1939,14 +2277,13 @@ export declare class ControlDatabase {
      * Use {@link redeemInvitation} instead when the strand must be created by
      * consent atomically with the usage.
      *
-     * The strand's live `StampId` is read first and written onto the usage row:
+     * The strand's live `StampId` is written onto the usage row:
      * `FormationUsage.StrandExists` matches the (id, stamp) PAIR, and
      * `Strand.AuthorizedInsert`'s consent branch reads the same pair back, so a consent
-     * record authorizes exactly the strand ROW it was recorded against. A missing strand
-     * THROWS here rather than being left to the deferred `StrandExists` CHECK — the
-     * ordinary "host strand has not converged yet" case is already reported as `missing`
-     * by {@link ControlFormationUsageRecorder.resolveStrand}, so an absent row at this
-     * point is a genuine race and deserves a named error, not a silent rollback.
+     * record authorizes exactly the strand ROW it was recorded against. A caller that already
+     * read the stamp passes it (`strandStampId`); otherwise it is read here first, and a
+     * missing strand THROWS {@link MissingHostStrandError} rather than being left to the
+     * deferred `StrandExists` CHECK.
      *
      * The row is keyed by the joiner's own nonce (`UsageStampId` is the primary key), so this
      * path — the one production actually races on (a bound invite published by `cadre-web` /
@@ -1981,6 +2318,13 @@ export declare class ControlDatabase {
          * {@link queryFormationInvite} read; `null` means "no invite row" / unlimited.
          */
         totalUses?: number | null;
+        /**
+         * The host strand's `StampId`, when the caller already read the row
+         * ({@link queryStrandWithStamp}); `undefined` reads it here. A stamp is fixed for the life
+         * of its row, so one read earlier is the stamp `StrandExists` compares, unless the row was
+         * removed (and re-seated) in between, which that CHECK refuses at commit.
+         */
+        strandStampId?: string;
     }): Promise<FormationUsageResult>;
     /**
      * Refuse a redemption that would consume a seat the invite does not have.
@@ -2034,7 +2378,7 @@ export declare class ControlDatabase {
      * permissive PRE-check that runs ahead of it, and a transiently short read costs each of
      * them only a worse outcome for the ATTEMPT, never a seat the invitation did not pay for:
      * {@link assertSeatRemains} loses its named exhaustion error and falls back to the CHECK's
-     * generic refusal; `ControlFormationUsageRecorder.isTokenUsed` reports not-used and lets
+     * generic refusal; `ControlFormationUsageRecorder.readToken` reports a seat free and lets
      * the redemption proceed to the CHECK, which decides; {@link hasOutstandingFormationInvite}
      * holds the stranger-admission door open slightly longer.
      *
@@ -2060,12 +2404,12 @@ export declare class ControlDatabase {
     /**
      * Is any `FormationInvite` row still redeemable — unexpired AND with usage
      * below its `TotalUses`? A null `ExpiresAt` never expires and a null
-     * `TotalUses` is unlimited, matching {@link ControlFormationUsageRecorder}'s
-     * per-token semantics (`isTokenValid` / `isTokenUsed`).
+     * `TotalUses` is unlimited, matching the per-token semantics of `classifyTokenRead`
+     * (`formation-token.ts`).
      *
      * Answers the control-network connection gate's coarse "does this node expect
      * a stranger?" question, which has no token to ask about. The expiry
-     * comparison is `expiresAtMs <= now` — identical to `isTokenValid`'s — so an
+     * comparison is `expiresAtMs <= now` — identical to `isInviteExpired`'s — so an
      * invite the formation handler would reject can never hold the gate open.
      *
      * The scan is deliberately not pushed into SQL: nothing else here compares a
@@ -2091,31 +2435,53 @@ export declare class ControlDatabase {
      * private half to the invitee out of band. It is never stored here (`Strand.Invite` has the
      * same shape).
