@serfab/cadre-core 1.17.0 → 1.18.0

package/src/cadre-node.ts

@@ -1,6 +1,6 @@
 import debug from 'debug';
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
-import type { Libp2p, PeerId, PrivateKey } from '@libp2p/interface';
+import type { Connection, IdentifyResult, Libp2p, PeerId, PrivateKey } from '@libp2p/interface';
 import { peerIdFromString, peerIdFromPrivateKey } from '@libp2p/peer-id';
 import { generateKeyPair } from '@libp2p/crypto/keys';
 import { createLibp2pNode, type IRawStorage } from '@optimystic/db-p2p';
@@ -19,6 +19,7 @@ import type {
   SAppConfig,
   CadreNodeEvents,
   ControlNetworkSeed,
+  SeedDialTarget,
   ApplySeedResult,
   SeedAckMessage,
   SeedDeliveryTarget,
@@ -94,7 +95,7 @@ import {
   type JoinedStrandStore,
   type PartyJoinedStrandLedger
 } from './joined-strand-store.js';
-import { mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './peer-addr-book.js';
+import { addrKey, mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './peer-addr-book.js';
 import { strandFretPeerAddrs } from './strand-fret-addrs.js';
 import { verifyCadrePeerVoucher, verifyInvitationAdmission, verifyRevocationSigner } from './peer-authorization.js';
 import { deriveOwnerAnchor } from './owner-anchor-sync.js';
@@ -116,17 +117,22 @@ import {
   verifyDeviceTokenSignature,
   isPushPlatform
 } from './device-token.js';
-import { StrandWatcher, type StrandQueryable, type SAppIdLookup } from './strand-watcher.js';
+import { StrandWatcher, DEFAULT_STRAND_WATCH_BACKSTOP_MS, type StrandQueryable, type SAppIdLookup } from './strand-watcher.js';
 import { StrandInstanceManager, liveStrandStatus } from './strand-instance-manager.js';
 import { PeerJoinBackfill } from './peer-join-backfill.js';
 import { deriveCohortMembers } from './strand-cohort.js';
 import type { CohortPeerRow } from './strand-cohort.js';
 import {
   selectControlCohortDials,
+  nextReconcileWakeMs,
+  CLAIM_RESTART_REDIAL_STEP_MS,
+  CONTROL_COHORT_REDIAL_MS,
   DEFAULT_CONTROL_COHORT_RECONCILE_MS,
   DEFAULT_CONTROL_COHORT_TARGET_DEGREE,
   type ControlCohortReconcileResult
 } from './control-cohort.js';
+import { scheduleRuns, type TableChangeWatch } from './table-change-watch.js';
+import { MEMBERSHIP_VIEW_RECONNECT_RELOAD_MS } from './membership-view.js';
 import {
   dialPeerAddrs,
   SelfRelayOnlyError,
@@ -138,11 +144,12 @@ import {
 import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayReservationBudgetMs, relayedDialBudgetMs, relayedRequestBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
-import { ControlDatabase, generateStampId, isPendingJoinConflict, isStrandIdConflict, IssuedRowNotHereYetError, pendingJoinId, type JoinRequestFields, type RevokedRowRef } from './control-database.js';
+import { ControlDatabase, generateStampId, isPendingJoinConflict, isStrandIdConflict, IssuedRowNotHereYetError, pendingJoinId, type CadrePeerRetouchOutcome, type FoundingInvite, type JoinRequestFields, type RevokedRowRef } from './control-database.js';
 import {
   CadreInviteHandler,
   encodeCadreInvitation,
   redeemInPasses,
+  sanitizeAddrs,
   signRedeemRequest,
   type CadreInvitation
 } from './cadre-invite-protocol.js';
@@ -164,11 +171,12 @@ import {
   requestedPendingJoin
 } from './pending-join-runner.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
-import { SeedBootstrapService, mergeSeedPeers, seedDigest, type SeedEventCallbacks, type SeedBootstrapConfig } from './seed-bootstrap.js';
+import { SeedBootstrapService, mergeSeedPeers, seedDialTargets, seedDigest, type SeedEventCallbacks, type SeedBootstrapConfig } from './seed-bootstrap.js';
 import { claimSecretTrustPolicy, type SeedTrustPolicy } from './seed-trust-policy.js';
 import { ClaimRefusedError, claimProof, parseClaimSecret } from './claim-proof.js';
 import {
   StrandSolicitationService,
+  type BoundHostStrand,
   type StrandSolicitationServiceOptions
 } from './strand-solicitation.js';
 import { ControlFormationUsageRecorder } from './control-formation-recorder.js';
@@ -183,7 +191,7 @@ import {
   UnauthorizedReservationBudget,
   type InboundConnectionVerdict
 } from './membership-connection-gater.js';
-import { controlNetworkName, installControlProtocolGuard } from './control-protocol-guard.js';
+import { controlNetworkName, installControlProtocolGuard, servesControlDatabase } from './control-protocol-guard.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs, type StrandAddrPeer, type StrandAddrOutcome, type StrandAddrCollection } from './strand-addr-protocol.js';
 import {
@@ -226,8 +234,8 @@ const timing = debug('sereus:cadre:timing');
  *
  * Ten minutes sits comfortably inside the peerStore's one-hour address expiry
  * (`MAX_ADDRESS_AGE`, see `peer-addr-book.ts`) with headroom for several missed
- * passes, and far above the 15 s reconcile cadence the refresh rides on, so the
- * strand-addr RPC fan-out stays cheap.
+ * passes, and far above the reconcile pass's 2-minute backstop the refresh rides
+ * on, so the strand-addr RPC fan-out stays cheap.
  */
 export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
 
@@ -237,11 +245,29 @@ export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
  * phone asking before its `CadrePeer` row has replicated to the sibling is refused
  * and its delegate grant goes unrecorded, and waiting the full
  * {@link STRAND_PEER_ADDR_REFRESH_MS} for the next try is the delay this bounds.
- * Four reconcile ticks, so a sibling that keeps failing costs one timed-out RPC a
- * minute rather than one a tick.
+ * A pass arms its own wake for the earliest due time it leaves behind
+ * (`nextReconcileWakeMs`), so a sibling that keeps failing costs one timed-out
+ * RPC a minute, with no pass in between.
  */
 export const STRAND_PEER_ADDR_RETRY_MS = 60 * 1000;
 
+/**
+ * What one reconcile pass did, for the wrapper that arms the next wake; callers get only
+ * its `dialed` ({@link ControlCohortReconcileResult}).
+ */
+interface ControlCohortPassOutcome extends ControlCohortReconcileResult {
+  /**
+   * The pass dialed a selected sibling, or a cold-start bootstrap peer, and the dial failed.
+   * A sibling the pass could not dial at all — no dialable address, or every address relays
+   * through this node — does not count: a retry would dial nothing, and every way it gains
+   * an address (its record replicating in, a connection it opens) starts a pass of its own.
+   */
+  unconnected: boolean;
+}
+
+/** How {@link CadreNode.dialControlSibling} ended: connected, a failed dial, or nothing to dial. */
+type SiblingDialOutcome = 'connected' | 'failed' | 'undialable';
+
 /**
  * Default lifetime of an owner grant ({@link CadreNode.createOwnerGrant}): whoever holds the
  * bundle can become an owner, so it is a bearer credential for admin rights and lives only
@@ -441,6 +467,19 @@ function requireMatchingStrandRow(live: StrandRow, desired: StrandRow, situation
   return live;
 }
 
+/**
+ * What a founding's control write resolved: the live `Strand` row, and the party key the write
+ * seated for a closed strand. No key when it adopted a stored row or a stored key; the launch
+ * then reads the stored one.
+ */
+interface FoundingWrite {
+  strandRow: StrandRow;
+  partyKey?: string;
+}
+
+/** The publish half of `foundStrand`, handed to its start half. */
+type FoundingPublish = FoundingWrite & Pick<FoundStrandResult, 'founded'>;
+
 /**
  * Await `work` unless `signal` aborts first: `true` once `work` resolves, `false` when the
  * signal aborted before it did (already at the call, or during the wait). A rejection of
@@ -663,8 +702,8 @@ export class CadreNode implements SAppIdLookup {
    *
    * Cleared by {@link cleanup} only, deliberately NOT by {@link detachStrand}: the watcher's
    * filter rejection stops a replica through that very method, and forgetting the id there
-   * would have the next poll find it unknown again, re-admit the strand provisionally and
-   * relaunch the replica — once every other poll, forever. A strand id's sApp never changes,
+   * would have the next watcher run find it unknown again, re-admit the strand provisionally
+   * and relaunch the replica — on every other run, forever. A strand id's sApp never changes,
    * and the map is bounded by the strands this party has published, like
    * {@link discoveredStrands}.
    */
@@ -695,19 +734,24 @@ export class CadreNode implements SAppIdLookup {
    * wait that ends in mutual denial (the upstream gate is fail-closed on
    * timeout, unlike the fail-open connection gater). Optimystic's predicate is
    * synchronous by contract. So the set is refreshed OUT OF BAND instead — after
-   * start, on every {@link reconcileControlCohort} pass (15s cadence), and
-   * immediately after every LOCAL membership mutation so a just-vouched peer
-   * is admitted without waiting for the timer. That last refresh is AUTOMATIC:
-   * the control database notifies {@link refreshMembershipGate} after every
+   * start, at the head of every {@link reconcileControlCohort} pass, whenever a
+   * membership table changes (the gate watch {@link start} takes through
+   * `ControlDatabase.watchMembershipTables`, which hears a local commit and a change
+   * replicated into this node's storage alike, within a 50 ms window), and immediately
+   * after every LOCAL membership mutation so a just-vouched peer is admitted
+   * before the writer's call returns. That last refresh is AUTOMATIC: the
+   * control database notifies {@link refreshMembershipGate} after every
    * committed `CadrePeer` write (see `ControlDatabase.mutateCadrePeer`), so no
-   * writer has to remember. A change that arrives by REPLICATION is picked up
-   * on the next timed refresh — bounded staleness, acceptable because this gate
-   * is defense in depth: rows an unadmitted peer manages to write are still
-   * disbelieved at read time by the voucher-anchored predicate. For cohort
-   * choice the same window means a member whose row arrived by replication is
-   * left out of this node's control-block cohorts until that refresh.
-   * Optimystic reads the predicate live on every lookup, so replacing this set
-   * is the whole re-evaluation; there is no per-peer reclassify call to make.
+   * writer has to remember. A change this node's storage never hears of — a
+   * machine outside the block's cohort on a party larger than the replication
+   * breadth — is picked up at the pass's 2-minute backstop: bounded staleness,
+   * acceptable because this gate is defense in depth: rows an unadmitted peer
+   * manages to write are still disbelieved at read time by the voucher-anchored
+   * predicate. For cohort choice the same window means a member whose row
+   * arrived by replication is left out of this node's control-block cohorts
+   * until that refresh. Optimystic reads the predicate live on every lookup, so
+   * replacing this set is the whole re-evaluation; there is no per-peer
+   * reclassify call to make.
    */
   private authorizedControlPeers: Set<string> = new Set();
 
@@ -771,9 +815,9 @@ export class CadreNode implements SAppIdLookup {
    * When this node last ANNOUNCED a delegate, keyed `<targetPeerId>\n<strandId>`
    * (the peer announced TO, not the delegate). Throttles
    * {@link refreshDelegateGrants} to once per `DELEGATE_GRANT_TTL_MS / 2` per
-   * (relay, strand) so the 15 s reconcile tick never becomes per-tick RPC
-   * chatter; the launch/resume announce passes record here too. Keys whose
-   * strand is no longer running are pruned on each reconcile pass.
+   * (relay, strand) so a run of change-driven reconcile passes never becomes
+   * per-pass RPC chatter; the launch/resume announce passes record here too.
+   * Keys whose strand is no longer running are pruned on each reconcile pass.
    */
   private readonly delegateAnnounceAt = new Map<string, number>();
 
@@ -802,12 +846,13 @@ export class CadreNode implements SAppIdLookup {
    * strand, keyed `peerStrandKey(siblingControlPeerId, strandId)` → epoch ms; a
    * missing key is due. Bounds {@link refreshStrandPeerAddrs}'s fan-out per
    * (sibling, strand) rather than per strand, so a sibling that connects after a
-   * pass is asked on the next 15 s tick instead of waiting out a stamp another
-   * sibling's answer set. An answer (even an empty one) makes the sibling due again
-   * in {@link STRAND_PEER_ADDR_REFRESH_MS}; no answer, in
-   * {@link STRAND_PEER_ADDR_RETRY_MS}. Keys whose strand stopped running or whose
-   * sibling is no longer connected are pruned every pass, so a resumed strand and a
-   * reconnected sibling are both asked at once.
+   * pass is asked on the pass its connection starts instead of waiting out a stamp
+   * another sibling's answer set. An answer (even an empty one) makes the sibling
+   * due again in {@link STRAND_PEER_ADDR_REFRESH_MS}; no answer, in
+   * {@link STRAND_PEER_ADDR_RETRY_MS}, and each pass arms its own wake for the
+   * earliest due time it leaves behind (`nextReconcileWakeMs`). Keys whose strand
+   * stopped running or whose sibling is no longer connected are pruned every pass,
+   * so a resumed strand and a reconnected sibling are both asked at once.
    */
   private readonly strandAddrAskDueAt = new Map<string, number>();
 
@@ -893,6 +938,19 @@ export class CadreNode implements SAppIdLookup {
    */
   private readonly pendingMembershipInvites = new Map<string, StrandMembershipInvite>();
 
+  /**
+   * The party key {@link adoptFormationMembershipInvite} just seated or read, by strand id,
+   * so the launch that follows a join does not read the `StrandPartyKey` row again. Taken
+   * (deleted) by the {@link resolveStrandPartyKey} that uses it, so any later launch reads
+   * the row; dropped by {@link detachStrand}. The joiner's counterpart of the founder's
+   * `StrandConfig.partyMemberPrivateKey`, without the app carrying the secret.
+   *
+   * NOTE: an entry is not dropped when the row is removed, because no `CadreNode` path removes
+   * it; an embedder calling `getControlDatabase().deleteStrandPartyKey` between a join and its
+   * launch would get the deleted key. If a node-level rotation is added, drop the entry there.
+   */
+  private readonly formedPartyKeys = new Map<string, string>();
+
   /**
    * Invite keys of the membership invitations this process has staged, by
    * {@link adoptFormationMembershipInvite} or from a `JoinSuccess` row
@@ -992,7 +1050,7 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * This session's joined strands: {@link joinedStrandStore} and the party-wide
-   * `JoinedStrand` table, unioned with the control rows each watcher poll, published and
+   * `JoinedStrand` table, unioned with the control rows each watcher run, published and
    * removed by the reconcile pass. Per SESSION, unlike the store — rebuilt at every
    * {@link start}, which is what ends a revoked join's "keep offering until this session
    * ends" (see `JoinedStrandSession.forgetAfterThisSession`).
@@ -1025,17 +1083,41 @@ export class CadreNode implements SAppIdLookup {
   /** Listener that re-publishes the self record when reachable addresses change. */
   private selfPeerUpdateHandler: (() => void) | null = null;
   /**
-   * Recurring proactive control-cohort dial cadence (see
-   * {@link reconcileControlCohort}). Wired alongside {@link recordRefreshTimer}
-   * in {@link startRecordRefresh} and torn down symmetrically in
-   * {@link stopRecordRefresh}; `.unref()`'d so it never keeps the loop alive.
-   */
-  private controlCohortReconcileTimer: ReturnType<typeof setInterval> | null = null;
-  /**
-   * Single-flight guard for {@link reconcileControlCohort}. The eager start pass,
-   * the recurring interval, and the `self:peer:update` trigger can fire close
-   * together; collapsing concurrent passes into one in-flight run prevents two
-   * passes from double-dialing the same siblings (mirrors {@link registerSelfInFlight}).
+   * The reconcile pass's schedule (see {@link reconcileControlCohort}): single-flight
+   * runs on `table-change-watch.ts`'s rule, with no table subscription of its own — the
+   * gate watch ({@link membershipGateWatch}), the control connection listeners,
+   * `self:peer:update`, and the pass's own wake ({@link armReconcileWake}) `trigger` it,
+   * and its backstop (`network.controlCohort.reconcileMs`, default
+   * `DEFAULT_CONTROL_COHORT_RECONCILE_MS`) runs it when nothing has. Built alongside
+   * {@link recordRefreshTimer} in {@link startRecordRefresh}, about 1 s after start, and
+   * disposed in {@link stopRecordRefresh}; its timers never keep the loop alive.
+   */
+  private controlReconcileRuns: TableChangeWatch | null = null;
+  /**
+   * The subscription on the membership tables (`ControlDatabase.watchMembershipTables`) that
+   * re-materializes the membership gate and triggers {@link controlReconcileRuns} on every
+   * change ({@link onMembershipGateTablesChanged}).
+   * Taken in {@link start} right after the membership listener is wired, disposed in
+   * {@link cleanup} before the control database closes.
+   */
+  private membershipGateWatch: TableChangeWatch | null = null;
+  /** The second membership-view drop after a sibling connects ({@link armMembershipViewReload}); cleared in {@link stopRecordRefresh}. */
+  private membershipViewReloadTimer: ReturnType<typeof setTimeout> | null = null;
+  /**
+   * Consecutive passes whose dial of a selected sibling or a cold-start bootstrap peer
+   * failed (`ControlCohortPassOutcome.unconnected`), for the redial ladder
+   * ({@link armReconcileWake}); 0 after a pass none of whose dials did. Per session:
+   * reset in {@link stopRecordRefresh}.
+   */
+  private reconcileRedialStreak = 0;
+  /** Peers a {@link redialClaimedNode} loop is running for, so a repeated claim starts no second one. */
+  private readonly claimRedialPeers = new Set<string>();
+  /**
+   * Single-flight guard for {@link reconcileControlCohort}. An explicit call, the
+   * `self:peer:update` trigger and a scheduled run can fire close together; collapsing
+   * concurrent passes into one in-flight run prevents two passes from double-dialing the
+   * same siblings (mirrors {@link registerSelfInFlight}). A scheduled run waits for this
+   * pass and then starts its own rather than joining it.
    */
   private reconcileControlCohortInFlight: Promise<ControlCohortReconcileResult> | null = null;
   /**
@@ -1058,20 +1140,28 @@ export class CadreNode implements SAppIdLookup {
    * machine in the party is already discarding this node's address as stale.
    */
   private lastSelfRecordPublishAt: number | null = null;
+  /**
+   * The newest record this process signed for its own `CadrePeer` row: written by either path
+   * of {@link publishSelfRecord}, or handed to a member to write by {@link redeemCadreInvitation}.
+   * What {@link publishSelfRecordUnlessCurrent} compares the row against. Per session, cleared
+   * with {@link lastSelfRecordPublishAt}: a row carried over from an earlier process is never
+   * taken as current.
+   */
+  private lastSignedSelfRecord: PeerAddressRecord | null = null;
   /** Say-once latch for {@link escalateIfSelfRecordStale}; re-armed by the next publish. */
   private selfRecordStaleWarned = false;
 