      *
-     * @param invite.key - the invitation public key (base64url ed25519), the row's primary key
-     * @param invite.peerId - the device the invitation is for, or null for whoever redeems first
-     * @param invite.grantsOwner - whether redemption also seats an `OwnerKey` row for the device
-     * @param invite.expiresAtMs - epoch ms after which it cannot be redeemed; omit for never
-     * @param invite.totalUses - how many redemptions it allows; omit for unlimited
      * @returns the row as stored, `expiresAt` in its canonical form
      */
-    insertCadreInvite(invite: {
-        key: string;
-        peerId?: string | null;
-        grantsOwner: boolean;
-        expiresAtMs?: number | null;
-        totalUses?: number | null;
-    }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<CadreInviteRow>;
+    insertCadreInvite(invite: CadreInviteFields, ownerKey: string, signMessage: ControlSign): Promise<CadreInviteRow>;
+    /**
+     * Build and owner-sign a `CadreInvite` row WITHOUT inserting it: the signing half of
+     * {@link insertCadreInvite}, which `CadreNode.joinWithOwnerGrant` uses alone for the
+     * invitation a node issues to itself, since a store that holds no `OwnerKey` row for the
+     * issuer would refuse the local insert and the row is seated at a member from the bundle
+     * instead. `ExpiresAt` is canonicalized by this database's engine, which is a format, not a
+     * store, so the row reads the same wherever it is seated.
+     */
+    signCadreInvite(invite: CadreInviteFields, ownerKey: string, signMessage: ControlSign): Promise<CadreInviteRow>;
     /**
      * Seat an owner-signed `CadreInvite` row received inside an invitation bundle, under its own
      * stored `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, so a member that
-     * already holds the row (by replication, or from an earlier redemption attempt) is a no-op.
+     * already holds the row (by replication, or from an earlier redemption attempt) is a no-op,
+     * and so is one whose insert the cohort refuses because a member there holds it.
      *
      * @returns `true` when this call inserted the row, `false` when it was already present.
      * @throws {CadreInviteIssuerUnknownError} when `CadreInvite.AuthorizedInsert` refuses it: the
      *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
-     *   not verify. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     *   not verify. {@link IssuedRowNotHereYetError} when the cohort holds the row and this node
+     *   cannot read it yet. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
      */
     seatCadreInvite(row: CadreInviteRow): Promise<boolean>;
+    /**
+     * Insert-if-absent of an issued row from a bundle's copy, under the write lock: the body of
+     * {@link seatCadreInvite} and {@link seatOwnerGrant}. `exec` runs the bare insert under the
+     * row's own stored issuer pair.
+     *
+     * @returns `true` when this call inserted the row, `false` when it was already present —
+     *   here, or at the cohort member that refused the insert for holding it
+     *   ({@link adoptCohortHeldRow}).
+     * @throws `refuse(cause)` when the table's `AuthorizedInsert` refuses the row;
+     *   {@link IssuedRowNotHereYetError} when the cohort holds the row and this node still cannot
+     *   read it; every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     */
+    private seatIssuedRow;
+    /**
+     * The seat's insert was refused because a cohort member already holds a row under `key`, which
+     * this node's guard read missed because its store lags the cohort. A bundle's copy is verbatim
+     * and every column is under the issuer's signature, so the held row is this one: it counts as
+     * seated once a refreshing read (unlocked, so retried as any read) finds it here.
+     *
+     * @throws {IssuedRowNotHereYetError} when the read still does not find it.
+     */
+    private adoptCohortHeldRow;
     /** Bare `CadreInvite` insert shared by {@link insertCadreInvite} and {@link seatCadreInvite}; the caller holds the lock. */
     private execCadreInviteInsert;
     /**
@@ -2123,8 +2489,10 @@ export declare class ControlDatabase {
      * the row is the holder's proof and never goes away; liveness is {@link hasLiveCadreInvite}'s
      * question, and `CadreInviteUsage.Authorized`'s at redemption.
      *
-     * `retry: false` is passed by {@link redeemCadreInvite}, which reads INSIDE its locked write
-     * body — the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
+     * A redemption reads the row once, before its write, and carries it into
+     * {@link isCadreInviteLive} and {@link redeemCadreInvite}. `retry: false` is passed by
+     * {@link redeemCadreInvite} when it was handed none and reads INSIDE its locked write body —
+     * the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
      */
     queryCadreInvite(key: string, retry?: boolean): Promise<CadreInviteRow | null>;
     /**
@@ -2138,7 +2506,7 @@ export declare class ControlDatabase {
     /**
      * Every `CadreInviteUsage` row this node holds — the redemption records the membership
      * predicate verifies invitation-admitted rows against. Same `retry` contract as
-     * {@link queryCadreInvites}.
+     * {@link queryCadreInvites}; both come from their membership views ({@link readMembershipRows}).
      */
     queryCadreInviteUsages(retry?: boolean): Promise<CadreInviteUsageRow[]>;
     /**
@@ -2149,6 +2517,8 @@ export declare class ControlDatabase {
      * `retry: false` is passed by {@link assertCadreInviteSeatRemains}, inside the locked body.
      */
     countCadreInviteUsage(key: string, retry?: boolean): Promise<number>;
+    /** The one-row count read behind {@link countCadreInviteUsage} and {@link countOwnerGrantUsage}. */
+    private countUsageRows;
     /**
      * Is any cadre invitation still redeemable — not withdrawn, unexpired, with uses below its
      * `TotalUses`, and issued by a current owner? The conditions `CadreInviteUsage.Authorized`
@@ -2164,14 +2534,24 @@ export declare class ControlDatabase {
     hasLiveCadreInvite(nowMs?: number): Promise<boolean>;
     /**
      * Is this one cadre invitation still redeemable here — the conditions
-     * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is the one this node
-     * holds under `invite.key`; when it holds none, `invite` itself (a bundle's copy, not seated
-     * yet), but only if its issuer signature verifies, because an unsigned copy would otherwise be
-     * judged by whichever owner it names as issuer. A permissive pre-check like
-     * {@link countCadreInviteUsage}: {@link seatCadreInvite} and the redemption's own write are
-     * what enforce every condition.
+     * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is `held`, the one this
+     * node holds under `invite.key` ({@link queryCadreInvite}, read by the caller); when it holds
+     * none, `invite` itself (a bundle's copy, not seated yet), but only if its issuer signature
+     * verifies, because an unsigned copy would otherwise be judged by whichever owner it names as
+     * issuer. A permissive pre-check like {@link countCadreInviteUsage}: {@link seatCadreInvite}
+     * and the redemption's own write are what enforce every condition.
+     *
+     * The use count read here is read again inside the redemption's write lock
+     * ({@link assertCadreInviteSeatRemains}), on purpose: this one decides whether the device is
+     * pushed the control store before the write, so the holder of a spent invitation is refused
+     * without being sent anything; the in-lock one decides the seat, against a concurrent redemption.
+     */
+    isCadreInviteLive(invite: CadreInviteRow, held: CadreInviteRow | null, nowMs?: number): Promise<boolean>;
+    /**
+     * The body of {@link isCadreInviteLive} and {@link isOwnerGrantLive}: is `row` (the one held,
+     * or a verified bundle copy; null for neither) still open and under its use cap?
      */
-    isCadreInviteLive(invite: CadreInviteRow, nowMs?: number): Promise<boolean>;
+    private issuedRowLive;
     /**
      * Every `CadreInvite` row this node holds with its standing: how many redemptions are
      * recorded, whether it is withdrawn, and whether it is still redeemable — the same
@@ -2180,6 +2560,11 @@ export declare class ControlDatabase {
      * occasional read, not a gate's.
      */
     listCadreInviteStatuses(nowMs?: number): Promise<CadreInviteStatus[]>;
+    /**
+     * The body of {@link listCadreInviteStatuses} and {@link listOwnerGrantStatuses}: each of
+     * `rows` with its withdrawal, its recorded uses and whether it is still redeemable.
+     */
+    private issuedRowStandings;
     /**
      * Owner-signed WITHDRAWAL of a cadre invitation: file the `Revocation` tombstone retiring its
      * stamp, with the row kept. The row stays because every device the invitation admitted
@@ -2197,24 +2582,29 @@ export declare class ControlDatabase {
      * Fires the guarded-delete listener like a removal does, so a withdrawal committed while the
      * node was alone is queued for re-issue on cohort growth ({@link CadreNode.noteGuardedDelete}).