   // ── Write-while-alone re-replication (control-write-ensure-replicated) ──────
   /**
    * Re-replication queue for owner `authorizePeer` writes that committed while
-   * this node was alone — `controlNode.getConnections().length === 0` at write
-   * time means the Optimystic commit was local-only (the block's cluster was ≤1)
-   * and never broadcast. Maps the affected subject peerId → 'authorize', to
+   * this node was alone ({@link committedAlone}) — the Optimystic commit was
+   * local-only (the block's cohort was this node) and never broadcast. Maps the
+   * affected subject peerId → 'authorize', to
    * re-issue once the cohort grows. Removals are NOT tracked here — a delete
    * leaves a `Revocation` tombstone, tracked by {@link pendingRevocations}; a
    * removePeer also clears any queued authorize for the same subject (the row is
-   * gone, so re-issuing the insert would be wrong). Drained on the 0→≥1
-   * control-connection transition by {@link drainPendingControlReplication}.
+   * gone, so re-issuing the insert would be wrong). Drained when a sibling becomes
+   * reachable ({@link updateControlSiblingReachability}) by {@link drainPendingControlReplication}.
    */
   private pendingPeerWrites: Map<string, 'authorize'> = new Map();
   /**
@@ -1095,14 +1185,6 @@ export class CadreNode implements SAppIdLookup {
    * exactly a "removals from before this lifetime" case).
    */
   private reissuedHeldRevocations = false;
-  /**
-   * Whether this process has seen the singleton `Revocation` ledger marker filed — its own
-   * `'opened'` or an `'already-open'` answer, in {@link openRevocationLedgerIfDue}. A
-   * record of work done, not a cached authorization answer: the marker can never be
-   * deleted (`NoDelete`), so this can only go stale if the database itself is replaced,
-   * which is why stop() clears it with the other per-process replication state.
-   */
-  private revocationLedgerOpened = false;
   /** This node's own `CadrePeer` self-write committed local-only (re-touched on growth). */
   private pendingSelfPeerWrite = false;
   /** This node's own `DeviceToken` self-write committed local-only (re-touched on growth). */
@@ -1117,15 +1199,25 @@ export class CadreNode implements SAppIdLookup {
   /** Single-flight guard for the re-replication drain (mirrors {@link registerSelfInFlight}). */
   private drainControlReplicationInFlight: Promise<void> | null = null;
   /**
-   * Tracks the control-connection presence edge so the drain fires only on the
-   * 0→≥1 transition (the earliest point a re-issue can broadcast), not on every
-   * subsequent `connection:open`. Re-armed to false once connections return to 0.
+   * Connected control peers whose identify says they serve the control database
+   * ({@link onControlPeerIdentified}): the peers Optimystic can count into a control block's
+   * cohort, before its membership check. A peer joins on its first `peer:identify` of a
+   * connected period, not on `connection:open`: until it identifies, every control block's
+   * cohort is this node alone. It leaves when its last connection closes. Read through
+   * {@link hasReachableControlSibling}, which applies the membership check.
    */
-  private hasControlConnection = false;
-  /** `connection:open` listener driving the growth-triggered drain (teardown in {@link stopRecordRefresh}). */
-  private controlConnectionOpenHandler: (() => void) | null = null;
-  /** `connection:close` listener re-arming the growth edge (teardown in {@link stopRecordRefresh}). */
-  private controlConnectionCloseHandler: (() => void) | null = null;
+  private readonly identifiedControlPeers = new Set<string>();
+  /**
+   * {@link hasReachableControlSibling} at its last evaluation, so the drain fires on the
+   * false→true edge only (the earliest point a re-issue reaches the cohort), not on every later
+   * identify. Re-armed to false when no reachable sibling remains
+   * ({@link updateControlSiblingReachability}).
+   */
+  private controlSiblingReachable = false;
+  /** `peer:identify` listener: {@link onControlPeerIdentified} (teardown in {@link stopRecordRefresh}). */
+  private controlPeerIdentifyHandler: ((event: CustomEvent<IdentifyResult>) => void) | null = null;
+  /** `connection:close` listener: {@link onControlConnectionClosed} (teardown in {@link stopRecordRefresh}). */
+  private controlConnectionCloseHandler: ((event: CustomEvent<Connection>) => void) | null = null;
 
   constructor(config: CadreNodeConfig) {
     this.config = config;
@@ -1318,7 +1410,7 @@ export class CadreNode implements SAppIdLookup {
       // loaded before the first reconcile pass could consult them.
       this.initializeBootstrapPeerStore();
 
-      // The remembered cross-party joins, which the strand watcher built below polls
+      // The remembered cross-party joins, which the strand watcher built below reads
       // beside the control rows. Before network bring-up, so a mis-scoped injected store
       // fails closed like the two above.
       this.initializeJoinedStrandStore();
@@ -1404,6 +1496,21 @@ export class CadreNode implements SAppIdLookup {
       // rest of start() and the refresh early-returns while it is — a write in that
       // window is covered by start's own pass below.
       this.controlDatabase.setMembershipChangeListener((reason) => this.refreshMembershipGate(reason));
+      // The gate watch: a change to any membership table, replicated in or committed here,
+      // re-materializes the gate and starts a reconcile pass. Separate from the pass so a
+      // replicated revocation does not wait behind a pass spending its dial budget on an
+      // unreachable sibling. The watch handler only arms a timer, so nothing runs under the
+      // write lock the membership listener is called with; `onChange` runs from that timer.
+      //
+      // NOTE: a table this `Database` has not yet touched hears local commits only
+      // (`table-change-watch.ts`). The start refresh reads `CadrePeer`, `OwnerKey` and
+      // `Revocation`; the four invitation and grant tables are first read when some row is
+      // admitted through one, and a load the committed-read path served is not kept and
+      // arms no bridge, so a chain row that replicates in before then waits for the next
+      // change on a touched table or the backstop. Nothing depends on a chain row until a
+      // `CadrePeer` or `OwnerKey` row refers to it, and that row is itself such a change.
+      this.membershipGateWatch = this.controlDatabase.watchMembershipTables(
+        () => this.onMembershipGateTablesChanged(), { label: 'membership-gate' });
       // Committed-delete seam → write-while-alone revocation queue. Same wiring
       // window argument as the membership listener above.
       this.controlDatabase.setGuardedDeleteListener((revocation) => this.noteGuardedDelete(revocation));
@@ -1423,7 +1530,7 @@ export class CadreNode implements SAppIdLookup {
           onStrandRemoved: async (strandId) => this.handleStrandRemoved(strandId)
         },
         this.config.strandFilter ?? { mode: 'all' },
-        this.config.strandWatchInterval ?? 5000,
+        this.config.strandWatchInterval ?? DEFAULT_STRAND_WATCH_BACKSTOP_MS,
         this // CadreNode implements SAppIdLookup
       );
 
@@ -1506,8 +1613,8 @@ export class CadreNode implements SAppIdLookup {
       log('CadreNode started successfully');
 
       // Wire the control-connection growth listeners immediately (not via the
-      // delayed refresh path) so no early `connection:open` is missed — the
-      // write-while-alone re-replication drain must fire on the first 0→≥1 edge.
+      // delayed refresh path) so no early `peer:identify` is missed — the
+      // write-while-alone re-replication drain must fire when the first sibling is reachable.
       this.wireControlConnectionListeners();
 
       // Arm the control network's peer-join block catch-up now that the control
@@ -1898,7 +2005,8 @@ export class CadreNode implements SAppIdLookup {
       );
     }
     this.joinedStrandStore = store;
-    this.joinedStrands = new JoinedStrandSession(store, this.createPartyJoinedStrandLedger());
+    this.joinedStrands = new JoinedStrandSession(store, this.createPartyJoinedStrandLedger(),
+      () => this.strandWatcher?.refresh());
   }
 
   /**
@@ -2054,8 +2162,8 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Arm the CONTROL network's peer-join block catch-up: push every block in the
-   * control database's own raw store to each newly connected AUTHORIZED member
-   * this runtime has not yet caught up. This is what physically replicates
+   * control database's own raw store to each AUTHORIZED member on each
+   * (re)connection, skipping what it is known to hold. This is what physically replicates
    * control blocks committed while the writer was alone — the named
    * collection-header blocks written once at genesis above all, whose revision
    * never moves again, so no later commit ever carries them to a member that
@@ -2064,7 +2172,9 @@ export class CadreNode implements SAppIdLookup {
    * for peers it knew about before the restart).
    *
    * Unlike the per-strand instances (see `strand-instance-manager.ts`), pushes
-   * are gated on {@link isAuthorizedMember}, judged at push time: the control
+   * are gated on the authorized-member snapshot ({@link authorizedControlPeers},
+   * which {@link refreshAuthorizedControlPeers} materializes from the same rows and
+   * rule {@link isAuthorizedMember} queries), judged at push time: the control
    * network's inbound connection gate deliberately admits non-members in
    * several states (seed delivery to an un-enrolled node, an open enrollment
    * window, an outstanding invitation, configured bootstrap/relay peers), and
@@ -2080,23 +2190,19 @@ export class CadreNode implements SAppIdLookup {
    * The one non-member the gate admits is a device whose invitation
    * redemption this member is admitting ({@link admitRedeemingDevice}).
    *
-   * No-ops (logged) when the embedder configured no control storage or the
-   * node exposes no key network — the backfill would have nothing to read or
-   * no way to dial.
+   * No-ops (logged) when {@link controlBackfillStorage} answers nothing (disabled,
+   * or no control storage configured) or the node exposes no key network — the
+   * backfill would have nothing to read or no way to dial.
    */
   private startControlBackfill(): void {
-    if (this.config.controlBackfill?.enabled === false || !this.controlNode) {
+    if (!this.controlNode) {
       return;
     }
-    // Through the resolver, not the {@link controlStorage} memo field: the resolver is
-    // idempotent (it returns the same wrapped store `buildControlNodeOptions` already
-    // resolved), so the catch-up cannot be silently disarmed by a future reordering that
-    // moves this call ahead of the one that populated the field.
-    const storage = this.resolveControlStorage();
+    const storage = this.controlBackfillStorage();
     const keyNetwork = (this.controlNode as Libp2pNodeWithRepo).keyNetwork;
     if (!storage || !keyNetwork) {
       log('Control peer-join block catch-up is inert: %s',
-        !storage ? 'no control storage configured' : 'control node exposes no keyNetwork');
+        !storage ? 'disabled, or no control storage configured' : 'control node exposes no keyNetwork');
       return;
     }
     const networkName = this.controlNetworkName();
@@ -2109,7 +2215,11 @@ export class CadreNode implements SAppIdLookup {
       // under — derived from the same networkName binding the node options
       // used, never re-spelled here.
       protocolPrefix: `/optimystic/${networkName}`,
-      authorizePeer: async (peerId) => this.admittingDevices.has(peerId) || await this.isAuthorizedMember(peerId)
+      reportBlockHeld: (this.controlNode as Libp2pNodeWithRepo).reportBlockHeld,
+      // The membership snapshot, not {@link isControlNetworkMember}: that predicate admits
+      // everyone while the snapshot is empty and admits bootstrap/relay peers outright, and
+      // neither may receive the control store.
+      authorizePeer: async (peerId) => this.admittingDevices.has(peerId) || this.authorizedControlPeers.has(peerId)
     }, {
       // A shorter settle window than the strand default (1000 ms): the control
       // store is small (a party's membership — dozens of blocks), a re-push is
@@ -2165,8 +2275,8 @@ export class CadreNode implements SAppIdLookup {
     const release = this.countAdmittingDevice(peerId);
     try {
       const result = await backfill.forceCatchUpPeer(peerIdFromString(peerId));
-      log('Device %s caught up before its admission: offered=%d accepted=%d rejected=%d',
-        peerId, result.offered, result.accepted, result.rejected.length);
+      log('Device %s caught up before its admission: offered=%d alreadyHeld=%d accepted=%d rejected=%d',
+        peerId, result.offered, result.alreadyHeld, result.accepted, result.rejected.length);
       return release;
     } catch (error) {
       release();
@@ -2230,6 +2340,20 @@ export class CadreNode implements SAppIdLookup {
     return this.controlStorage;
   }
 
+  /**
+   * The store the control network's peer-join block catch-up reads, or `undefined` when this
+   * runtime does not arm it: `controlBackfill.enabled: false`, or no control storage. Both of
+   * its readers ask here so they cannot disagree: {@link startControlBackfill} arms on it, and
+   * {@link buildControlNodeOptions} turns Optimystic's rebalance reaction off on it.
+   *
+   * Through the resolver, not the {@link controlStorage} memo field: the resolver is
+   * idempotent, so the catch-up cannot be silently disarmed by a future reordering that moves
+   * a read ahead of the one that populated the field.
+   */
+  private controlBackfillStorage(): IRawStorage | undefined {
+    return this.config.controlBackfill?.enabled === false ? undefined : this.resolveControlStorage();
+  }
+
   /**
    * Warn the operator when `network.announceAddrs` will silently cost this node the
    * relay reachability it also configured.
@@ -2337,6 +2461,19 @@ export class CadreNode implements SAppIdLookup {
         cohortQueryTimeoutMs: declaredCohortReadDeadlineMs(network)
       }),
       arachnode: { enableRingZulu: profile === 'storage' },
+      // One join catch-up per node, for the strand node's reason (`strand-instance-manager.ts`,
+      // at its `rebalance` option): Optimystic's rebalance growth arm would push a joining
+      // member each control block again, one request per block. Every peer the growth arm
+      // pushes to, the control catch-up pushes to as well, except the ones it deliberately
+      // withholds the control store from: the cohort predicate (`isNetworkMember` below) admits
+      // everyone while the membership snapshot is empty, and bootstrap/relay peers outright.
+      // With the catch-up disabled the reaction stays on.
+      //
+      // NOTE: no ring shifts and no reclaimable shed blocks on this node either, unused today.
+      // If storage nodes ever need them, turn the reaction back on: the catch-up already reports
+      // its accepted pushes to the rebalance monitor (`reportBlockHeld`); measure whether the
+      // growth arm still re-sends.
+      ...(this.controlBackfillStorage() && { rebalance: { enabled: false } }),
       ...(identityKey && { privateKey: identityKey }),
       // With `network.relayAddrs` set, built with libp2p's relay discovery off (given a
       // transport list to wrap — `node-transports.ts`), so the supervisor
@@ -2405,10 +2542,8 @@ export class CadreNode implements SAppIdLookup {
       // Who this node SENDS control writes to (cohort and coordinator choice), where
       // `authorizeInboundStream` is who may send to it. Without it Optimystic picks cohort
       // members from the protocols a peer's peer-store record lists, which any connected
-      // peer can fill. The stream gate's rule, unlogged (Optimystic asks several times per
-      // peer per cohort assembly and counts refusals on its own debug line), plus a device
-      // whose verified redemption is being written, which must hold the rows that admit it.
-      isNetworkMember: (peerId) => this.isControlNetworkMember(peerId) || this.admittingDevices.has(peerId)
+      // peer can fill.
+      isNetworkMember: (peerId) => this.isControlCohortMember(peerId)
     };
 
     return nodeOptions;
@@ -2492,8 +2627,8 @@ export class CadreNode implements SAppIdLookup {
    * (it redeems here by seating the row from its bundle, after which check 7
    * admits) or from a sibling whose membership row is still replicating (check 5
    * admits once it lands; if it has not landed by the deadline, the connection
-   * is closed and either side's next reconcile dial re-forms it, since outbound
-   * dials are never gated). The protocol guard refuses all of them every
+   * is closed and the reconcile pass the close starts on either side re-forms it,
+   * since outbound dials are never gated). The protocol guard refuses all of them every
    * members-only protocol meanwhile. A circuit-relay reservation admitted by
    * {@link admitControlRelayReservation} disarms the deadline (see
    * `membership-connection-gater.ts` → "The relay-reservation seam").
@@ -2724,6 +2859,18 @@ export class CadreNode implements SAppIdLookup {
     return this.authorizedControlPeers.size === 0 || this.authorizedControlPeers.has(remotePeerId);
   }
 
+  /**
+   * Whether this node sends control writes to `remotePeerId`: Optimystic's `isNetworkMember`
+   * for the control node (cohort and coordinator choice), and the membership half of
+   * {@link hasReachableControlSibling}. The stream gate's rule ({@link isControlNetworkMember}),
+   * unlogged, because Optimystic asks several times per peer per cohort assembly and counts
+   * refusals on its own debug line; plus a device whose verified redemption is being written
+   * ({@link admittingDevices}), which must hold the rows that admit it.
+   */
+  private isControlCohortMember(remotePeerId: string): boolean {
+    return this.isControlNetworkMember(remotePeerId) || this.admittingDevices.has(remotePeerId);
+  }
+
   /**
    * Per-stream authorization for the protocol guard's `members-snapshot` class
    * (`control-protocol-guard.ts`): the four Optimystic control-DB protocols
@@ -2765,7 +2912,8 @@ export class CadreNode implements SAppIdLookup {
    * this listener with its write lock HELD (`notifyMembershipChanged`), so a retrying
    * read here would sleep its backoff holding the lock and stall every other local
    * writer. Nothing is lost — this refresh already keeps the previous snapshot on
-   * failure and is re-driven by the next membership write and by the timed reconcile.
+   * failure and is re-driven by the next membership change (local or replicated, through
+   * the gate watch) and by the reconcile pass's backstop.
    *
    * The trusted-owner anchor sync ({@link syncOwnerAnchor}) runs FIRST, so the snapshot
    * built here judges `CadrePeer` rows against the anchor as the `OwnerKey` table now
@@ -2840,15 +2988,20 @@ export class CadreNode implements SAppIdLookup {
       // commit is what would authorize it), and the gate re-judges at push time.
       //
       // NOTE: every refresh re-arms every connected peer that is not yet caught
-      // up, and each re-armed pass costs one `CadrePeer` query at the gate. A
-      // connection that is admitted but never authorized — a configured
+      // up. A connection that is admitted but never authorized — a configured
       // bootstrap or relay peer, the steady state for a NAT'd node — is
-      // therefore re-judged on every membership write and every timed reconcile
-      // tick, forever. Negligible at a cadre's handful of connections; if a node
-      // ever holds many such connections, or refreshes get frequent, skip
-      // re-arming peers whose last pass was denied under the SAME membership
-      // snapshot instead of re-arming unconditionally.
+      // therefore re-judged on every refresh, forever: every local membership
+      // write, every replicated membership change (the gate watch), and every
+      // reconcile pass, down to the 2-minute backstop on an idle party. Each
+      // such pass is one timer and a lookup in the snapshot just set (the gate
+      // reads no control database). If a node ever holds many such connections,
+      // or refreshes get frequent, skip re-arming peers whose last pass was
+      // denied under the SAME membership snapshot instead of re-arming
+      // unconditionally.
       void this.controlBackfill?.scheduleConnectedPeers();
+      // Same join order for the growth edge: a sibling that identified before this commit
+      // authorized it becomes reachable here.
+      this.updateControlSiblingReachability();
       await this.hangUpRevokedControlPeers(rows, loadTombstones);
       await this.noteOwnRemoval(rows, loadTombstones);
     } catch (error) {
@@ -3035,9 +3188,10 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * What the strand watcher polls: this party's control rows plus a row per cross-party
+   * What the strand watcher reads: this party's control rows plus a row per cross-party
    * join (see {@link joinedStrands}), so a joined strand is offered and relaunched on
-   * the same path as the party's own.
+   * the same path as the party's own. It runs on a change to either table; the
+   * machine-local joins wake it through {@link JoinedStrandSession}'s change callback.
    */
   private createStrandQueryable(): StrandQueryable {
     return {
@@ -3049,7 +3203,14 @@ export class CadreNode implements SAppIdLookup {
         log('Querying strands from control database');
         const control = await this.controlDatabase.queryStrands();
         return this.joinedStrands ? await this.joinedStrands.withControlRows(control) : control;
-      }
+      },
+      watchChanges: (onChange, options) => {
+        if (!this.controlDatabase) {
+          throw new Error('CadreNode must initialize its control database before watching its strand tables');
+        }
+        return this.controlDatabase.watchTables(['CadreControl.Strand', 'CadreControl.JoinedStrand'], onChange, options);
+      },
+      lastReadPartial: () => this.joinedStrands?.lastReadPartial() ?? false
     };
   }
 