      */
-    withdrawCadreInvite(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    withdrawCadreInvite(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
+    /**
+     * The body of {@link withdrawCadreInvite} and {@link withdrawOwnerGrant}: under the write
+     * lock, file the owner-signed tombstone retiring the row's stamp with the row kept, and fire
+     * the guarded-delete listener for it (so a withdrawal made while alone is re-issued).
+     */
+    private withdrawIssuedRow;
     /**
-     * The withdrawal tombstones for the `CadreInvite` rows among `keys` that are held here and
-     * not yet withdrawn, signed and ready for {@link execTombstone}: the body
-     * {@link withdrawCadreInvite} files one of and {@link removeMachine} files several of in one
+     * The withdrawal tombstones for the `table` rows among `keys` that are held here and not
+     * yet withdrawn, signed and ready for {@link execTombstone}: the body
+     * {@link withdrawIssuedRow} files one of and {@link removeMachine} files several of in one
      * transaction. Inside the locked body (every read `retry: false`); an absent or already
      * withdrawn key is logged and left out.
      */
-    private signCadreInviteWithdrawals;
+    private signWithdrawals;
     /**
-     * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member and,
-     * when the invitation grants ownership, as an owner — with NO owner signature. One
-     * transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`), the
-     * `OwnerKey` row when granted (consent branch of `Authorized`), and last the
-     * `CadreInviteUsage` row that authorizes both; the usage row's own checks (`PeerExists`,
-     * `OwnerExists`) read the rows back, so the three are mutually bound to this exact
-     * redemption and none can be held in reserve. The invitation must already be committed
-     * ({@link seatCadreInvite}): every consent branch reads `committed.CadreInvite`.
+     * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member —
+     * with NO owner signature, and as a machine only (ownership is {@link redeemOwnerGrant}'s).
+     * One transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`) and then
+     * the `CadreInviteUsage` row that authorizes it; the usage row's own check (`PeerExists`)
+     * reads the peer row back, so the two are mutually bound to this exact redemption and
+     * neither can be held in reserve. The invitation must already be committed
+     * ({@link seatCadreInvite}): the consent branch reads `committed.CadreInvite`.
      *
      * The two signatures are the holder's and the device's, minted on the device over
      * {@link cadreInviteRedeemMessage} / {@link cadreInviteConsentMessage}; this machine only
@@ -2223,26 +2613,41 @@ export declare class ControlDatabase {
      * (`verifyInvitationAdmission`) — a mismatched pair is written and then never trusted.
      *
      * Idempotent for a retry after a dropped reply: when the device's row is already present
-     * (and its `OwnerKey` row too, when granted) nothing is written and no seat is spent —
-     * `alreadyMember: true`. A present row whose `OwnerKey` row is missing under an
-     * owner-granting invitation is completed: the usage row then names the existing peer stamp.
-     * The seat check ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a
-     * single-use redemption is answered `alreadyMember` rather than refused as exhausted.
+     * nothing is written and no seat is spent — `alreadyMember: true`. The seat check
+     * ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a single-use
+     * redemption is answered `alreadyMember` rather than refused as exhausted.
      *
      * Through {@link mutateCadrePeer}, so the membership hub is notified; inside the locked body
      * every read passes `retry: false` and every stamp is minted per attempt, so a
      * {@link lockedWithRetry} re-run starts clean.
      *
      * @throws {InvitationExhaustedError} when the invitation's seats are all spent (by name,
-     *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains}).
+     *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains});
+     *   {@link IssuedRowNotHereYetError} when no `CadreInvite` row is readable here.
      */
     redeemCadreInvite(params: {
         inviteKey: string;
+        /**
+         * The row this node holds under `inviteKey`, read before the call ({@link queryCadreInvite});
+         * omitted, it is read inside the locked body. Never a bundle's copy: the requester chooses a
+         * copy's `TotalUses` and `IssuerKey`, and the seat check must judge the stored cap. The
+         * schema refuses every update and delete of the row (`NoUpdate`, `NoDelete`), so the earlier
+         * read is the row a locked read would return; withdrawal is a `Revocation` row, which the schema's
+         * `NotRevoked` and `Authorized` checks still read at commit.
+         */
+        held?: CadreInviteRow;
         peerId: string;
         /** The device's ed25519 public key (base64url); `peerId` is its identity multihash. */
         peerKey: string;
         /** The device's dialable addresses, if known; stored comma-joined as `authorizePeer` does. */
         multiaddrs?: string[];
+        /**
+         * The rest of the device's own signed address record over `multiaddrs`, already verified by
+         * the caller (`admittedRecord` in `cadre-invite-protocol.ts`): stored as the row's
+         * `UpdatedAt`, `Sig` and `Profile`, so the row resolves to the device's addresses from its
+         * admission. Omitted, the row is written unsigned, `UpdatedAt` at this machine's clock.
+         */
+        record?: Pick<PeerAddressRecord, 'updatedAt' | 'profile' | 'sig'>;
         /** Single-use nonce minted by the device; both signatures cover it. */
         usageStampId: string;
         /** The holder's signature with the invitation private key over the `'redeem'` digest. */
@@ -2251,13 +2656,6 @@ export declare class ControlDatabase {
         peerSig: string;
         nowMs?: number;
     }): Promise<CadreInviteRedemptionResult>;
-    /**
-     * The rows a redemption would seat that are already present: the device's `CadrePeer`
-     * stamp, and — only when the invitation grants ownership — its `OwnerKey` stamp. Raw stamp
-     * reads ({@link queryStampId}), so a physically present row counts; inside the locked
-     * body, so never retried.
-     */
-    private readSeatedAdmission;
     /**
      * Refuse a redemption that would consume a seat the cadre invitation does not have, by
      * name ({@link InvitationExhaustedError}) — the cadre-invitation twin of
@@ -2266,10 +2664,150 @@ export declare class ControlDatabase {
      * committed count inside the locked body, so on a same-node race the loser is refused here.
      */
     private assertCadreInviteSeatRemains;
+    /** The body of {@link assertCadreInviteSeatRemains} and {@link assertOwnerGrantSeatRemains}; `countUsage` reads inside the locked body. */
+    private assertIssuedSeatRemains;
+    /**
+     * Mint and insert an owner-signed `OwnerGrant`: a grant of ownership to whoever holds the
+     * grant's private half, redeemable through any member machine ({@link redeemOwnerGrant})
+     * to seat an owner key the holder generates or already holds. No machine is admitted and no
+     * peer id is named. The grant twin of {@link insertCadreInvite}: the owner signs the whole
+     * row ({@link ownerGrantAddMessage}), `ExpiresAt` through {@link canonicalDatetime}, and
+     * the returned row is what the grant bundle carries, re-inserted verbatim by
+     * {@link seatOwnerGrant} on a member that has not received it by replication.
+     *
+     * @param grant.key - the grant's ed25519 PUBLIC key (base64url), the row's primary key; the
+     *   caller minted the pair and hands the private half to the holder out of band
+     * @param grant.label - the label every key this grant seats will carry
+     *   ({@link ownerKeyLabel}'s rule: trimmed, at most 64 characters, blank meaning none); the
+     *   issuer's choice, which the holder cannot change
+     * @param grant.expiresAtMs - epoch ms after which it cannot be redeemed; omit or null for
+     *   never. The short default lifetime is the node API's to apply, not this writer's.
+     * @param grant.totalUses - how many redemptions it allows; omit for unlimited
+     * @returns the row as stored, `expiresAt` in its canonical form
+     */
+    insertOwnerGrant(grant: {
+        key: string;
+        label?: string | null;
+        expiresAtMs?: number | null;
+        totalUses?: number | null;
+    }, ownerKey: string, signMessage: ControlSign): Promise<OwnerGrantRow>;
+    /**
+     * Seat an owner-signed `OwnerGrant` row received inside a grant bundle, under its own stored
+     * `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, as {@link seatCadreInvite}.