@@ -3065,10 +3226,6 @@ export class CadreNode implements SAppIdLookup {
       return this.controlDatabase;
     };
     return {
-      // NOTE: one more control read per watcher poll (5 s), and for a party that never
-      // joined anything it reads a never-written block, which consults the cohort. If poll
-      // cost shows up in a device profile, cache the list and re-read it on the reconcile
-      // cadence.
       list: () => database().queryJoinedStrands(),
       names: async (strandId) => (await database().queryStrand(strandId)) !== null
         || (await database().queryJoinedStrand(strandId)) !== null,
@@ -3155,26 +3312,29 @@ export class CadreNode implements SAppIdLookup {
    * after start (non-blocking). {@link registerSelf} is idempotent and safely
    * no-ops when it cannot yet sign/insert (e.g. owner key not installed),
    * so the timer is harmless even when registration only becomes possible later.
+   * A record this process already put in place that is still current (a founding owner's
+   * explicit publish, a redeemed invitation's admission, a restart's first-growth re-touch) is
+   * not written again ({@link publishSelfRecordUnlessCurrent}). Whether the node is connected
+   * yet does not matter: a device that redeems within a second of starting is.
    */
   private scheduleSelfRegistration(): void {
     this.selfRegistrationTimer = setTimeout(() => {
       void (async () => {
         try {
-          await this.registerSelf();
+          await this.publishSelfRecordUnlessCurrent();
         } catch (error) {
-          // Background task — a failed publish must not crash the node. A restarted machine
-          // whose own CadrePeer row replicates in while this update runs fails here with
-          // ConcurrentModificationError (seen on the owner's restart in every traced run of
-          // cadre-invite-any-member); the next connected reconcile pass retries
+          // Background task — a failed publish must not crash the node. A publish that loses
+          // its row to another writer — the owner's re-touch, or a restarted machine's own row
+          // replicating in while the update runs — is re-run by the write funnel over the row
+          // it finds (`ControlDatabase.updateSelfPeerRecord`); one that lost past the retry
+          // budget fails here, and the next connected reconcile pass is the fallback
           // (publishFirstSelfRecord).
           log('Self-registration failed: %o', error);
         }
-        // Wire the ongoing refresh + control-cohort reconcile cadence, then run
-        // an eager reconcile pass once the node has settled (the recurring
-        // interval was just armed inside startRecordRefresh).
+        // Wire the ongoing refresh and the control-cohort reconcile schedule, then
+        // run an eager reconcile pass now that the node has settled.
         this.startRecordRefresh();
-        void this.reconcileControlCohort().catch((error) =>
-          log('Control-cohort reconcile (start) failed: %o', error));
+        this.controlReconcileRuns?.trigger(0);
       })();
     }, 1000); // Small delay to ensure node is fully started
     // Node-only: don't keep the event loop alive solely for this timer.
@@ -3249,16 +3409,16 @@ export class CadreNode implements SAppIdLookup {
       return 'skipped';
     }
     // Collected only past that skip, which a node waiting for its row replicated in takes on
-    // every connected reconcile pass ({@link publishFirstSelfRecord}).
+    // reconcile pass made while a sibling is reachable ({@link publishFirstSelfRecord}).
     const addrs = await this.collectSelfAddrs();
 
     if (!existing && ownerService) {
       // First-time row: requires an owner signature (the node is its own
       // owner). insertSelfPeerRecord throws if no owner key is present.
       const record = this.signSelfRecord(peerId, signingKey, addrs, null);
+      const aloneBefore = this.committedAlone();
       if (await ownerService.insertSelfPeerRecord(record)) {
-        if (this.committedAlone()) this.pendingSelfPeerWrite = true;
-        this.noteSelfRecordPublished();
+        this.noteSelfPeerWritten(record, aloneBefore);
         log('registerSelf: inserted own CadrePeer record (owner-signed, updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
         return 'inserted';
       }
@@ -3273,44 +3433,102 @@ export class CadreNode implements SAppIdLookup {
       log('registerSelf: own CadrePeer row appeared mid-publish (concurrent authorize); self-updating to carry the signature');
     }
 
-    // Reached on the fall-through above, where the pre-race read missed the row a
-    // concurrent authorize then seated — so re-read to get that row's `UpdatedAt`, which
-    // the strictly-greater self-update rule is measured against. The re-read can still
-    // come back null (see the branch below).
-    //
-    // NOTE: when `existing` is set it predates this publish, so a removePeer(self) racing
-    // in would leave the UPDATE below matching no rows while still reporting 'refreshed'.
-    // Closing that needs updateSelfPeerRecord to report rows-affected — only worth doing
-    // if removing self ever becomes something that happens concurrently in practice.
-    const current = existing ?? await this.controlDatabase.queryPeerRecord(peerId);
-    if (!current) {
+    // The update body reads the row under the write lock and signs over what it finds, on
+    // every attempt — so neither `existing` (a read that predates this publish) nor a first
+    // attempt that lost the row to another writer decides the `UpdatedAt` the strictly-greater
+    // self-update rule is measured against, and a removal landing mid-publish re-reads as
+    // absent instead of matching no rows under a 'refreshed'. The record it returns is the
+    // one in the row.
+    const aloneBefore = this.committedAlone();
+    const record = await this.controlDatabase.updateSelfPeerRecord(peerId,
+      (current) => this.signSelfRecord(peerId, signingKey, addrs, current));
+    if (record === null) {
       // Two causes, and the second is a steady state rather than a race: the row really
       // vanished mid-publish (next refresh re-inserts), or this node was REVOKED — its row
       // is physically present, so insertCadrePeer's in-lock existence check no-op'd above,
-      // but queryPeerRecord reads it as absent because its stamp is retired. The revoked
-      // case repeats every heartbeat and never re-inserts; that is intended (a revoked node
-      // has nothing to publish), so this stays a skip, not an error.
+      // but the body reads it as absent because its stamp is retired. The revoked case
+      // repeats every heartbeat and never re-inserts; that is intended (a revoked node has
+      // nothing to publish), so this stays a skip, not an error.
       log('registerSelf: own CadrePeer row not readable (vanished mid-publish, or this node is revoked and its stamp retired); skipping');
       return 'skipped';
     }
-    const record = this.signSelfRecord(peerId, signingKey, addrs, current);
-    await this.controlDatabase.updateSelfPeerRecord(record);
-    if (this.committedAlone()) this.pendingSelfPeerWrite = true;
-    this.noteSelfRecordPublished();
+    this.noteSelfPeerWritten(record, aloneBefore);
     log('registerSelf: refreshed own CadrePeer record (updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
     return 'refreshed';
   }
 
   /**
-   * Record that this node's own address record just landed, and re-arm the stale-record
-   * warning. Called from BOTH publishing paths of {@link publishSelfRecord} and nowhere
-   * else — a `skipped` publish wrote nothing, so it must not refresh the stamp.
+   * Bookkeeping for a committed write of this node's own `CadrePeer` row by {@link publishSelfRecord}:
+   * `record` is the one the row holds (for the update path, the one its body signed on the
+   * attempt that committed, not the first it signed). Queued for the drain's re-touch
+   * ({@link pendingSelfPeerWrite}) when no sibling was reachable when the write started or when
+   * it ended: a sibling that identifies while the write is out may do so after the write's cohort
+   * was chosen, and the first-growth drain skips a row holding {@link lastSignedSelfRecord} unless
+   * this flag is set. Both fields are set here together so no write can leave the record without
+   * the flag.
    */
-  private noteSelfRecordPublished(): void {
-    this.lastSelfRecordPublishAt = Date.now();
+  private noteSelfPeerWritten(record: PeerAddressRecord, aloneBefore: boolean): void {
+    if (aloneBefore || this.committedAlone()) this.pendingSelfPeerWrite = true;
+    this.lastSignedSelfRecord = record;
+    this.noteSelfRecordPublished();
+  }
+
+  /**
+   * Record that this node's own address record is in place as of `at`, and re-arm the
+   * stale-record warning. Called for BOTH publishing paths of {@link publishSelfRecord}
+   * ({@link noteSelfPeerWritten}), and by {@link publishSelfRecordUnlessCurrent} with the stamp
+   * of a record already in place — a `skipped` publish wrote nothing and found nothing, so it
+   * must not refresh the stamp.
+   */
+  private noteSelfRecordPublished(at = Date.now()): void {
+    this.lastSelfRecordPublishAt = at;
     this.selfRecordStaleWarned = false;
   }
 
+  /**
+   * {@link registerSelf}, unless the own row already holds the record this process last signed
+   * ({@link lastSignedSelfRecord}) and that record is current ({@link isCurrentSelfRecord});
+   * then nothing is written and the record counts as published at its own stamp. For a publish
+   * that puts a record in place (the boot timer, the reconcile pass's first publish, the
+   * first-growth drain), never the heartbeat, which exists to re-stamp freshness. `'current'`
+   * is this method's own answer; {@link registerSelf} always writes.
+   */
+  private async publishSelfRecordUnlessCurrent(): Promise<SelfRegistrationOutcome | 'current'> {
+    if (this.registerSelfInFlight) {
+      return this.registerSelfInFlight;
+    }
+    const record = this.lastSignedSelfRecord;
+    if (record !== null && await this.isCurrentSelfRecord(record)) {
+      this.noteSelfRecordPublished(record.updatedAt);
+      log('registerSelf: own CadrePeer record already current (updatedAt=%d); not written again', record.updatedAt);
+      return 'current';
+    }
+    return this.registerSelf();
+  }
+
+  /**
+   * Is `record` still the one to publish: signed less than half a heartbeat ago, with this
+   * node's profile, over the addresses it would publish now, and the signature the own row
+   * holds? The age bound keeps a record that is not re-written fresh for resolvers: at most half
+   * a heartbeat old here and re-stamped by the heartbeat within one more, so never older than
+   * 1.5 heartbeats (11.25 min) against {@link DEFAULT_PEER_RECORD_MAX_AGE_MS}. Cheap checks
+   * first: the row comes from the membership view, the addresses from the app's resolver.
+   */
+  private async isCurrentSelfRecord(record: PeerAddressRecord): Promise<boolean> {
+    if (Date.now() - record.updatedAt >= DEFAULT_PEER_RECORD_HEARTBEAT_MS / 2 || record.profile !== this.config.profile) {
+      return false;
+    }
+    const row = await this.controlDatabase?.queryPeerRecord(record.peerId);
+    if (row?.sig !== record.sig) {
+      return false;
+    }
+    // Sanitized, as the record a redemption carries is (`signRedeemRequest`); a published
+    // record is not, so one whose list sanitizing would change (over 16 addresses) is never
+    // current and is written as before.
+    const addrs = sanitizeAddrs(await this.collectSelfAddrs());
+    return addrs.length === record.addrs.length && addrs.every((addr, i) => addr === record.addrs[i]);
+  }
+
   /**
    * Report an abandoned control write to the embedding app.
    *
@@ -3455,19 +3673,24 @@ export class CadreNode implements SAppIdLookup {
    * process does not learn it was removed ({@link noteOwnRemoval}), and pays that read on every
    * pass.
    *
-   * Connected-only: a row written elsewhere arrives over a connection, and an owner's publish
-   * committed alone is local-only and forks its own history — a restarted owner whose embedder
-   * runs a pass before it reconnects would write its row on the stale side of the fork, and
-   * then never see rows written while it was down (`cadre-invite-any-member` runs that pass and
-   * fails every time without this condition). The boot-time publish and the first-growth drain already try at the node's lone and
-   * first-connection moments; this retries on the passes after.
+   * Only while a sibling is reachable ({@link hasReachableControlSibling}): a row written
+   * elsewhere arrives from a sibling, and an owner's publish committed alone is local-only and
+   * forks its own history — a restarted owner whose embedder runs a pass before it reconnects
+   * would write its row on the stale side of the fork, and then never see rows written while it
+   * was down (`cadre-invite-any-member` runs that pass and fails every time without this
+   * condition). A connection is not enough: until the sibling identifies, the write's cohort is
+   * this node alone. The boot-time publish and the first-growth drain already try at the
+   * node's lone and first-sibling moments; this retries on the passes after.
+   *
+   * A machine admitted by invitation finds its row already holding the record its redemption
+   * carried, and writes nothing ({@link publishSelfRecordUnlessCurrent}).
    */
   private async publishFirstSelfRecord(): Promise<void> {
     if (this.lastSelfRecordPublishAt !== null || this.isAwaitingClaim() || this.removal !== null
-      || this.getControlConnectionCount() === 0) {
+      || !this.hasReachableControlSibling()) {
       return;
     }
-    const outcome = await this.registerSelf().catch((error: unknown) => {
+    const outcome = await this.publishSelfRecordUnlessCurrent().catch((error: unknown) => {
       log('reconcileControlCohort: first self-record publish failed (continuing): %o', error);
       return 'skipped' as const;
     });
@@ -3506,17 +3729,22 @@ export class CadreNode implements SAppIdLookup {
         this.escalateIfSelfRecordStale(reason, error);
       });
     };
-    const reconcile = (reason: string) => {
-      void this.reconcileControlCohort().catch((error) =>
-        log('Control-cohort reconcile (%s) failed: %o', reason, error));
-    };
+    const backstopMs = this.controlReconcileBackstopMs();
+    // The pass's schedule. A run never joins a pass already in flight: that pass may have
+    // read its rows before the change that woke this run, so joining it would drop the
+    // change until the backstop. It waits for the pass, then starts its own.
+    this.controlReconcileRuns = scheduleRuns(async () => {
+      await this.reconcileControlCohortInFlight?.catch(() => undefined);
+      await this.reconcileControlCohort().catch((error) =>
+        log('Control-cohort reconcile (scheduled) failed: %o', error));
+    }, { label: 'control-reconcile', backstopMs });
 
     // Address churn re-publishes the self record AND re-checks the control cohort:
     // a relay-reservation rotation / NAT change can drop a sibling connection, so
     // the next pass should re-observe and re-dial it.
     this.selfPeerUpdateHandler = () => {
       republish('self:peer:update');
-      reconcile('self:peer:update');
+      this.controlReconcileRuns?.trigger(0);
     };
     this.controlNode.addEventListener('self:peer:update', this.selfPeerUpdateHandler);
 
@@ -3538,15 +3766,32 @@ export class CadreNode implements SAppIdLookup {
     this.recordRefreshTimer = setInterval(() => republish('heartbeat'), DEFAULT_PEER_RECORD_HEARTBEAT_MS);
     (this.recordRefreshTimer as { unref?: () => void } | null)?.unref?.();
 
-    const reconcileMs = this.config.network?.controlCohort?.reconcileMs ?? DEFAULT_CONTROL_COHORT_RECONCILE_MS;
-    this.controlCohortReconcileTimer = setInterval(() => reconcile('interval'), reconcileMs);
-    (this.controlCohortReconcileTimer as { unref?: () => void } | null)?.unref?.();
+    log('Record refresh wired (heartbeat=%dms, cohortReconcileBackstop=%dms)',
+      DEFAULT_PEER_RECORD_HEARTBEAT_MS, backstopMs);
+  }
 
-    log('Record refresh wired (heartbeat=%dms, cohortReconcile=%dms)',
-      DEFAULT_PEER_RECORD_HEARTBEAT_MS, reconcileMs);
+  /** The reconcile schedule's backstop: `network.controlCohort.reconcileMs`, default `DEFAULT_CONTROL_COHORT_RECONCILE_MS`. */
+  private controlReconcileBackstopMs(): number {
+    return this.config.network?.controlCohort?.reconcileMs ?? DEFAULT_CONTROL_COHORT_RECONCILE_MS;
   }
 
-  /** Tear down the self-record refresh timers + listener (see {@link cleanup}). */
+  /**
+   * The gate watch's run ({@link membershipGateWatch}): re-materialize the gate, so a
+   * replicated revocation hangs up the removed machine now (`hangUpRevokedControlPeers`
+   * ends every refresh), then start a reconcile pass for whatever else the change means
+   * (a new sibling to dial, a tombstoned row to reap). A local membership write refreshes
+   * the gate twice — once from the awaited membership listener, so the writer sees its
+   * change before returning, and once here, 50 ms later. The listener's refresh runs under
+   * the write lock, so its reads take the committed-read path and the view keeps nothing
+   * from them; this refresh is the read that refills the view after the write, which some
+   * later caller would otherwise pay. Accepted: one reload per change, not two.
+   */
+  private async onMembershipGateTablesChanged(): Promise<void> {
+    await this.refreshMembershipGate('table-change');
+    this.controlReconcileRuns?.trigger(0);
+  }
+
+  /** Tear down the self-record refresh timers, the reconcile schedule and the listeners (see {@link cleanup}). */
   private stopRecordRefresh(): void {
     if (this.selfRegistrationTimer) {
       clearTimeout(this.selfRegistrationTimer);
@@ -3556,24 +3801,30 @@ export class CadreNode implements SAppIdLookup {
       clearInterval(this.recordRefreshTimer);
       this.recordRefreshTimer = null;
     }
-    if (this.controlCohortReconcileTimer) {
-      clearInterval(this.controlCohortReconcileTimer);
-      this.controlCohortReconcileTimer = null;
+    if (this.controlReconcileRuns) {
+      this.controlReconcileRuns.dispose();
+      this.controlReconcileRuns = null;
+    }
+    if (this.membershipViewReloadTimer) {
+      clearTimeout(this.membershipViewReloadTimer);
+      this.membershipViewReloadTimer = null;
     }
+    this.reconcileRedialStreak = 0;
     if (this.controlNode) {
       if (this.selfPeerUpdateHandler) {
         this.controlNode.removeEventListener('self:peer:update', this.selfPeerUpdateHandler);
       }
-      if (this.controlConnectionOpenHandler) {
-        this.controlNode.removeEventListener('connection:open', this.controlConnectionOpenHandler);
+      if (this.controlPeerIdentifyHandler) {
+        this.controlNode.removeEventListener('peer:identify', this.controlPeerIdentifyHandler);
       }
       if (this.controlConnectionCloseHandler) {
         this.controlNode.removeEventListener('connection:close', this.controlConnectionCloseHandler);
       }
     }
     this.selfPeerUpdateHandler = null;
-    this.controlConnectionOpenHandler = null;
+    this.controlPeerIdentifyHandler = null;
     this.controlConnectionCloseHandler = null;
+    this.identifiedControlPeers.clear();
 