+     *
+     * @returns `true` when this call inserted the row, `false` when it was already present.
+     * @throws {OwnerGrantIssuerUnknownError} when `OwnerGrant.AuthorizedInsert` refuses it: the
+     *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
+     *   not verify. {@link IssuedRowNotHereYetError} when the cohort holds the row and this node
+     *   cannot read it yet. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     */
+    seatOwnerGrant(row: OwnerGrantRow): Promise<boolean>;
+    /** Bare `OwnerGrant` insert shared by {@link insertOwnerGrant} and {@link seatOwnerGrant}; the caller holds the lock. */
+    private execOwnerGrantInsert;
+    /**
+     * Read one `OwnerGrant` row by key, or null when absent. Withdrawn rows are returned too,
+     * as {@link queryCadreInvite} returns them: the row is the holder's proof and never goes
+     * away. Read once per redemption and carried into {@link isOwnerGrantLive} and
+     * {@link redeemOwnerGrant}; `retry: false` is passed by {@link redeemOwnerGrant} when it was
+     * handed none and reads inside its locked body.
+     */
+    queryOwnerGrant(key: string, retry?: boolean): Promise<OwnerGrantRow | null>;
+    /**
+     * Every `OwnerGrant` row this node holds, withdrawn and expired ones included. Read by the
+     * anchor sync when at least one `OwnerKey` row is consent-seated (`CadreNode.loadOwnerGrantChain`);
+     * `retry: false` is forwarded from the membership-gate refresh for {@link queryCadrePeers}' reason.
+     */
+    queryOwnerGrants(retry?: boolean): Promise<OwnerGrantRow[]>;
+    /** Every `OwnerGrantUsage` row this node holds — the redemption records a grant-seated `OwnerKey` row is verified against. Same `retry` contract as {@link queryOwnerGrants}; both come from their membership views ({@link readMembershipRows}). */
+    queryOwnerGrantUsages(retry?: boolean): Promise<OwnerGrantUsageRow[]>;
+    /**
+     * How many times an owner grant has been redeemed (its `OwnerGrantUsage` rows), served
+     * through the `OwnerGrantUsageByGrant` index. A permissive PRE-check like
+     * {@link countCadreInviteUsage}: the cap is `OwnerGrantUsage.Authorized`'s own committed count.
+     */
+    countOwnerGrantUsage(key: string, retry?: boolean): Promise<number>;
+    /**
+     * Is this one owner grant still redeemable here — not withdrawn, unexpired, uses left, issuer
+     * still an owner — judged as {@link isCadreInviteLive} judges an invitation: by `held`, the row
+     * this node holds under `grant.key` ({@link queryOwnerGrant}, read by the caller), else by
+     * `grant` itself (a bundle's copy, not seated yet) when its issuer signature verifies. A
+     * permissive pre-check; {@link seatOwnerGrant} and the redemption's own write enforce every
+     * condition. Its use count is read again inside the write lock, for
+     * {@link isCadreInviteLive}'s reason.
+     */
+    isOwnerGrantLive(grant: OwnerGrantRow, held: OwnerGrantRow | null, nowMs?: number): Promise<boolean>;
+    /**
+     * Every `OwnerGrant` row this node holds with its standing — recorded redemptions, withdrawal,
+     * and whether it is still redeemable — for an owner's listing, as {@link listCadreInviteStatuses}.
+     */
+    listOwnerGrantStatuses(nowMs?: number): Promise<OwnerGrantStatus[]>;
+    /**
+     * Owner-signed WITHDRAWAL of an owner grant: file the `Revocation` tombstone retiring its
+     * stamp, with the row kept, exactly as {@link withdrawCadreInvite} withdraws an invitation
+     * and for the same reason (every key the grant seated proves itself through the row;
+     * `OwnerGrant.NoDelete`, `Revocation.RowIsGone`). Afterwards `OwnerGrantUsage.Authorized`
+     * refuses every further redemption and `OwnerGrant.NotRevoked` refuses re-seating the
+     * holder's copy on any node holding the tombstone. Keys already seated stay owners;
+     * removing one is {@link deleteOwnerKey}.
+     *
+     * Idempotent: `false` (nothing written) when the row is absent here or already withdrawn,
+     * `true` when this call filed the tombstone. Fires the guarded-delete listener, so a
+     * withdrawal committed while alone is re-issued on cohort growth.
+     */
+    withdrawOwnerGrant(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
+    /**
+     * Redeem a seated `OwnerGrant` on the issuer's behalf: seat `seatedKey` as an owner with NO
+     * owner signature. One transaction writes the `OwnerKey` row (the grant branch of
+     * `Authorized`: `VouchOwner` the issuer, `VouchSig` null, `VouchUsage` the usage stamp,
+     * `Label` the grant's) and then the `OwnerGrantUsage` row that authorizes it; the usage
+     * row's `SeatedExists` reads the owner row back, so the two are bound to this exact
+     * redemption and neither can be held in reserve. The grant must already be committed
+     * ({@link seatOwnerGrant}): both consent reads are of `committed.OwnerGrant`. No machine is
+     * admitted and no peer id is named.
+     *
+     * The two signatures are minted where the private keys are (the grant's and the seated
+     * key's), over {@link ownerGrantRedeemMessage} / {@link ownerGrantConsentMessage}; this
+     * machine only verifies them, by writing the row.
+     *
+     * Idempotent, and a no-op for a key that is already an owner: when `seatedKey` has a live
+     * `OwnerKey` row here nothing is written and no use is spent — `alreadyOwner: true` with
+     * that row's stamp. The seat check ({@link assertOwnerGrantSeatRemains}) runs after that, so
+     * the retry of a single-use redemption is answered `alreadyOwner` rather than refused as
+     * exhausted. A key removed earlier is seated afresh under a new stamp (`NotRevoked` passes),
+     * except on a machine that still holds its retired row, which refuses by name
+     * ({@link liveOwnerKeyStamp}).
+     *
+     * Through {@link mutateCadrePeer}, so the membership hub is notified and the anchors follow;
+     * inside the locked body every read passes `retry: false` and the stamp is minted per
+     * attempt, so a {@link lockedWithRetry} re-run starts clean.
+     *
+     * @throws {InvitationExhaustedError} when the grant's uses are all spent (by name, ahead of
+     *   the schema's generic `Authorized` refusal); its `token` is the grant key.
+     *   {@link IssuedRowNotHereYetError} when no `OwnerGrant` row is readable here.
+     */
+    redeemOwnerGrant(params: {
+        grantKey: string;
+        /** The row this node holds under `grantKey`, read before the call; omitted, it is read inside the locked body. Never a bundle's copy, for {@link redeemCadreInvite}'s reason. */
+        held?: OwnerGrantRow;
+        /** The owner key to seat (base64url ed25519): the holder generated it, or already holds it. */
+        seatedKey: string;
+        /** Single-use nonce minted by the holder; both signatures cover it. */
+        usageStampId: string;
+        /** The holder's signature with the grant private key over the `'redeem'` digest. */
+        grantSig: string;
+        /** The seated key's signature over the `'consent'` digest. */
+        ownerSig: string;
+        nowMs?: number;
+    }): Promise<OwnerGrantRedemptionResult>;
+    /** {@link assertCadreInviteSeatRemains} for an owner grant: refuse an exhausted grant by name, ahead of the write. */
+    private assertOwnerGrantSeatRemains;
     /**
      * Close the database and cleanup resources.
      *
-     * Drains the local-write chain first: {@link withWriteLock} can park a write behind
+     * Disposes every {@link watchTables} subscription before anything else, so a commit that
+     * lands while the write chain drains schedules no run, and again before dropping the handle.
+     *
+     * Then drains the local-write chain: {@link withWriteLock} can park a write behind
      * others across an await, and a queued closure evaluates `this.db!` only when it
      * finally runs — so nulling the handle out from under it would throw a TypeError on a
      * null handle instead of committing. The tail never rejects (it swallows both