     // Reset the write-while-alone re-replication state so a stop()→start() cycle
     // re-arms the growth edge and re-runs BOTH one-shot passes. Any queued
@@ -3582,10 +3833,9 @@ export class CadreNode implements SAppIdLookup {
     // first-growth revocation sweep — which is why the sweep flag must reset too,
     // or the second lifetime would skip the sweep and strand exactly the
     // committed-alone tombstones it exists to carry.
-    this.hasControlConnection = false;
+    this.controlSiblingReachable = false;
     this.reconstructedLocalOnlyWrites = false;
     this.reissuedHeldRevocations = false;
-    this.revocationLedgerOpened = false;
     this.pendingPeerWrites.clear();
     this.pendingRevocations.clear();
     this.pendingSelfPeerWrite = false;
@@ -3594,6 +3844,7 @@ export class CadreNode implements SAppIdLookup {
     // from scratch, and carrying the previous lifetime's stamp forward would either
     // suppress the stale-record warning or fire it on a node that just came up.
     this.lastSelfRecordPublishAt = null;
+    this.lastSignedSelfRecord = null;
     this.selfRecordStaleWarned = false;
   }
 
@@ -3783,26 +4034,37 @@ export class CadreNode implements SAppIdLookup {
    * Run one proactive control-cohort dial pass to keep this node connected to its
    * cadre siblings (so the `CadreControl` collections form a replicating cohort).
    * Public so the cohort-growth-driven re-replication path
-   * (`control-write-ensure-replicated`) and tests can trigger a pass on demand;
-   * normally driven by the eager start pass, the recurring interval, and
-   * `self:peer:update` (all wired in {@link startRecordRefresh}).
+   * (`control-write-ensure-replicated`), `addDrone`'s callers, `claimNode`,
+   * `redeemCadreInvitation` and tests can run a pass on demand. On its own a pass
+   * runs when something it acts on changes, and otherwise at a backstop
+   * ({@link controlReconcileRuns}): once after start; on `self:peer:update`; when a
+   * membership table changes, local commit or replicated ({@link membershipGateWatch});
+   * when a control connection to an authorized sibling opens or closes
+   * ({@link onControlSiblingConnectionChange}); on the redial and strand-address wakes
+   * a pass arms for itself ({@link armReconcileWake}); and at the backstop,
+   * `network.controlCohort.reconcileMs` (default `DEFAULT_CONTROL_COHORT_RECONCILE_MS`,
+   * 2 minutes) after the last pass settled. A connection to a relay, a bootstrap node or
+   * another party's machine starts no pass: the pass acts on none of them, beyond
+   * counting them as "connected" for its write steps, which therefore run at the next
+   * membership change or backstop on a one-machine party whose only connection is a
+   * relay.
    *
    * Concurrent triggers collapse into a single in-flight pass
    * (see {@link reconcileControlCohortInFlight}) so two passes never double-dial;
-   * a call that joins an in-flight pass resolves to THAT pass's result.
+   * a call that joins an in-flight pass resolves to THAT pass's result (a scheduled
+   * run waits for it instead, so the change that woke the run is seen).
    * Best-effort throughout: a failure to resolve/dial any one sibling is logged
    * and the pass continues; the whole pass is a no-op when the node is alone.
    *
    * Resolves to the peers the pass dialled ({@link ControlCohortReconcileResult}),
    * so a caller can tell a link this pass opened from one something else opened —
-   * the pass skips a peer that is already connected. The timer and event triggers
-   * discard it.
+   * the pass skips a peer that is already connected. The scheduled runs discard it.
    */
   async reconcileControlCohort(): Promise<ControlCohortReconcileResult> {
     if (this.reconcileControlCohortInFlight) {
       return this.reconcileControlCohortInFlight;
     }
-    const op = this.runReconcileControlCohort();
+    const op = this.runReconcileControlCohortAndArmWake();
     this.reconcileControlCohortInFlight = op;
     try {
       return await op;
@@ -3811,38 +4073,77 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /** One pass, then the wake it earns ({@link armReconcileWake}); the public result is the pass's `dialed`. */
+  private async runReconcileControlCohortAndArmWake(): Promise<ControlCohortReconcileResult> {
+    const startedAt = Date.now();
+    const outcome = await this.runReconcileControlCohort();
+    this.armReconcileWake(outcome, startedAt);
+    return { dialed: outcome.dialed };
+  }
+
+  /**
+   * After every pass, explicit or scheduled: advance or reset the redial streak and
+   * `trigger` the schedule for the earliest of the pass's own reasons to run again
+   * (`nextReconcileWakeMs`): a redial for a sibling or bootstrap peer it left
+   * unconnected, or a strand-address ask falling due before the backstop. Nothing else
+   * the pass does needs a wake sooner than the backstop: delegate grants re-announce
+   * every 15 minutes inside a 30-minute TTL, the FRET and formation address re-merges
+   * guard a one-hour expiry, and the self record has its own heartbeat. A pass that
+   * runs before the schedule exists (an explicit call during the first second after
+   * start) still counts for the streak.
+   */
+  private armReconcileWake(outcome: ControlCohortPassOutcome, startedAt: number): void {
+    this.reconcileRedialStreak = outcome.unconnected ? this.reconcileRedialStreak + 1 : 0;
+    const runs = this.controlReconcileRuns;
+    if (!runs) {
+      return;
+    }
+    const wakeMs = nextReconcileWakeMs({
+      redialStreak: this.reconcileRedialStreak,
+      passStartedAt: startedAt,
+      strandAddrDueAt: this.strandAddrAskDueAt.values(),
+      now: Date.now(),
+      backstopMs: this.controlReconcileBackstopMs(),
+    });
+    if (wakeMs !== undefined) {
+      log('reconcileControlCohort: next pass in %dms (redial streak %d)', wakeMs, this.reconcileRedialStreak);
+      runs.trigger(wakeMs);
+    }
+  }
+
   /** Body of {@link reconcileControlCohort}; serialised by its single-flight guard. */
-  private async runReconcileControlCohort(): Promise<ControlCohortReconcileResult> {
+  private async runReconcileControlCohort(): Promise<ControlCohortPassOutcome> {
     // Shutdown / not-yet-started guard (mirrors publishSelfRecord). A pass that
     // fires after stop() began must early-return rather than touch a torn-down node.
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return { dialed: [] };
-    }
-    // Ride this pass's cadence to refresh the per-stream gate's materialized
-    // authorized set — membership changes that ARRIVED BY REPLICATION (rather
-    // than a local write) are picked up here, bounding the snapshot's staleness
-    // to the time between pass starts: the reconcile interval, or the previous
-    // pass's length when that is longer (passes are single-flight, and one
-    // unreachable sibling's dial alone can take `controlDialBudget().totalMs`).
+      return { dialed: [], unconnected: false };
+    }
+    // Refresh the per-stream gate's materialized authorized set at the head of every
+    // pass, so the sibling enumeration below judges rows the same way the gate does.
+    // Changes reach the gate on their own through the gate watch; this refresh is the
+    // backstop's, for a change this node's storage never heard of.
     // NOTE: this refresh and the sibling enumeration below each run their own
     // CadrePeer query (two reads per pass), plus a third from
     // `refreshStrandPeerAddrs` on every pass where a strand is running AND this
     // node holds a control connection (one read for the whole pass, not one per
     // strand; it runs even when no sibling is due, because pruning departed
     // siblings needs the current target set). Each also reads Revocation first.
-    // Before the Revocation ledger marker exists (filed below, once connected)
-    // that block is missing, so every one of those reads consults the cohort
-    // about it; once the marker exists every
-    // block they touch is held and none of them does (both states pinned in
-    // control-founding-consult-budget.spec.ts). If those reads ever get costly,
-    // share one row-set across all three.
+    // All of them are served from the control database's membership views
+    // (`ControlDatabase.readMembershipRows`): an in-memory scan while the view is
+    // current, storage only for the first read after the table changed or after
+    // `MEMBERSHIP_VIEW_MAX_AGE_MS`, and an idle pass makes no cohort consult
+    // (pinned in control-founding-consult-budget.spec.ts). Threading one row set
+    // through the refresh, the reap, the enumeration and the strand-address targets
+    // would save no storage read and was declined
+    // (`control-reconcile-woken-by-changes-reads-once`); rows going stale during a
+    // pass is harmless, since a change during the pass starts another one.
     await this.refreshMembershipGate('reconcile');
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return { dialed: [] };
+      return { dialed: [], unconnected: false };
     }
     await this.publishFirstSelfRecord();
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return { dialed: [] };
+      return { dialed: [], unconnected: false };
     }
     // Refresh relay delegate grants BEFORE the sibling enumeration below: a
     // solo cadre with a party relay has no siblings to dial but must still keep
@@ -3850,7 +4151,7 @@ export class CadreNode implements SAppIdLookup {
     // the reservation and faces the connection gate again).
     await this.refreshDelegateGrants();
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return { dialed: [] };
+      return { dialed: [], unconnected: false };
     }
     // Then re-warm each running strand's own address book from its FRET address
     // records and from whichever siblings are due an ask. Same reasoning as
@@ -3858,15 +4159,16 @@ export class CadreNode implements SAppIdLookup {
     // network, and every layer under cadre-core dials strand peers by bare peer id.
     await this.refreshStrandPeerAddrs();
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return { dialed: [] };
+      return { dialed: [], unconnected: false };
     }
     const selfPeerId = this.controlNode.peerId.toString();
 
     // Reap guarded rows this node still holds for incarnations an already-committed
     // Revocation tombstone retires — the half of a removal replication cannot carry
-    // (a delete of an already-absent row replays as nothing). Connected-only: a reap
-    // is a write, and a write committed alone is local-only and forks this node's own
-    // history, which is the condition this work exists to stop creating
+    // (a delete of an already-absent row replays as nothing). Only while a sibling is
+    // reachable (hasReachableControlSibling, not merely connected): a reap is a write, and a
+    // write committed alone is local-only and forks this node's own history, which is the
+    // condition this work exists to stop creating
     // (tickets/blocked/forked-control-collection-sync-livelocks.md). Nothing is urgent
     // here — the stale row already reads as absent everywhere — so waiting for
     // connectivity costs nothing and keeps the reap fork-CLOSING rather than
@@ -3888,7 +4190,7 @@ export class CadreNode implements SAppIdLookup {
     // avoid. Bounded by how long a sweep runs, which is bounded by the backlog of
     // unreaped rows (0 in steady state). If that backlog can ever be large, move the
     // check inside reapRevokedRows' loop via an injected predicate.
-    if (this.getControlConnectionCount() > 0) {
+    if (this.hasReachableControlSibling()) {
       try {
         const reaped = await this.controlDatabase.reapRevokedRows(selfPeerId);
         if (reaped > 0) {
@@ -3900,41 +4202,22 @@ export class CadreNode implements SAppIdLookup {
         log('reconcileControlCohort: reap pass failed (continuing): %o', error);
       }
       if (!this._running || !this.controlNode || !this.controlDatabase) {
-        return { dialed: [] };
-      }
-
-      // File the Revocation ledger marker once, so that table stops being a never-written
-      // block, which the storage layer re-checks with the cohort on every read (and every
-      // membership lookup and guarded insert reads it). Connected-only for the reap's
-      // reason above: a marker committed alone is local-only, and one filed by a
-      // disconnected owner while another machine creates the same collection is exactly
-      // that fork. Owner-only, and at most once per process — see openRevocationLedgerIfDue.
-      //
-      // NOTE: accepted tradeoff — a solo founder does not file the marker until it holds a
-      // control connection (normally its first sibling; a relay or bootstrap connection also
-      // counts — see getControlConnectionCount — and is the reap's same residual), so until
-      // then it keeps paying one local findCluster per read of
-      // the missing Revocation block (0.009 ms each, measured upstream; no network work on
-      // a cohort of one). Fork safety weighed over that and kept; revisit if findCluster
-      // ever shows up as material in a device profile, or if a solo-founding marker can be
-      // made fork-safe (e.g. filed inside the genesis transaction, before any other machine
-      // can hold the party's collections).
-      await this.openRevocationLedgerIfDue();
-      if (!this._running || !this.controlNode || !this.controlDatabase) {
-        return { dialed: [] };
+        return { dialed: [], unconnected: false };
       }
 
       // Publish this machine's unpublished cross-party joins party-wide and remove the rows a
-      // self-revocation queued (JoinedStrandSession.syncWithParty). Connected-only for the
-      // reap's reason above; owner-only by the session's own signer check. Nothing is urgent:
-      // a join reaches the party within one pass of this machine being connected.
+      // self-revocation queued (JoinedStrandSession.syncWithParty). Behind the reap's gate,
+      // for its reason; owner-only by the session's own signer check. Nothing is urgent:
+      // a join recorded locally starts no pass, so it reaches the party on the next pass
+      // while a sibling is reachable — a membership change, a sibling connecting, or the
+      // backstop, 2 minutes at most.
       try {
         await this.joinedStrands?.syncWithParty();
       } catch (error) {
         log('reconcileControlCohort: joined-strand sync failed (retrying next pass): %o', error);
       }
       if (!this._running || !this.controlNode || !this.controlDatabase) {
-        return { dialed: [] };
+        return { dialed: [], unconnected: false };
       }
     }
 
@@ -3949,11 +4232,11 @@ export class CadreNode implements SAppIdLookup {
       // because filling this table needs a connection and getting a connection
       // needs this table. Fall back to the seed's bootstrap addresses; a solo
       // cadre has none and this is a no-op. Must not throw or busy-loop.
-      return { dialed: await this.dialColdStartBootstrap() };
+      return this.dialColdStartBootstrap();
     }
     // Re-guard after the await: a stop() may have raced the membership read.
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return { dialed: [] };
+      return { dialed: [], unconnected: false };
     }
 
     // 2. Classify backbone (always-on) members and select a bounded dial set.
@@ -3970,54 +4253,34 @@ export class CadreNode implements SAppIdLookup {
     //    keeping what resolved for the dial loop below.
     const resolved = await this.warmSiblingAddrBook(siblings);
     if (!this._running || !this.controlNode || !this.controlDatabase) {
-      return { dialed: [] };
+      return { dialed: [], unconnected: false };
     }
 
     // 4. Skip already-connected peers (no re-dial / churn for live connections).
     const connected = new Set(this.controlNode.getConnections().map((c) => c.remotePeer.toString()));
 
     // 5. Dial each selected, not-yet-connected sibling, best-effort, from the
-    //    addresses step 3 already resolved for it.
+    //    addresses step 3 already resolved for it. A failed dial earns the pass a
+    //    redial wake (armReconcileWake); a sibling with nothing to dial does not.
     const dialed: string[] = [];
+    let unconnected = false;
     for (const sibling of dials) {
       if (!this._running || !this.controlNode) {
-        return { dialed };
+        return { dialed, unconnected: false };
       }
       if (connected.has(sibling.peerId)) {
         continue;
       }
-      if (await this.dialControlSibling(sibling, resolved.get(sibling.peerId) ?? [])) {
+      const outcome = await this.dialControlSibling(sibling, resolved.get(sibling.peerId) ?? []);
+      if (outcome === 'connected') {
         dialed.push(sibling.peerId);
+      } else if (outcome === 'failed') {
+        unconnected = true;
       }
     }
-    log('reconcileControlCohort: pass complete (siblings=%d, selected=%d, dialed=%d)',
-      siblings.length, dials.length, dialed.length);
-    return { dialed };
-  }
-
-  /**
-   * The owner-only half of the reconcile pass's ledger-marker step: file the singleton
-   * `Revocation` marker ({@link SeedBootstrapService.openRevocationLedger}) unless this
-   * process has already seen it filed. The connectivity gate is the caller's
-   * ({@link runReconcileControlCohort}); why the marker exists is on
-   * {@link ControlDatabase.openRevocationLedger}.
-   *
-   * Sets {@link revocationLedgerOpened} on `'opened'` or `'already-open'`. A node that
-   * cannot sign as an owner does nothing: it picks the owner's marker up the first time it
-   * reads the table, like any other replicated row. Best-effort like every step of the
-   * pass — a failure is logged and leaves the flag clear, so the next connected pass retries.
-   */
-  private async openRevocationLedgerIfDue(): Promise<void> {
-    if (this.revocationLedgerOpened || !this.seedBootstrapService?.canAuthorize()) {
-      return;
-    }
-    try {
-      const outcome = await this.seedBootstrapService.openRevocationLedger();
-      this.revocationLedgerOpened = true;
-      log('reconcileControlCohort: revocation ledger marker %s', outcome);
-    } catch (error) {
-      log('reconcileControlCohort: filing the revocation ledger marker failed (retrying next pass): %o', error);
-    }
+    log('reconcileControlCohort: pass complete (siblings=%d, selected=%d, dialed=%d, unconnected=%s)',
+      siblings.length, dials.length, dialed.length, unconnected);
+    return { dialed, unconnected };
   }
 
   /**
@@ -4043,8 +4306,9 @@ export class CadreNode implements SAppIdLookup {
    * current ({@link refreshDialHint}).
    *
    * NOTE: this resolves EVERY sibling serially before the dial loop below runs,
-   * so it costs one record query per sibling per reconcile pass (~15s) and each
-   * one delays the pass's first dial. A cadre is a handful of devices, so today
+   * so it costs one record query per sibling per reconcile pass (served from the
+   * membership rows view while it is current) and each one delays the pass's first
+   * dial. A cadre is a handful of devices, so today
    * that is a few extra local reads; if cadres ever grow large, batch the records
    * into one query, merge only on change, or move the warm pass after the dials.
    */
@@ -4180,26 +4444,28 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Dial one sibling from its already-resolved addresses, best-effort. Returns
-   * whether the dial resolved (false when no address resolves or the dial fails).
+   * Dial one sibling from its already-resolved addresses, best-effort.
    *
    * A per-peer failure (NAT, offline, relay down, connection-gater denial, or
    * the {@link controlDialBudget} expiring) is logged and swallowed so one
    * unreachable sibling never aborts the pass — exactly like
    * {@link SeedBootstrapService.applySeed}'s owner-dial loop. A failed dial is
-   * simply retried on the next pass. A sibling whose every address relays
-   * through this node ({@link SelfRelayOnlyError}) is not dialed at all and gets
-   * a one-line log instead: only the sibling can reconnect.
-   */
-  private async dialControlSibling(sibling: CohortPeerRow, resolved: Multiaddr[]): Promise<boolean> {
+   * retried on the pass's redial ladder ({@link armReconcileWake}: 15 s, 30 s, 60 s,
+   * then every backstop) and on any pass a change starts sooner. A sibling with no
+   * dialable address, or whose every address relays through this node
+   * ({@link SelfRelayOnlyError}), is not dialed at all and is `undialable`: it gets a
+   * one-line log and no redial, since only a change — its record replicating in, or
+   * the sibling connecting — can make it dialable, and each of those starts a pass.
+   */
+  private async dialControlSibling(sibling: CohortPeerRow, resolved: Multiaddr[]): Promise<SiblingDialOutcome> {
     const controlNode = this.controlNode;
     if (!controlNode) {
-      return false;
+      return 'undialable';
     }
     const addrs = await this.resolveControlDialAddrs(sibling.peerId, resolved);
     if (addrs.length === 0) {
       log('reconcileControlCohort: no dialable control address for sibling %s; skipping', sibling.peerId);
-      return false;
+      return 'undialable';
     }
     try {
       log('reconcileControlCohort: dialing sibling %s (%d addr(s))', sibling.peerId, addrs.length);
@@ -4210,14 +4476,14 @@ export class CadreNode implements SAppIdLookup {
         this.controlDialBudget(),
         `reconcileControlCohort dial of sibling ${sibling.peerId}`
       );
-      return true;
+      return 'connected';
     } catch (error) {
       if (error instanceof SelfRelayOnlyError) {
         log('reconcileControlCohort: sibling %s is reachable only by relaying through this node; waiting for it to reconnect', sibling.peerId);
-      } else {
-        log('reconcileControlCohort: dial of sibling %s failed (continuing): %o', sibling.peerId, error);
+        return 'undialable';
       }
-      return false;
+      log('reconcileControlCohort: dial of sibling %s failed (continuing): %o', sibling.peerId, error);
+      return 'failed';
     }
   }
 
@@ -4272,7 +4538,7 @@ export class CadreNode implements SAppIdLookup {
    * These addresses are never merged into the libp2p address book: they are
    * unverified, and the address book takes only verified ones (see
    * `mergePeerAddrs`). Layers that dial by bare peer id use the connection this
-   * dial opens, and after it drops the next reconcile pass dials again.
+   * dial opens, and after it drops the reconcile pass the close starts dials again.
    *
    * NOTE: an entry is consulted here only for a current sibling, so a peer revoked
    * by another owner is not dialed from it, even though the entry stays (only this
@@ -4327,8 +4593,7 @@ export class CadreNode implements SAppIdLookup {
    * Called for every seed this node accepts, on BOTH intake paths — the
    * {@link applySeed} wrapper (which may run on a throwaway service, so the
    * service itself is the wrong place to keep this) and the inbound
-   * `/sereus/seed/1.0.0` handler via `onSeedApplied`. Peers with no address are
-   * skipped: there is nothing to dial.
+   * `/sereus/seed/1.0.0` handler via `onSeedApplied`.
    *
    * `preferred` is the seed's own claim about its peers, exactly as
    * `SeedBootstrapService.applySeed` uses it to choose its dial targets. That is
@@ -4336,14 +4601,15 @@ export class CadreNode implements SAppIdLookup {
    * signature-checked against a trust-anchored signer before this runs, and the
    * flag only *selects a dial target*; a dial grants no authority.
    *
-   * Addressless peers and self are skipped by {@link retainDialTarget}.
+   * The peers retained are `seedDialTargets` (addressless peers and self dropped), the same
+   * ones the service dials; they are returned for the `seed:applied` payload.
    */
-  private recordSeedBootstrapPeers(seed: ControlNetworkSeed): void {
-    for (const peer of seed.peers) {
-      if (peer.preferred) {
-        this.retainDialTarget(peer.peerId, peer.multiaddrs, 'recordSeedBootstrapPeers');
-      }
+  private recordSeedBootstrapPeers(seed: ControlNetworkSeed): SeedDialTarget[] {
+    const targets = seedDialTargets(seed, this.controlNode?.peerId.toString());
+    for (const { peerId, multiaddrs } of targets) {
+      this.retainDialTarget(peerId, multiaddrs, 'recordSeedBootstrapPeers');
     }
+    return targets;
   }
 
   /**
@@ -4358,9 +4624,8 @@ export class CadreNode implements SAppIdLookup {
    * failing a seed or an add that has already been accepted.
    *
    * Two peers are never retained. One with no address: there is nothing to dial.
-   * And self: `createSeed` projects EVERY `CadrePeer` row, so an owner that applies
-   * a seed minted after it joined finds itself in the owner list, and `addDrone`
-   * could be handed this node's own id. Retaining self would make the cold-start
+   * And self: `addDrone` could be handed this node's own id (seed intake arrives
+   * already filtered by `seedDialTargets`). Retaining self would make the cold-start
    * pass dial this node forever (the steady-state pass filters self out of its
    * sibling list for the same reason).
    */
@@ -4395,33 +4660,35 @@ export class CadreNode implements SAppIdLookup {
    * help: it dials only siblings enumerated from that very table. Retrying here
    * is the only way back in.
    *
-   * Unbounded, at the reconcile cadence, with no backoff: the branch is already
-   * gated by "the control database has no siblings", so it stops the moment the
-   * node is actually in the party, and a node that is stranded MUST keep trying —
-   * a give-up rule would turn a transient outage into a permanent one. The steady
-   * cost is one dial per bootstrap peer per pass (a seed prefers its minter and the
-   * party's always-on machines, a few at most), each failing fast against an
-   * unreachable address.
-   * NOTE: if seeds ever carry many preferred peers, or the reconcile cadence tightens
-   * well below its 15 s default, add per-peer backoff here.
+   * Unbounded: the branch is already gated by "the control database has no
+   * siblings", so it stops the moment the node is actually in the party, and a node
+   * that is stranded MUST keep trying — a give-up rule would turn a transient outage
+   * into a permanent one. A failed dial earns the pass a redial wake on the ladder
+   * {@link armReconcileWake} runs (15 s, 30 s, 60 s, then every backstop, 2 minutes
+   * by default), so the steady cost is one dial per bootstrap peer per backstop (a
+   * seed prefers its minter and the party's always-on machines, a few at most), each
+   * failing fast against an unreachable address.
+   * NOTE: the ladder is per pass, not per peer; if seeds ever carry many preferred
+   * peers, add per-peer backoff here.
    *
    * Best-effort per peer, exactly like {@link dialControlSibling}: one dead
    * address never aborts the pass.
    */
-  private async dialColdStartBootstrap(): Promise<string[]> {
+  private async dialColdStartBootstrap(): Promise<ControlCohortPassOutcome> {
     const controlNode = this.controlNode;
     // Snapshot up front: the store hands back a copy, so a seed applied mid-pass
     // cannot mutate what we are iterating.
     const targets = this.bootstrapPeerStore?.all();
     if (!controlNode || !targets || targets.size === 0) {
-      return [];
+      return { dialed: [], unconnected: false };
     }
     // Same skip rule as step 3 of the steady-state pass: no churn on live links.
     const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
     const dialed: string[] = [];
+    let unconnected = false;
     for (const [peerId, entry] of targets) {
       if (!this._running || !this.controlNode) {
-        return dialed;
+        return { dialed, unconnected: false };
       }
       // NOTE: a connection this node still holds in `status: 'open'` after the remote
       // has already aborted it counts as connected here, so the cold-start retry stays
@@ -4435,11 +4702,13 @@ export class CadreNode implements SAppIdLookup {
       }
       if (await this.dialBootstrapPeer(peerId, entry.addrs)) {
         dialed.push(peerId);
+      } else {
+        unconnected = true;
       }
     }
-    log('reconcileControlCohort: cold-start pass complete (bootstrap=%d, connected=%d, dialed=%d)',
-      targets.size, connected.size, dialed.length);
-    return dialed;
+    log('reconcileControlCohort: cold-start pass complete (bootstrap=%d, connected=%d, dialed=%d, unconnected=%s)',
+      targets.size, connected.size, dialed.length, unconnected);
+    return { dialed, unconnected };
   }
 
   /**
@@ -4458,32 +4727,36 @@ export class CadreNode implements SAppIdLookup {
     return this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId);
   }
 
-  /** Dial one cold-start bootstrap peer, best-effort. Returns whether it connected. */
-  private async dialBootstrapPeer(peerId: string, addrs: string[]): Promise<boolean> {
+  /**
+   * Dial one peer from its retained dial target's addresses, best-effort: a cold-start bootstrap
+   * peer, or a just-claimed node ({@link redialClaimedNode}), which `context` names in the logs.
+   * Returns whether it connected.
+   */
+  private async dialBootstrapPeer(peerId: string, addrs: string[], context = 'reconcileControlCohort(cold-start)'): Promise<boolean> {
     const controlNode = this.controlNode;
     if (!controlNode) {
       return false;
     }
     const parsed = this.bootstrapDialAddrs(peerId, addrs);
     if (parsed.length === 0) {
-      log('reconcileControlCohort(cold-start): no dialable address for bootstrap peer %s; skipping', peerId);
+      log('%s: no dialable address for bootstrap peer %s; skipping', context, peerId);
       return false;
     }
     try {
-      log('reconcileControlCohort(cold-start): dialing bootstrap peer %s (%d addr(s))', peerId, parsed.length);
+      log('%s: dialing bootstrap peer %s (%d addr(s))', context, peerId, parsed.length);
       await dialPeerAddrs(
         controlNode,
         peerId,
         parsed,
         this.controlDialBudget(),
-        `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`
+        `${context} dial of bootstrap peer ${peerId}`
       );
       return true;
     } catch (error) {
       if (error instanceof SelfRelayOnlyError) {
-        log('reconcileControlCohort(cold-start): bootstrap peer %s is reachable only by relaying through this node; waiting for it to reconnect', peerId);
+        log('%s: bootstrap peer %s is reachable only by relaying through this node; waiting for it to reconnect', context, peerId);
       } else {
-        log('reconcileControlCohort(cold-start): dial of bootstrap peer %s failed (continuing): %o', peerId, error);
+        log('%s: dial of bootstrap peer %s failed (continuing): %o', context, peerId, error);
       }
       return false;
     }
@@ -4494,32 +4767,34 @@ export class CadreNode implements SAppIdLookup {
   //
   // Optimystic's coordinator commits a control write WITHOUT broadcasting when the
   // block's cluster has ≤1 member. An owner that authorizes/removes a peer or
-  // (re)publishes its own record while no sibling is connected therefore writes a
+  // (re)publishes its own record while no sibling is reachable therefore writes a
   // row that exists ONLY in its local control DB — a sibling that connects later
   // never observes it (pull-on-read routes to the block's cluster, which never
   // learned of the write). reconcileControlCohort shrinks the alone window but
-  // cannot close it (a write in the instant before any sibling connects is still
-  // local-only). The remedy: detect "wrote while alone" (0 connections is a sound
-  // lower bound), queue the affected row, and RE-ISSUE the write once the cohort
-  // grows (0→≥1 connection), as an idempotent monotonic update that now broadcasts.
+  // cannot close it (a write in the instant before any sibling identifies is still
+  // local-only). The remedy: detect "wrote while alone" (no identified sibling the
+  // cohort would admit: committedAlone), queue the affected row, and RE-ISSUE the write
+  // once one is reachable, as an idempotent monotonic update that now broadcasts.
   // See docs/architecture.md (Control Network Convergence → "Writes made while alone").
   // ============================================================================
 
   /**
-   * Whether a control write happening now would commit local-only. A sound lower
-   * bound is "no connected control peers": 0 connections ⇒ the block's cluster is
-   * ≤1 ⇒ Optimystic commits without broadcasting. This is the pragmatic proxy for
-   * the precise signal (the block's `getClusterSize`); it over-approximates safely
-   * — a connected-but-not-in-this-block's-cluster write may still be local-only and
-   * is caught by the cohort's periodic pull-on-read instead. Re-issuing an already-
-   * replicated row is harmless (an idempotent monotonic bump), so the coarse proxy
-   * is acceptable as the agreed first cut.
+   * Whether a control write happening now would commit local-only: no sibling is reachable
+   * ({@link hasReachableControlSibling}, the public form, so the two cannot drift). A relay, a
+   * bootstrap node or a peer that has not identified yet holds a connection without being in the
+   * write's cohort, so a write made with only those connected is queued too. One made alone at
+   * the revision the cohort reached meanwhile is a fork no later consult sees, because a consult
+   * compares revision numbers only; the re-issue on the growth edge is what conflicts with the
+   * cohort's copy and pulls it in.
    *
-   * Reads {@link getControlConnectionCount} — the public, embedder-facing form of
-   * the same sample — so the two cannot drift.
+   * Still a proxy for the precise signal (the block's own cohort): a reachable sibling outside
+   * this block's cohort leaves the write local-only, caught by the cohort's pull-on-read. On the
+   * control network every block's cohort is the whole party, so that gap is a party larger than
+   * `CONTROL_REPLICATION_BREADTH`. Re-issuing a replicated row is harmless (an idempotent
+   * monotonic bump).
    */
   private committedAlone(): boolean {
-    return this.getControlConnectionCount() === 0;
+    return !this.hasReachableControlSibling();
   }
 
   /**
@@ -4576,7 +4851,7 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Drain the write-while-alone re-replication queue: re-issue the writes that
    * committed local-only now that the cohort can broadcast them. Public so the
-   * 0→≥1 growth trigger ({@link handleControlConnectionChange}) and tests can drive
+   * growth trigger ({@link updateControlSiblingReachability}) and tests can drive
    * it; concurrent calls collapse into one in-flight drain
    * ({@link drainControlReplicationInFlight}) so two growth signals never
    * double-issue. Best-effort throughout — a per-row failure leaves that entry
@@ -4618,13 +4893,15 @@ export class CadreNode implements SAppIdLookup {
     //    periodic-refresh property.
     await this.drainPendingRevocations();
 
-    // 2. Self rows. On the first growth always re-touch (covers a self row carried
-    //    over from a prior process that committed local-only before this start);
-    //    afterwards only when a self-write-while-alone was recorded this session.
+    // 2. Self rows. A self write made while alone is always re-touched: the re-touch
+    //    is what carries it to the cohort. Otherwise the first growth re-touches a row
+    //    a prior process may have committed local-only, unless the row already holds a
+    //    current record this process signed (a redeemed invitation's admission).
     //    registerSelf is idempotent + single-flight, so this never races a
     //    duplicate publish with the heartbeat republish.
     if (firstGrowth || this.pendingSelfPeerWrite) {
-      await this.registerSelf().catch((error) => log('drain: registerSelf failed: %o', error));
+      const publish = this.pendingSelfPeerWrite ? this.registerSelf() : this.publishSelfRecordUnlessCurrent();
+      await publish.catch((error) => log('drain: registerSelf failed: %o', error));
       this.pendingSelfPeerWrite = false;
     }
     if (firstGrowth || this.pendingSelfDeviceWrite) {
@@ -4782,8 +5059,11 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Body of {@link reconstructAuthoredMembership}'s sweep: re-issue each candidate
-   * owner-authored row, returning how many were re-touched. A per-row failure is
-   * logged and skipped; a teardown mid-sweep stops it.
+   * owner-authored row, returning how many were re-touched. A row the sweep already holds as
+   * self-published is skipped without a call; the re-touch itself decides again over the row
+   * it reads under the lock, so a row that vanished or was self-published since the sweep's
+   * read is reported, not written. A per-row failure is logged and skipped; a teardown
+   * mid-sweep stops it.
    */
   private async reissueAuthoredMembershipRows(selfPeerId: string, members: CadrePeerRow[]): Promise<number> {
     let touched = 0;
@@ -4791,17 +5071,15 @@ export class CadreNode implements SAppIdLookup {
       if (!this._running || !this.controlNode || !this.controlDatabase) {
         return touched;
       }
-      if (member.peerId === selfPeerId || this.pendingPeerWrites.has(member.peerId)) {
+      // Self, queued for the drain (step 4 re-touches it once), or peer-owned (self-Sig
+      // present) → not this sweep's to bump.
+      if (member.peerId === selfPeerId || this.pendingPeerWrites.has(member.peerId) || member.sig) {
         continue;
       }
       try {
-        const record = await this.controlDatabase.queryPeerRecord(member.peerId);
-        // Missing (raced a delete) or peer-owned (self-Sig present) → not ours to bump.
-        if (!record || record.sig) {
-          continue;
+        if (await this.reissuePeerAuthorize(member.peerId) === 'retouched') {
+          touched++;
         }
-        await this.reissuePeerAuthorize(member.peerId, record.updatedAt);
-        touched++;
       } catch (error) {
         log('drain: reconstruction re-touch of %s failed (continuing): %o', member.peerId, error);
       }
@@ -4836,9 +5114,10 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Body of {@link drainPendingPeerWrites}' loop. An entry is cleared only on
-   * success (or when there is nothing left to re-issue); a failure is logged and
-   * the entry stays queued for the next cohort growth.
+   * Body of {@link drainPendingPeerWrites}' loop. An entry is cleared on every outcome the
+   * re-touch reports — re-touched, or nothing left to re-issue because the row was removed
+   * since or the peer self-published; the re-touch decides which over the row it reads under
+   * the lock. A failure is logged and the entry stays queued for the next cohort growth.
    */
   private async reissuePendingPeerWrites(): Promise<void> {
     for (const peerId of [...this.pendingPeerWrites.keys()]) {
@@ -4846,13 +5125,8 @@ export class CadreNode implements SAppIdLookup {
         return;
       }
       try {
-        const record = await this.controlDatabase.queryPeerRecord(peerId);
-        if (!record || record.sig) {
-          // Removed since, or peer self-published — nothing for the owner to re-issue.
-          this.pendingPeerWrites.delete(peerId);
-          continue;
-        }
-        await this.reissuePeerAuthorize(peerId, record.updatedAt);
+        const outcome = await this.reissuePeerAuthorize(peerId);
+        log('drain: re-issue of %s (authorize): %s', peerId, outcome);
         this.pendingPeerWrites.delete(peerId);
       } catch (error) {
         log('drain: re-issue of %s (authorize) failed; leaving queued for next growth: %o', peerId, error);
@@ -4865,60 +5139,202 @@ export class CadreNode implements SAppIdLookup {
    * `UpdatedAt` strictly above the stored value (and the wall clock) and re-sign via
    * the owner branch of `CadrePeer.AuthorizedUpdate`. The row already exists
    * locally (it committed there, just local-only), so this is an UPDATE, not the
-   * original INSERT.
+   * original INSERT. The bump, and whether the row is still the owner's to re-issue, are
+   * decided over the row as read inside the write ({@link SeedBootstrapService.reauthorizePeer}'s
+   * re-broadcast mode).
    */
-  private async reissuePeerAuthorize(peerId: string, currentUpdatedAt: number): Promise<void> {
+  private async reissuePeerAuthorize(peerId: string): Promise<CadrePeerRetouchOutcome> {
     if (!this.seedBootstrapService) {
-      return;
+      throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
-    const updatedAt = Math.max(Date.now(), (currentUpdatedAt ?? 0) + 1);
-    await this.seedBootstrapService.reauthorizePeer(peerId, updatedAt);
+    return await this.seedBootstrapService.reauthorizePeer(peerId, 'rebroadcast');
   }
 
   /**
-   * On a control connection opening, detect the 0→≥1 transition and drain the
-   * write-while-alone re-replication queue (single-flight; fires only on the edge,
-   * not on every subsequent `connection:open`). Best-effort — a drain failure is
-   * logged, not thrown.
+   * Re-evaluate {@link hasReachableControlSibling} and act on its edges: on false→true, drain
+   * the write-while-alone re-replication queue (single-flight; best-effort, a drain failure is
+   * logged, not thrown); on true→false, re-arm, so the next reachable sibling drains again.
+   * Called when a peer identifies, when a connection closes, and after every membership refresh,
+   * where a sibling that connected before this node authorized it (the production join order)
+   * becomes reachable. A device counted in for its admission ({@link admittingDevices}) is not
+   * a trigger: the admission's own writes are in flight, and its row landing refreshes
+   * membership.
    */
-  private handleControlConnectionChange(): void {
+  private updateControlSiblingReachability(): void {
     if (!this._running || !this.controlNode) {
       return;
     }
-    const connected = this.controlNode.getConnections().length > 0;
-    if (!connected || this.hasControlConnection) {
+    const reachable = this.hasReachableControlSibling();
+    if (reachable === this.controlSiblingReachable) {
+      return;
+    }
+    this.controlSiblingReachable = reachable;
+    if (!reachable) {
       return;
     }
-    this.hasControlConnection = true;
-    log('Control cohort grew (0 → ≥1 connection); draining write-while-alone re-replication queue');
-    void this.drainPendingControlReplication('connection:open')
-      .catch((error) => log('Control re-replication drain (connection:open) failed: %o', error));
+    log('Control cohort grew (a sibling is reachable); draining write-while-alone re-replication queue');
+    void this.drainPendingControlReplication('sibling-reachable')
+      .catch((error) => log('Control re-replication drain (sibling-reachable) failed: %o', error));
   }
 
-  /** Re-arm the growth edge once all control connections drop, so a later reconnect re-drains. */
-  private handleControlConnectionClose(): void {
-    if (!this.controlNode) {
+  /**
+   * A connected peer identified as serving the control database: count it
+   * ({@link identifiedControlPeers}), re-evaluate the growth edge, and run the sibling-open
+   * reactions, once per connected period. libp2p re-emits `peer:identify` on every
+   * identify-push from a connected peer, and those repeats start nothing.
+   */
+  private onControlPeerIdentified(peerId: PeerId): void {
+    const id = peerId.toString();
+    // An identify that reports after its connection closed counts nobody.
+    if (this.identifiedControlPeers.has(id) || !this.controlNode || this.controlNode.getConnections(peerId).length === 0) {
+      return;
+    }
+    this.identifiedControlPeers.add(id);
+    this.updateControlSiblingReachability();
+    this.onControlSiblingConnectionChange(id, 'open');
+  }
+
+  /**
+   * A control connection closed: `remotePeer` stops counting once it has none left, and the
+   * growth edge re-arms if no reachable sibling remains. The sibling-close reaction runs on every
+   * close. libp2p's connection manager drops the closed connection from `getConnections` before
+   * this listener runs: libp2p dispatches each event on its internal bus, where the connection
+   * manager listens, before re-dispatching it to the node's own listeners.
+   */
+  private onControlConnectionClosed(remotePeer: PeerId): void {
+    const id = remotePeer.toString();
+    if (!this.controlNode || this.controlNode.getConnections(remotePeer).length === 0) {
+      this.identifiedControlPeers.delete(id);
+    }
+    this.updateControlSiblingReachability();
+    this.onControlSiblingConnectionChange(id, 'close');
+  }
+
+  /**
+   * Count the peers that identified before {@link wireControlConnectionListeners} ran, whose
+   * `peer:identify` has already fired, from their peer-store records. Updates the growth edge
+   * but runs no sibling-open reaction, as a connection that predates the listeners never did. A
+   * peer not yet in the peer store is still identifying, and its own event counts it.
+   */
+  private async noteIdentifiedControlPeers(): Promise<void> {
+    const node = this.controlNode;
+    if (!node) {
       return;
     }
-    if (this.controlNode.getConnections().length === 0) {
-      this.hasControlConnection = false;
+    const connected = new Map<string, PeerId>();
+    for (const connection of node.getConnections()) {
+      connected.set(connection.remotePeer.toString(), connection.remotePeer);
+    }
+    const partyId = this.config.controlNetwork.partyId;
+    await Promise.all([...connected.values()].map(async (peerId) => {
+      try {
+        const { protocols } = await node.peerStore.get(peerId);
+        // Still wired to this node: a stop while the read was out cleared the set.
+        const wired = this.controlPeerIdentifyHandler !== null && this.controlNode === node;
+        if (wired && servesControlDatabase(partyId, protocols) && node.getConnections(peerId).length > 0) {
+          this.identifiedControlPeers.add(peerId.toString());
+        }
+      } catch (error) {
+        if ((error as Error).name !== 'NotFoundError') {
+          log('Peer store read for connected control peer %s failed — left to its identify: %o', peerId.toString(), error);
+        }
+      }
+    }));
+    this.updateControlSiblingReachability();
+  }
+
+  /**
+   * An AUTHORIZED sibling became reachable (its identify, once per connected period:
+   * {@link onControlPeerIdentified}) or one of its connections closed: start a reconcile
+   * pass. On open the pass asks the new sibling for strand addresses and re-arms the
+   * delegate grants; on close it re-dials. First, on open, drop the membership rows
+   * views: a machine that was offline while a sibling committed learns of the commit
+   * only when it next reads the block from storage, and dropping the views makes the
+   * pass's reads do that now rather than after the views' maximum age. Those reads can
+   * fall inside the read-repair window, so the open also arms a second drop past it
+   * ({@link armMembershipViewReload}). Any other
+   * peer — a relay, a bootstrap node, another party's machine — starts nothing.
+   *
+   * On identify rather than `connection:open` because, until the sibling identifies,
+   * Optimystic's cohort for every control block is this node alone: a pass started at the
+   * open writes (the first self-record publish) and reads on a cohort of one.
+   */
+  private onControlSiblingConnectionChange(remotePeer: string, change: 'open' | 'close'): void {
+    if (!this.authorizedControlPeers.has(remotePeer)) {
+      return;
     }
+    if (change === 'open') {
+      // NOTE: a machine removed from the cadre that has not learned of it keeps redialing
+      // its siblings, each of which admits it provisionally and hangs up at the deadline
+      // (28.5 s at the default link), and every such open drops the views here and once
+      // more past the read-repair window: two storage reloads, with their cohort consults
+      // refused, per cycle until it learns. If a removed machine's churn ever shows up,
+      // skip both drops for a peer whose previous connection the remote closed inside the
+      // provisional deadline.
+      this.controlDatabase?.invalidateMembershipViews();
+      this.armMembershipViewReload();
+    }
+    // NOTE: a close starts a pass at once, and a sibling in its bring-up quiet period lets the
+    // dial resolve and then drops the connection (`createMembershipConnectionGater`'s deny
+    // timing), so a restarting sibling costs one dial-connect-close pass after another for its
+    // whole bring-up (5-6 passes in ~200 ms against a claimed node restarting locally). If a
+    // slow device's bring-up ever makes that churn show up, delay the pass a close starts when
+    // the previous connection to that sibling lived only a few milliseconds.
+    log('Control connection to sibling %s %s; reconcile pass triggered', remotePeer, change);
+    this.controlReconcileRuns?.trigger(0);
+  }
+
+  /**
+   * Drop the membership views again {@link MEMBERSHIP_VIEW_RECONNECT_RELOAD_MS} after a
+   * sibling connects, and start a pass whose reads reload them. This node's reads before
+   * the connection stamped Optimystic's read-repair window on the control blocks, so the
+   * reload the open itself starts is served from the local copy with no cohort consult,
+   * and the view would keep rows that predate the sibling's commits until its maximum age.
+   * The reload past the window starts the consults; one that brings a newer revision
+   * raises the table change that drops the view and refreshes the gate. Re-armed by every
+   * open, so it runs one window after the latest.
+   *
+   * NOTE: a consult Optimystic defers (16 already in flight) starts nothing and leaves the block
+   * unstamped, so the view keeps its rows until the first read past its maximum age, which on an
+   * idle node is the reconcile backstop. If `cluster-tx:read-repair-deferred` lines show at a
+   * reconnect, re-arm this reload once more instead of waiting for the backstop.
+   */
+  private armMembershipViewReload(): void {
+    if (this.membershipViewReloadTimer) {
+      clearTimeout(this.membershipViewReloadTimer);
+    }
+    this.membershipViewReloadTimer = setTimeout(() => {
+      this.membershipViewReloadTimer = null;
+      log('Read-repair window passed since a sibling connected; reloading the membership views');
+      this.controlDatabase?.invalidateMembershipViews();
+      this.controlReconcileRuns?.trigger(0);
+    }, MEMBERSHIP_VIEW_RECONNECT_RELOAD_MS);
+    // Node-only: don't keep the event loop alive solely for this timer.
+    (this.membershipViewReloadTimer as { unref?: () => void } | null)?.unref?.();
   }
 
   /**
-   * Wire the control-connection growth listeners that drive write-while-alone
-   * re-replication. Wired in {@link start} (not the delayed refresh path) so no
-   * early `connection:open` is missed; torn down in {@link stopRecordRefresh}.
-   * Idempotent.
+   * Wire the control-connection listeners, which keep {@link identifiedControlPeers}: the
+   * growth edge that drives write-while-alone re-replication, and the sibling reconcile
+   * trigger ({@link onControlSiblingConnectionChange}). Wired in {@link start} (not the
+   * delayed refresh path) so no early identify is missed, and reads back the peers that
+   * identified before it ran ({@link noteIdentifiedControlPeers}); torn down in
+   * {@link stopRecordRefresh}. Idempotent.
    */
   private wireControlConnectionListeners(): void {
-    if (!this.controlNode || this.controlConnectionOpenHandler) {
+    if (!this.controlNode || this.controlPeerIdentifyHandler) {
       return;
     }
-    this.controlConnectionOpenHandler = () => this.handleControlConnectionChange();
-    this.controlConnectionCloseHandler = () => this.handleControlConnectionClose();
-    this.controlNode.addEventListener('connection:open', this.controlConnectionOpenHandler);
+    const partyId = this.config.controlNetwork.partyId;
+    this.controlPeerIdentifyHandler = (event) => {
+      if (servesControlDatabase(partyId, event.detail.protocols)) {
+        this.onControlPeerIdentified(event.detail.peerId);
+      }
+    };
+    this.controlConnectionCloseHandler = (event) => this.onControlConnectionClosed(event.detail.remotePeer);
+    this.controlNode.addEventListener('peer:identify', this.controlPeerIdentifyHandler);
     this.controlNode.addEventListener('connection:close', this.controlConnectionCloseHandler);
+    void this.noteIdentifiedControlPeers();
   }
 
   // ============================================================================
@@ -5249,6 +5665,7 @@ export class CadreNode implements SAppIdLookup {
       if (sAppId !== undefined) {
         this.replicaSAppIds.set(strandId, sAppId);
         log('Storage replica %s serves sApp %s', strandId, sAppId);
+        this.strandWatcher?.sAppIdLearned(strandId);
       }
     } catch (error) {
       log('Could not read the sApp id of storage replica %s (left unknown): %o', strandId, error);
@@ -5371,6 +5788,7 @@ export class CadreNode implements SAppIdLookup {
     this.strandLaunchRefusals.clear();
     this.discoveredStrands.clear();
     this.replicaSAppIds.clear();
+    this.formedPartyKeys.clear();
 
     // Drop delegate-admission state: the grants are scoped to the session that
     // recorded them, so a stop()/start() cycle on this object must not keep
@@ -5394,6 +5812,10 @@ export class CadreNode implements SAppIdLookup {
     // Detach the membership hub first: nothing this teardown does should drive a
     // gate refresh, and a notification arriving after this point is a no-op.
     if (this.controlDatabase) {
+      // The database's registry would dispose the gate watch too; disposing it here, before
+      // the listener goes, keeps a closing commit from scheduling a gate refresh.
+      this.membershipGateWatch?.dispose();
+      this.membershipGateWatch = null;
       this.controlDatabase.setMembershipChangeListener(null);
       this.controlDatabase.setGuardedDeleteListener(null);
       this.controlDatabase.setControlWriteAbandonedListener(null);
@@ -5753,8 +6175,9 @@ export class CadreNode implements SAppIdLookup {
    * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
    * automatic relaunch need it. A failed launch here hands the strand back to that
    * relaunch — `StrandWatcher.forgetStrand` drops the id from the watcher's
-   * `knownStrands` and records the backoff, so a later poll re-attempts it on the same
-   * `pollInterval * 2^(failures-1)` ladder a watcher-driven failure gets. Because the
+   * `knownStrands`, records the backoff and wakes the watcher when it expires, so the
+   * strand is re-attempted on the same ladder a watcher-driven failure gets
+   * (`min(strandWatchInterval, 5 s) * 2^(failures-1)`, capped at 5 minutes). Because the
    * config stays registered, the retry takes `handleStrandAdded`'s auto-launch branch:
    * what the app sees is `strand:error` per failed retry and `strand:started` when one
    * succeeds, never a second `strand:discovered`. {@link detachStrand} (reached via
@@ -5797,6 +6220,7 @@ export class CadreNode implements SAppIdLookup {
     // A claim also overrides any earlier `stopStrand` of this id: the watcher must track
     // the strand again, or a party-wide removal would never stop it here.
     this.strandWatcher?.unsuppressStrand(strandRow.Id);
+    this.strandWatcher?.sAppIdLearned(strandRow.Id);
     log('Registered sAppConfig for strand %s (sApp: %s, founder: %s)',
       strandRow.Id, sAppConfig.id, founder ?? 'derived');
 
@@ -5822,7 +6246,7 @@ export class CadreNode implements SAppIdLookup {
       // Hand the strand back to the watcher's retry ladder. Harmless on the founder path
       // (`foundStrand` → `publishStrand` + this call), where the watcher may never have
       // offered the strand: the `knownStrands` delete is a no-op and the recorded backoff
-      // only delays the watcher's own first attempt by one poll interval, which is what
+      // only delays the watcher's own first attempt by one ladder step, which is what
       // should happen right after an attempt that just failed.
       //
       // NOTE: the retry relaunches from the CONTROL row (or, for a strand joined from
@@ -5906,7 +6330,8 @@ export class CadreNode implements SAppIdLookup {
    * (the key exists nowhere else). No app-data wipe is needed for either.
    *
    * The insert is signed through this node's owner signer ({@link getOwnerSigner}), in one
-   * approval with a closed strand's party-key mint. The signer's key is persisted on the row
+   * approval and one control transaction with a closed strand's party key
+   * ({@link ControlDatabase.insertFoundingRows}). The signer's key is persisted on the row
    * as `FounderOwnerKey` (the schema pins the column to the verified signer), and this node's
    * peer id as `FounderPeerId` (bound into the signature), which is what later lets any
    * launch derive "this machine is the founder" from the row alone.
@@ -5917,7 +6342,8 @@ export class CadreNode implements SAppIdLookup {
    *
    * A CLOSED strand's publish also seats this party's own membership identity key —
    * the `StrandPartyKey` row {@link ensureStrandPartyKey} documents — which is what the
-   * founder bootstrap derives `Member.Key`/`Manager.MemberKey` from. The
+   * founder bootstrap derives `Member.Key`/`Manager.MemberKey` from; a key the party already
+   * holds for the id is kept. The
    * `memberPrivateKey` ARGUMENT stays the strand-wide read secret formation hands to
    * joiners; it derives nobody's identity.
    *
@@ -5937,23 +6363,8 @@ export class CadreNode implements SAppIdLookup {
    */
   async publishStrand(strandId: string, type: 'o' | 'c' = 'o', memberPrivateKey?: string, sign?: OwnerSign): Promise<StrandRow> {
     const signer = this.requireOwnerSigner(`publish strand ${strandId}`);
-    // Trim/reject here so the id that lands matches the one unpublishStrand looks up: it
-    // trims too, and an untrimmed row would be unreachable by the same string.
-    const trimmed = requireNonBlank(strandId, 'strand id');
-    // Refuse an unusable id HERE, not only at launch. `addStrand` already asserts, but it
-    // runs after this row is written, and this row replicates: an id no node can turn into
-    // a storage scope key would otherwise reach the whole party's control database and be
-    // declined once per member. Asserted after the trim so the id checked is the id stored.
-    assertStrandScopeKey(trimmed);
-    // FounderPeerId records THIS machine as the founder, which is what later lets a relaunch
-    // derive founder-ness; ControlDatabase.insertStrand writes the same id (its own node's).
-    const desired: StrandRow = {
-      Id: trimmed,
-      Type: type,
-      MemberPrivateKey: memberPrivateKey ?? null,
-      FounderOwnerKey: signer.publicKey,
-      FounderPeerId: this.controlNode!.peerId.toString(),
-    };
+    const desired = this.founderStrandRow(strandId, type, memberPrivateKey, signer);
+    const trimmed = desired.Id;
 
     // Read first rather than leaning on the insert's collision for BOTH readings. The
     // ordinary resume (an app killed after its own publish committed) then needs no error
@@ -5974,53 +6385,158 @@ export class CadreNode implements SAppIdLookup {
       log('publishStrand(%s): already published (type %s) with identical content — no-op', trimmed, type);
       // A closed strand THIS machine published must hold a party key (its own membership
       // identity — see ensureStrandPartyKey). Insert-if-absent, so the ordinary repeat
-      // is a read-only no-op and a publish interrupted between the row insert and the
-      // mint heals here. A row another machine published is that machine's to mint for.
+      // is a read-only no-op and a closed row stored without its key heals here. A row
+      // another machine published is that machine's to mint for.
       if (type === 'c' && this.isSelfFoundedRow(matched)) {
         await this.ensureStrandPartyKey(trimmed, undefined, sign);
       }
       return matched;
     }
 
-    return await withinOwnerApproval(signer, { partyId: this.partyId, action: `Publish the strand ${trimmed} to the cadre` }, sign,
-      (approved) => this.insertStrandRow(desired, signer, approved));
+    return (await this.writeFoundingRows(desired, undefined, signer, sign)).strandRow;
   }
 
   /**
-   * The write half of {@link publishStrand}: insert `desired`, adopting a matching row a
-   * concurrent founder landed first, then mint a closed strand's party key, all under one
-   * owner approval's `sign`.
+   * The `Strand` row this machine publishes for `strandId`, as {@link publishStrand} and
+   * {@link foundStrand} write it: the id trimmed and checked, this node's owner key and peer id
+   * as its founder.
    */
-  private async insertStrandRow(desired: StrandRow, signer: OwnerSigner, sign: OwnerSign): Promise<StrandRow> {
-    const { Id: trimmed, Type: type } = desired;
+  private founderStrandRow(strandId: string, type: 'o' | 'c', memberPrivateKey: string | undefined, signer: OwnerSigner): StrandRow {
+    // Trim/reject here so the id that lands matches the one unpublishStrand looks up: it
+    // trims too, and an untrimmed row would be unreachable by the same string.
+    const trimmed = requireNonBlank(strandId, 'strand id');
+    // Refuse an unusable id HERE, not only at launch. `addStrand` already asserts, but it
+    // runs after this row is written, and this row replicates: an id no node can turn into
+    // a storage scope key would otherwise reach the whole party's control database and be
+    // declined once per member. Asserted after the trim so the id checked is the id stored.
+    assertStrandScopeKey(trimmed);
+    // FounderPeerId records THIS machine as the founder, which is what later lets a relaunch
+    // derive founder-ness; ControlDatabase.insertFoundingRows writes the same id (its own node's).
+    return {
+      Id: trimmed,
+      Type: type,
+      MemberPrivateKey: memberPrivateKey ?? null,
+      FounderOwnerKey: signer.publicKey,
+      FounderPeerId: this.controlNode!.peerId.toString(),
+    };
+  }
+
+  /**
+   * The write half of {@link publishStrand} and {@link foundStrand}: under one owner approval,
+   * insert `desired`, a closed strand's party key and the requested invitation in one control
+   * transaction ({@link ControlDatabase.insertFoundingRows}), adopting a matching row a
+   * concurrent founder landed first. Reads nothing first: the caller has just read the
+   * `Strand` row, and a stored key or row is resolved from the insert's own rejection.
+   */
+  private async writeFoundingRows(
+    desired: StrandRow,
+    invite: FoundingInvite | undefined,
+    signer: OwnerSigner,
+    sign?: OwnerSign
+  ): Promise<FoundingWrite> {
+    const action = invite
+      ? `Publish the strand ${desired.Id} to the cadre, with an invitation to the app ${invite.sAppId}`
+      : `Publish the strand ${desired.Id} to the cadre`;
+    return await withinOwnerApproval(signer, { partyId: this.partyId, action }, sign,
+      (approved) => this.insertOrAdoptFounding(desired, invite, signer, approved));
+  }
+
+  /** {@link writeFoundingRows} inside its approval. */
+  private async insertOrAdoptFounding(
+    desired: StrandRow,
+    invite: FoundingInvite | undefined,
+    signer: OwnerSigner,
+    sign: OwnerSign
+  ): Promise<FoundingWrite> {
+    let partyKey: string | undefined;
     try {
-      await this.controlDatabase!.insertStrand(trimmed, type, signer.publicKey, sign, desired.MemberPrivateKey ?? undefined);
+      partyKey = await this.seatFoundingRows(desired, invite, signer, sign);
     } catch (error) {
       // Only the uniqueness collision is a candidate for the idempotent reading; every
       // other rejection (unauthorized signer, retired stamp) must keep surfacing.
       if (!isStrandIdConflict(error, 'Strand')) {
         throw error;
       }
-      const landed = await this.controlDatabase!.queryStrand(trimmed);
-      if (!landed) {
-        // Collided, yet no row is readable: not the race this branch handles (a row
-        // deleted between the rejection and the re-read, or a stale local view). Surface
-        // the original rather than guessing.
+      const strandRow = await this.adoptConcurrentFounding(desired, error);
+      // The rejection rolled the invitation back with the row; a caller asking for one gets one.
+      if (invite) {
+        await this.publishFoundingInviteIfAbsent(strandRow.Id, invite, sign);
+      }
+      return { strandRow };
+    }
+    log('Published strand %s (type %s) to control DB under owner %s', desired.Id, desired.Type, signer.publicKey);
+    if (invite) {
+      this.registerPublishedInvitation(invite.token, invite.expiresAtMs);
+    }
+    return { strandRow: desired, partyKey };
+  }
+
+  /**
+   * Insert `desired`'s founding rows, minting a closed strand's party key — this party's own
+   * membership identity, which the founder bootstrap derives `Member`/`Manager` from, distinct
+   * from the row's shared `MemberPrivateKey` read secret. A key already stored for the id with
+   * no strand row (one {@link ensureStrandPartyKey} seated, which it would adopt too) refuses
+   * that transaction whole; the rows are then written again without a key.
+   *
+   * @returns The party key this seated; undefined when it seated none, so the launch reads the stored one.
+   */
+  private async seatFoundingRows(
+    desired: StrandRow,
+    invite: FoundingInvite | undefined,
+    signer: OwnerSigner,
+    sign: OwnerSign
+  ): Promise<string | undefined> {
+    const controlDatabase = this.controlDatabase!;
+    const strand = { id: desired.Id, type: desired.Type, memberPrivateKey: desired.MemberPrivateKey ?? undefined };
+    if (desired.Type !== 'c') {
+      await controlDatabase.insertFoundingRows({ strand, formationInvite: invite }, signer.publicKey, sign);
+      return undefined;
+    }
+    const partyKey = await generateStrandMemberKey();
+    try {
+      await controlDatabase.insertFoundingRows({ strand, partyKey, formationInvite: invite }, signer.publicKey, sign);
+      return partyKey;
+    } catch (error) {
+      if (!isStrandIdConflict(error, 'StrandPartyKey')) {
         throw error;
       }
-      log('publishStrand(%s): lost a concurrent founding race; re-read the landed row', trimmed);
-      return requireMatchingStrandRow(landed, desired, 'landed concurrently from another founder');
+      log('publishStrand(%s): this party already holds a key for the id; publishing the row and adopting that key', desired.Id);
+      await controlDatabase.insertFoundingRows({ strand, formationInvite: invite }, signer.publicKey, sign);
+      return undefined;
     }
-    log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signer.publicKey);
-    // A closed strand's publish also mints this party's own membership identity key
-    // (StrandPartyKey) — the key the founder bootstrap derives Member/Manager from,
-    // deliberately distinct from the row's shared MemberPrivateKey read secret. A failure
-    // here surfaces (the strand row has already committed, so a retried publish takes
-    // the idempotent branch and heals the mint; so does the next founder launch).
-    if (type === 'c') {
-      await this.ensureStrandPartyKey(trimmed, undefined, sign);
+  }
+
+  /**
+   * Resolve a founding refused on `Strand.Id`: re-read the row that landed and adopt it when it
+   * matches `desired` — a concurrent founder, such as two machines of one party on one id —
+   * or throw naming the columns that differ.
+   */
+  private async adoptConcurrentFounding(desired: StrandRow, error: unknown): Promise<StrandRow> {
+    const landed = await this.controlDatabase!.queryStrand(desired.Id);
+    if (!landed) {
+      // Collided, yet no row is readable: not the race this branch handles (a row
+      // deleted between the rejection and the re-read, or a stale local view). Surface
+      // the original rather than guessing.
+      throw error;
     }
-    return desired;
+    log('publishStrand(%s): lost a concurrent founding race; re-read the landed row', desired.Id);
+    return requireMatchingStrandRow(landed, desired, 'landed concurrently from another founder');
+  }
+
+  /**
+   * Publish a founding's invitation on its own, bound to `strandId`, for a founding that adopted
+   * a stored row rather than writing its own — unless the invitation is already stored, bound to
+   * this strand, as a repeat of a founding whose transaction committed leaves it.
+   *
+   * @param sign - The open approval's `sign`; omitted, the publish asks for its own.
+   */
+  private async publishFoundingInviteIfAbsent(strandId: string, invite: FoundingInvite, sign?: OwnerSign): Promise<void> {
+    if ((await this.controlDatabase!.queryFormationInvite(invite.token))?.strandId === strandId) {
+      log('foundStrand(%s): the invitation is already published', strandId);
+      return;
+    }
+    const { token, sAppId, ...options } = invite;
+    await this.publishFormationInvite(token, sAppId, { ...options, strandId }, sign);
   }
 
   /**
@@ -6028,6 +6544,11 @@ export class CadreNode implements SAppIdLookup {
    * founder — in one resumable call. The single entry point for creating a strand; a
    * caller joining one someone else founded uses {@link addStrand} alone.
    *
+   * The publish is one control transaction under one owner approval: the `Strand` row, a
+   * closed strand's `StrandPartyKey` row, and the invitation in
+   * {@link FoundStrandConfig.formationInvite} when one is given. The start then uses the party
+   * key the publish seated rather than reading it back.
+   *
    * Safe to re-run from any point of interruption, which hand-rolling
    * {@link publishStrand} + {@link addStrand} is not. Either half can already have
    * happened:
@@ -6109,18 +6630,19 @@ export class CadreNode implements SAppIdLookup {
    * derive whether this machine founds it. Every check that can refuse the founding is here,
    * so both forms of `foundStrand` reject on it before returning.
    */
-  private async publishFoundingRow(config: FoundStrandConfig): Promise<Pick<FoundStrandResult, 'strandRow' | 'founded'>> {
-    const { strandId, type = 'o', memberPrivateKey } = config;
+  private async publishFoundingRow(config: FoundStrandConfig): Promise<FoundingPublish> {
+    const { strandId, type = 'o', memberPrivateKey, formationInvite, sAppConfig } = config;
     if (!this._running || !this.controlDatabase) {
       throw new Error(`CadreNode must be started before attempting to found strand ${strandId}`);
     }
     const controlDatabase = this.controlDatabase;
     const trimmed = requireNonBlank(strandId, 'strand id');
+    const invite: FoundingInvite | undefined = formationInvite && { ...formationInvite, sAppId: sAppConfig.id };
     const timed = <T>(step: string, op: () => Promise<T>) => timedStep('foundStrand', trimmed, step, op);
     const published = await timed('queryStrand', () => controlDatabase.queryStrand(trimmed));
-    const strandRow = published
-      ? this.adoptPublishedStrand(published, type, memberPrivateKey)
-      : await timed('publishStrand', () => this.publishStrand(trimmed, type, memberPrivateKey));
+    const { strandRow, partyKey } = published
+      ? await this.resumeFounding(published, type, memberPrivateKey, invite)
+      : await timed('publishStrand', () => this.publishFoundingStrand(trimmed, type, memberPrivateKey, invite));
     // Derived, not hardcoded `true`: adopting a row another machine published means that
     // machine runs the bootstrap — this one must attach or it would write a second Header.
     const founded = this.isSelfFoundedRow(strandRow);
@@ -6129,20 +6651,52 @@ export class CadreNode implements SAppIdLookup {
         '(FounderPeerId is not this node\'s peer id) — attaching as a joiner; ' +
         'the founder bootstrap runs on that machine', trimmed);
     }
-    return { strandRow, founded };
+    return { strandRow, founded, partyKey };
+  }
+
+  /** {@link publishFoundingRow} when no row is stored: write the founding rows under this node's owner. */
+  private publishFoundingStrand(
+    strandId: string,
+    type: 'o' | 'c',
+    memberPrivateKey: string | undefined,
+    invite: FoundingInvite | undefined
+  ): Promise<FoundingWrite> {
+    const signer = this.requireOwnerSigner(`publish strand ${strandId}`);
+    return this.writeFoundingRows(this.founderStrandRow(strandId, type, memberPrivateKey, signer), invite, signer);
+  }
+
+  /**
+   * {@link publishFoundingRow} over a stored row: adopt it ({@link adoptPublishedStrand}), then
+   * publish the requested invitation on its own, under its own approval.
+   */
+  private async resumeFounding(
+    published: StrandRow,
+    type: 'o' | 'c',
+    memberPrivateKey: string | undefined,
+    invite: FoundingInvite | undefined
+  ): Promise<FoundingWrite> {
+    const strandRow = this.adoptPublishedStrand(published, type, memberPrivateKey);
+    if (invite) {
+      await timedStep('foundStrand', strandRow.Id, 'publishFormationInvite',
+        () => this.publishFoundingInviteIfAbsent(strandRow.Id, invite));
+    }
+    return { strandRow };
   }
 
   /**
    * The start half of {@link foundStrand}. Its timing lines (`addStrand: start`, then the
    * duration or `failed after`) are logged when the start settles, also in the background
    * form, so a start that hangs still shows as a start line with no end line.
+   *
+   * A party key the publish half just seated is handed to the launch, which would otherwise
+   * read back the row the same founding wrote.
    */
   private attachFoundingRow(
-    { strandRow, founded }: Pick<FoundStrandResult, 'strandRow' | 'founded'>,
+    { strandRow, founded, partyKey }: FoundingPublish,
     { sAppConfig, awaitFirstSync }: FoundStrandConfig
   ): Promise<StrandInstance> {
     return timedStep('foundStrand', strandRow.Id, 'addStrand',
-      () => this.addStrand({ strandRow, sAppConfig, founder: founded, awaitFirstSync }));
+      () => this.addStrand({ strandRow, sAppConfig, founder: founded, awaitFirstSync, partyMemberPrivateKey: partyKey }));
   }
 
   /**
@@ -6178,9 +6732,10 @@ export class CadreNode implements SAppIdLookup {
    * inverse of {@link publishStrand}.
    *
    * Party-wide, unlike {@link stopStrand}, which only stops the strand on THIS node: every
-   * cadre node watching the table sees the row vanish on its next poll (default 5 s) and
-   * stops its own instance. This node converges immediately — the method forces a watcher
-   * poll and stops any still-running local instance before resolving. Removing the row
+   * cadre node watching the table hears the row's removal and stops its own instance (a
+   * machine outside the `Strand` block's cohort, on a cadre larger than 16, only at its
+   * watcher's backstop read, default 5 minutes). This node converges immediately — the
+   * method forces a watcher run and stops any still-running local instance before resolving. Removing the row
    * removes OUR party's participation only: other parties in the strand keep their own
    * rows and the strand network carries on, so no cross-party sign-off is involved — this
    * is an owner-signed control-plane write like every other, not "destroy the network".
@@ -6267,16 +6822,16 @@ export class CadreNode implements SAppIdLookup {
     // deadline rather than dropping it (a binding cleared late is still worth more than
     // one never cleared).
     await this.strandManager.clearOwnMemberPeerBinding(trimmed);
-    // Converge locally now rather than waiting up to a poll interval. The watcher fires
-    // onStrandRemoved for a strand it tracked; the explicit teardown below covers a node
-    // whose strandFilter never admitted this strand (the watcher never knew it, so it will
-    // never fire). StrandInstanceManager.stopStrand no-ops on an unknown id, so the two
+    // Converge locally before resolving rather than when the write wakes the watcher. The
+    // watcher fires onStrandRemoved for a strand it tracked; the explicit teardown below
+    // covers a node whose strandFilter never admitted this strand (the watcher never knew
+    // it, so it will never fire). StrandInstanceManager.stopStrand no-ops on an unknown id, so the two
     // paths cannot double-stop into an error.
     //
     // detachStrand, NOT stopStrand: this is a party-wide removal, not a local abandonment
     // of a strand that still exists, so it must not SUPPRESS the id in the watcher. The
     // row is already gone — there is nothing to suppress — and an id re-published before
-    // the next poll's suppression cleanup would then never be offered again this session.
+    // the next run's suppression cleanup would then never be offered again this session.
     // (Same reasoning as handleStrandRemoved, which also avoids stopStrand's `_running`
     // guard; here the guard is already satisfied by requireOwnerSigner above.)
     await this.strandWatcher?.forcePoll();
@@ -6300,9 +6855,11 @@ export class CadreNode implements SAppIdLookup {
    * as `MemberPrivateKey`; docs/strands.md → "Closed-Strand Member Key Handling") and is
    * never put on the formation wire.
    *
-   * Called internally by {@link publishStrand} (closed strands mint at publish) and by a
-   * founder launch that finds no row (a publish interrupted before its mint); public so a
-   * test harness — or a joiner flow that persists a formation-issued identity — can seat
+   * A founding seats the key in the same transaction as the strand row, not through here.
+   * Called internally by {@link publishStrand}'s repeat of a published closed strand and by a
+   * founder launch that finds no row, which heal a closed strand row stored without its key
+   * (one seated by `ControlDatabase.insertStrand` directly, or whose key was removed); public
+   * so a test harness — or a joiner flow that persists a formation-issued identity — can seat
    * a specific key deliberately.
    *
    * @param strandId - The strand the key is this party's identity for.
@@ -6353,8 +6910,8 @@ export class CadreNode implements SAppIdLookup {
    * Resolve the party membership key a closed strand's launch threads into the founder
    * bootstrap: the explicit attach-time key when given, else the party's persisted
    * `StrandPartyKey` row, else — on the one machine the row names as founder (`FounderPeerId`)
-   * — a freshly minted-and-persisted key, which seats the identity for a publish that was
-   * interrupted before its mint. Everyone else resolves undefined: non-founding
+   * — a freshly minted-and-persisted key, which seats the identity for a closed row stored
+   * without one (see {@link ensureStrandPartyKey}). Everyone else resolves undefined: non-founding
    * machines never mint (no mint race between a party's machines), and only a founder
    * bootstrap needs the key at all.
    *
@@ -6374,6 +6931,11 @@ export class CadreNode implements SAppIdLookup {
     if (explicitKey !== undefined) {
       return explicitKey;
     }
+    const formed = this.formedPartyKeys.get(strand.Id);
+    if (formed !== undefined) {
+      this.formedPartyKeys.delete(strand.Id);
+      return formed;
+    }
     if (!this.controlDatabase) {
       return undefined;
     }
@@ -6398,8 +6960,8 @@ export class CadreNode implements SAppIdLookup {
    * Counterpart to {@link createOpenInvitation}, which only mints the
    * out-of-band {@link OpenInvitation} envelope: persisting the matching
    * `FormationInvite` row is what makes the token *redeemable* — the host's
-   * {@link ControlFormationUsageRecorder} answers `isTokenValid`/`isTokenUsed`
-   * from this row. A host minting a closed-strand invite does both (mint +
+   * {@link ControlFormationUsageRecorder} reads it (`readToken`) to check a
+   * redemption. A host minting a closed-strand invite does both (mint +
    * publish), exactly as the integration harness's `createInvitation` does.
    *
    * Signs through the same owner signer as {@link publishStrand}, whose key must be an
@@ -6422,16 +6984,21 @@ export class CadreNode implements SAppIdLookup {
     const signer = this.requireOwnerSigner(`publish formation invite ${token}`);
     await withinOwnerApproval(signer, { partyId: this.partyId, action: `Publish an invitation to the app ${sAppId}` }, sign,
       (approved) => this.controlDatabase!.insertFormationInvite(token, sAppId, signer.publicKey, approved, options));
-    // A host may publish an invite whose token was minted elsewhere; registering
-    // it locally opens the connection gate's formation exemption immediately
-    // rather than waiting for the durable row to become readable.
-    this.strandSolicitationService?.registerMintedInvitation(
-      token,
-      options.expiresAtMs ?? Number.POSITIVE_INFINITY
-    );
+    this.registerPublishedInvitation(token, options.expiresAtMs);
     log('Published formation invite %s (sApp %s) under owner %s', token, sAppId, signer.publicKey);
   }
 
+  /**
+   * Register an invitation this node just published with the strand solicitation service. A
+   * host may publish one whose token was minted elsewhere; registering it locally opens the
+   * connection gate's formation exemption immediately rather than waiting for the durable row
+   * to become readable. A token {@link createOpenInvitation} minted here is already registered,
+   * and this records the same expiry again.
+   */
+  private registerPublishedInvitation(token: string, expiresAtMs: number | undefined): void {
+    this.strandSolicitationService?.registerMintedInvitation(token, expiresAtMs ?? Number.POSITIVE_INFINITY);
+  }
+
   /**
    * Enroll an approver public key allowed to sign off on `ValidationUrl` redemptions.
    *
@@ -6547,7 +7114,7 @@ export class CadreNode implements SAppIdLookup {
    * fan-out, so a rediscovery costs nothing beyond the map lookup plus the (pure)
    * founder derivation. NOT a silent no-op any more when the launch resolves as a
    * FOUNDER: the tracked instance may have been launched first as a joiner (an app
-   * attach, or this node's own watcher poll winning the `resolveCohortSeed` window
+   * attach, or this node's own watcher run winning the `resolveCohortSeed` window
    * below), which used to drop the founder request and leave the strand headerless —
    * now the tracked instance is founded in place
    * ({@link StrandInstanceManager.foundExistingStrand}), waking it first if quiesced
@@ -6559,9 +7126,9 @@ export class CadreNode implements SAppIdLookup {
    *
    * An absent `sAppConfig` launches a storage replica ({@link CadreNodeConfig.hostUnclaimedStrands}),
    * which is ALWAYS a joiner whatever the row says: the founder bootstrap writes the sApp
-   * into `Strand.Header`, and a replica has none. So a self-founded row whose watcher poll
+   * into `Strand.Header`, and a replica has none. So a self-founded row whose watcher run
    * wins the race against its app's `addStrand` after a restart comes up as a replica — and
-   * so does a `foundStrand` whose publish a watcher poll saw before its attach. A claim
+   * so does a `foundStrand` whose publish a watcher run saw before its attach. A claim
    * that finds a tracked replica upgrades it in place, over the same node and store
    * ({@link StrandInstanceManager.attachSApp}), BEFORE any founding: the founder bootstrap
    * needs the sApp the attach supplies.
@@ -6604,8 +7171,8 @@ export class CadreNode implements SAppIdLookup {
 
     // A closed strand's launch carries the party's OWN membership identity key: the
     // explicit attach-time key, else the control-layer StrandPartyKey row — minted here
-    // when this machine is the row-derived founder and no row exists yet (a publish
-    // interrupted before its mint). A joiner with no persisted key threads undefined;
+    // when this machine is the row-derived founder and no row exists yet (a closed row
+    // stored without its key). A joiner with no persisted key threads undefined;
     // only a FOUNDER bootstrap needs the key, and that path throws loudly without one
     // (StrandDatabase).
     const partyMemberPrivateKey = strand.Type === 'c'
@@ -6948,7 +7515,7 @@ export class CadreNode implements SAppIdLookup {
    *
    * Timestamps are recorded OPTIMISTICALLY, whatever `collectStrandAddrs` reports
    * per peer: recording only on success would re-announce to an unreachable relay
-   * on every reconcile tick, one dial timeout each. A failed INITIAL announce costs
+   * on every reconcile pass, one dial timeout each. A failed INITIAL announce costs
    * the strand supervisor its first attempt only (the relay denies the
    * reservation; every re-drive re-announces first through
    * {@link announceDelegateToRelay}); a failed REFRESH retries within
@@ -7092,9 +7659,11 @@ export class CadreNode implements SAppIdLookup {
    *
    * Due times are per (sibling, strand) and set from each sibling's own outcome, so
    * a sibling that connects late — a phone joining after the party's always-on
-   * machines — is asked on the next tick, and one that could not answer or refused
-   * (its view of the membership may not include us yet) is retried within
-   * {@link STRAND_PEER_ADDR_RETRY_MS} rather than {@link STRAND_PEER_ADDR_REFRESH_MS}.
+   * machines — is asked on the pass its connection starts, and one that could not
+   * answer or refused (its view of the membership may not include us yet) is retried
+   * within {@link STRAND_PEER_ADDR_RETRY_MS} rather than
+   * {@link STRAND_PEER_ADDR_REFRESH_MS}; the pass that stamped the retry arms a wake
+   * for it ({@link armReconcileWake}).
    *
    * Distinct from {@link refreshDelegateGrants}, deliberately: that pass covers
    * RELAYS on a `DELEGATE_GRANT_TTL_MS / 2` throttle to keep circuit-relay
@@ -7144,15 +7713,17 @@ export class CadreNode implements SAppIdLookup {
    *
    * `connectedSiblingTargets`' membership read is unbounded, and with zero
    * connections its answer is empty whatever the table holds, so decide it from the
-   * connection list instead of paying for the read once a tick.
+   * connection list instead of paying for the read once a pass.
    *
-   * NOTE: otherwise the read runs on EVERY tick with a running strand, not only when
+   * NOTE: otherwise the read runs on EVERY pass with a running strand, not only when
    * some (sibling, strand) is due: pruning a departed sibling needs the current
    * target set, and whether anyone is due cannot be told without it (a connected
-   * non-member never gets a due time to compare). One more `CadrePeer` read per 15 s
-   * tick, on top of the two `runReconcileControlCohort` already makes; if those reads
-   * get costly, share one row-set across the pass (see the NOTE there) rather than
-   * skipping ticks here.
+   * non-member never gets a due time to compare). One more `CadrePeer` read per
+   * pass, on top of the two `runReconcileControlCohort` already makes, all served
+   * from the membership rows view: an in-memory scan while the view is current,
+   * storage only after the table changed or the view's maximum age passed. Sharing
+   * one row set across the pass would save no storage read and was declined (see
+   * the NOTE there).
    *
    * NOTE: one strand-addr RPC per (running strand × due sibling) — each a tiny
    * request/response on an already-open control connection. If a node ever runs
@@ -7243,8 +7814,8 @@ export class CadreNode implements SAppIdLookup {
    *
    * NOTE: every pass serialises the whole FRET table (`exportTable()`), verifies one
    * signature per record and makes one `peerStore.merge` per peer, per running strand
-   * per 15 s tick. Fine at strand table sizes, and an unchanged address set writes
-   * nothing in libp2p's persistent peer store. If many strands or large tables make it
+   * per pass — every change-driven pass and the 2-minute backstop. Fine at strand table
+   * sizes, and an unchanged address set writes nothing in libp2p's persistent peer store. If many strands or large tables make it
    * show up, read only the entries whose address stamp is near the one-hour mark.
    *
    * @returns the ids of the peers the table holds a usable record for.
@@ -7550,8 +8121,8 @@ export class CadreNode implements SAppIdLookup {
    * The stop + emit are skipped when the strand manager holds no instance for `strandId` —
    * e.g. a party owner that published a strand's row but never ran it locally, or an
    * explicit {@link stopStrand} for an id this node never started. `hibernationManager`
-   * untrack and the `sAppConfigs` / {@link strandLaunchRefusals} / {@link discoveredStrands}
-   * deletes stay unconditional (all no-ops when there is nothing to remove), so a launch
+   * untrack and the `sAppConfigs` / {@link strandLaunchRefusals} / {@link discoveredStrands} /
+   * {@link formedPartyKeys} deletes stay unconditional (all no-ops when there is nothing to remove), so a launch
    * that failed before an instance was ever tracked still gets its stray entries cleared.
    *
    * Dropping the {@link discoveredStrands} entry here covers both callers, and both
@@ -7568,6 +8139,7 @@ export class CadreNode implements SAppIdLookup {
     this.sAppConfigs.delete(strandId);
     this.strandLaunchRefusals.delete(strandId);
     this.discoveredStrands.delete(strandId);
+    this.formedPartyKeys.delete(strandId);
     if (!this.strandManager.hasStrand(strandId)) {
       log('detachStrand: strand %s not tracked locally — no-op (no stop, no strand:stopped)', strandId);
       return;
@@ -7956,21 +8528,37 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Open control-network connections right now. A lower-bound proxy for replication
-   * reach: 0 connections ⇒ a control write commits local-only. The private
-   * `committedAlone` write-while-alone seam is defined in terms of this.
-   *
-   * It approximates the precise signal (the block's cluster size), and a caller that
-   * samples it AFTER a write samples a slightly wider window than `committedAlone`
-   * does inside the write itself. It exists so an embedder can warn an owner before a
-   * control write that this machine currently sees none of its siblings, and report
-   * after one that the write may not have travelled — a warning shown unconditionally
-   * is a warning people learn to ignore.
+   * Open control-network connections right now, of every kind: siblings, relays, bootstrap
+   * nodes and peers still identifying. A report of connectivity, not of replication reach: a
+   * control write can commit local-only with connections open, and whether one would is
+   * {@link hasReachableControlSibling}.
    */
   getControlConnectionCount(): number {
     return this.controlNode?.getConnections().length ?? 0;
   }
 
+  /**
+   * Whether a control write made now reaches another machine: a connected peer has identified
+   * as serving the control database and is one this node sends control writes to (an
+   * authorized member, or a device whose admission it is writing). Optimystic counts a peer
+   * into a control block's cohort on those same terms; with none, a write commits on this node
+   * alone and is queued for re-issue once one is reachable (docs/architecture.md → "Writes made
+   * while alone").
+   *
+   * It exists so an embedder can warn an owner before a control write that this machine
+   * currently reaches none of its siblings, and report after one that the write may not have
+   * travelled; a warning shown unconditionally is a warning people learn to ignore. A caller
+   * that samples it AFTER a write samples a slightly wider window than the write did.
+   */
+  hasReachableControlSibling(): boolean {
+    for (const peerId of this.identifiedControlPeers) {
+      if (this.isControlCohortMember(peerId)) {
+        return true;
+      }
+    }
+    return false;
+  }
+
   /**
    * Force a poll of the strand watcher (for testing)
    */
@@ -8052,7 +8640,8 @@ export class CadreNode implements SAppIdLookup {
     }), this.controlNode, this.controlDatabase);
     log('Owner signer wired (owner key %s)', signer.publicKey);
     // Embedders wire the owner key after start(), so the runner's first pass usually found
-    // this machine not yet an owner; without this it would wait a full poll interval.
+    // this machine not yet an owner; wiring a signer writes no table it watches, so without
+    // this it would wait for its backstop.
     this.pendingJoinRunner?.kick();
   }
 
@@ -8290,6 +8879,10 @@ export class CadreNode implements SAppIdLookup {
     if (usage === undefined || invite === undefined) {
       return false;
     }
+    // NOTE: accepted tradeoff — three ed25519 verifies per invitation-admitted row on every
+    // refresh, CPU only since the rows come from the membership views; a memo of verdicts would
+    // also have to follow the trusted-owner anchor, which syncOwnerAnchor rewrites. Revisit if
+    // the gate's admission deadline ever shows it.
     return verifyInvitationAdmission(this.partyId, row, usage, invite, key => this.trustedOwnerStore?.has(key) ?? false);
   }
 
@@ -8313,7 +8906,7 @@ export class CadreNode implements SAppIdLookup {
    * builds its snapshot against that anchor, which is also what its previous snapshot was
    * judged against. Caught here rather than failing the refresh, because the membership read
    * tolerates an unreachable `Revocation` block on an isolated node
-   * (`ControlDatabase.readRevokedStampRows`) and `queryRevocations` does not: failing the
+   * (`ControlDatabase.readRevocationRowsOrNone`) and `queryRevocations` does not: failing the
    * whole refresh on that would freeze such a node's gate snapshot.
    * NOTE: on such a node the sync is skipped at every refresh until the block is held; if an
    * isolated node ever has to derive owner additions while cut off, give `queryRevocations`
@@ -8322,9 +8915,12 @@ export class CadreNode implements SAppIdLookup {
    * NOTE: cost per membership refresh is one `OwnerKey` read and one `Revocation` read (the
    * tombstone list, whose `OwnerKey` stamps are handed to `queryOwnerKeyRows` so it does not
    * read the retired set again, and which the hang-up of removed peers shares through
-   * `loadTombstones`), plus the owner-grant chain when some owner row is grant-seated (the
-   * NOTE in the body). Before the Revocation ledger marker is filed that one read is a cohort
-   * consult per refresh, which `control-founding-consult-budget.spec.ts` pins.
+   * `loadTombstones`), plus the owner-grant chain's two reads when some owner row is
+   * grant-seated. All are served from the control database's membership views, so they reach
+   * storage only after their table changed or the view's maximum age passed
+   * (`control-founding-consult-budget.spec.ts` pins the counts). On a party founded before
+   * genesis created every control collection, whose `Revocation` table has never been
+   * written, each `Revocation` load is a cohort consult until the first tombstone.
    *
    * @param retry - forwarded to every read; `false` on the refresh path, for the reason on
    *   {@link refreshAuthorizedControlPeers}.
@@ -8345,9 +8941,6 @@ export class CadreNode implements SAppIdLookup {
       const tombstones = await loadTombstones();
       const retired = new Set(tombstones.filter(tombstone => tombstone.tableName === 'OwnerKey').map(tombstone => tombstone.stampId));
       const rows = await controlDatabase.queryOwnerKeyRows(retry, retired);
-      // NOTE: the grant chain is two whole-table reads per membership refresh while any owner
-      // row is grant-seated, over tables that are append-only; the memo suggested on
-      // loadInvitationChain would cover it too.
       const grantChain = rows.some(isConsentSeated) ? await this.loadOwnerGrantChain(controlDatabase, retry) : null;
       const derivation = deriveOwnerAnchor({ partyId: this.partyId, anchor: before, rows, tombstones, grantChain });
       if (derivation.refusedRemovals.length > 0) {
@@ -8413,15 +9006,8 @@ export class CadreNode implements SAppIdLookup {
   /**
    * The usage and invitation rows {@link hasAnchoredProof} resolves an invitation-admitted
    * `CadrePeer` row through, keyed for lookup. Both reads honour `retry` for
-   * {@link listAuthorizedMembers}' reason.
-   *
-   * NOTE: once invitations are the only admission route (ticket
-   * `cadre-invitations-redeemable-by-any-member`), every cadre with a member not yet
-   * re-vouched pays these two whole-table reads and three ed25519 verifies per row on every
-   * membership refresh. Both tables are append-only and a verified chain never changes (expiry,
-   * use count and withdrawal are not re-checked), so if the gate's admission deadline ever
-   * shows this, memoise verified (row stamp → usage stamp) pairs per node and skip the reads
-   * when every admitted row is already memoised.
+   * {@link listAuthorizedMembers}' reason. The rows come from the membership views, so they
+   * reach storage only after the table changed or the view's maximum age passed.
    */
   private async loadInvitationChain(controlDatabase: ControlDatabase, retry: boolean): Promise<InvitationChain> {
     const [usages, invites] = await Promise.all([
@@ -8587,16 +9173,16 @@ export class CadreNode implements SAppIdLookup {
    * write-driven refresh never fires for it — yet applying it can ANCHOR a new
    * owner key, which flips rows already present from unauthorized to authorized.
    * Hence the explicit refresh here; without it a peer the freshly anchored owner
-   * vouched for stays denied until the next timed cohort reconcile.
+   * vouched for stays denied until the next membership change or the backstop pass.
    */
   private seedEventCallbacks(): SeedEventCallbacks {
     return {
       onSeedReceived: (partyId, peerId) => this.emit('seed:received', { partyId, peerId }),
       onSeedApplied: (partyId, peersAdded, seed) => {
-        this.emit('seed:applied', { partyId, peersAdded });
         // A wire-delivered seed never passes through the `applySeed` wrapper, so
         // this is where its preferred peers become cold-start bootstrap targets.
-        this.recordSeedBootstrapPeers(seed);
+        const dialTargets = this.recordSeedBootstrapPeers(seed);
+        this.emit('seed:applied', { partyId, peersAdded, dialTargets });
         void this.refreshMembershipGate('seed-applied');
       },
       onSeedError: (partyId, error) => this.emit('seed:error', { partyId, error }),
@@ -8622,13 +9208,14 @@ export class CadreNode implements SAppIdLookup {
    * NO `CadrePeer` writer needs to call this: the control database notifies it
    * after every committed member-row write (`ControlDatabase.mutateCadrePeer`,
    * wired in {@link start}), which is exactly what makes the refresh automatic
-   * rather than a caller obligation. It stays public for the changes that write
-   * NO row locally and so raise no notification:
-   *
-   * - a membership row that arrived by REPLICATION (otherwise picked up on the
-   *   next timed cohort reconcile — bounded staleness by design), and
-   * - a newly anchored trusted owner key ({@link applySeed}), which flips rows
-   *   ALREADY present from unauthorized to authorized without touching them.
+   * rather than a caller obligation. A membership row that arrived by REPLICATION
+   * refreshes it too, through the gate watch {@link start} takes on the membership
+   * tables (within its 50 ms window; a change this node's storage never hears of
+   * waits for the reconcile pass's backstop). It stays public for the one change
+   * that writes no row and raises no table event: a newly anchored trusted owner
+   * key ({@link applySeed}), which flips rows ALREADY present from unauthorized to
+   * authorized without touching them. A caller may also await it to observe a
+   * refresh that began after its own change.
    *
    * Coalescing: marks the snapshot stale and resolves once a refresh that began
    * after this call has completed, so a caller that awaits it always observes
@@ -8654,13 +9241,10 @@ export class CadreNode implements SAppIdLookup {
    * connected peer it newly covers — the strand-side counterpart to
    * {@link refreshMembershipGate}.
    *
-   * Unlike that one, NOTHING calls this automatically: strand membership is
-   * written through the strand's own `Database` handle
-   * (`strand-membership-writer.ts`), which raises no notification this runtime
-   * can hook, and a revocation that arrives by REPLICATION raises none either.
-   * The gate therefore polls (default 30 s). An app that has just called
-   * `revokeMember` or `leaveStrand` should follow the write with this call so
-   * the cut is immediate rather than up to one poll interval late.
+   * The gate already refreshes on its own when the strand's `Member` or
+   * `MemberPeer` table changes: at once for a `revokeMember` or `leaveStrand`
+   * written on this machine, and when a replicated removal reaches this node's
+   * storage. Call this to await the cut — it resolves after the sweep.
    *
    * Quiet no-op for a strand that is not running, is quiesced, is open, or has
    * the gate disabled. Never rejects; resolves once the sweep has finished.
@@ -8711,8 +9295,8 @@ export class CadreNode implements SAppIdLookup {
    * CONCURRENT external write's refresh for the life of the scope: that writer's
    * promise resolves before its peer is admitted, and admission lands at scope
    * exit instead. Acceptable — scope exit is milliseconds away (bounded by the
-   * drain), versus the ~15 s reconcile interval that was the alternative before
-   * any of this existed — but it is the reason these scopes stay short and rare.
+   * drain), versus the reconcile pass that was the alternative before any of this
+   * existed — but it is the reason these scopes stay short and rare.
    */
   private async deferMembershipGateRefresh<T>(reason: string, body: () => Promise<T>): Promise<T> {
     this.membershipGateDeferDepth++;
@@ -8854,7 +9438,7 @@ export class CadreNode implements SAppIdLookup {
       throw new Error('CadreNode must be started before planning an owner key removal');
     }
     const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
-    return (await this.planOwnerKeyRemovalWith(this.controlDatabase, key)).plan;
+    return await this.planOwnerKeyRemovalWith(this.controlDatabase, key);
   }
 
   /**
@@ -8888,7 +9472,7 @@ export class CadreNode implements SAppIdLookup {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
     const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
-    const { plan, rows } = await this.planOwnerKeyRemovalWith(this.controlDatabase, key);
+    const plan = await this.planOwnerKeyRemovalWith(this.controlDatabase, key);
     if (plan.refusal !== null) {
       throw new OwnerKeyRemovalRefusedError(key, plan.refusal);
     }
@@ -8903,19 +9487,19 @@ export class CadreNode implements SAppIdLookup {
     }
     const action = `Remove the owner key ${namedOwnerKey(key, plan.ownerKey?.label ?? null)} from the cadre`;
     const removed = await signer.approve({ partyId: this.partyId, action }, async (sign) => {
-      await this.revouchDependents(service, revouch, rows, sign);
+      await this.revouchDependents(service, revouch, sign);
       return await service.removeOwner(key, sign);
     });
     log('removeOwner(%s): removed=%s revouched owners=%d peers=%d', key, removed, revouch.owners.length, revouch.peers.length);
     return { removed, revouched: revouch };
   }
 
-  /** {@link planOwnerKeyRemoval} with the rows it was judged from, which {@link removeOwner} re-vouches dependents by. */
-  private async planOwnerKeyRemovalWith(controlDatabase: ControlDatabase, key: string): Promise<{ plan: OwnerKeyRemovalPlan; rows: CadrePeerRow[] }> {
+  /** {@link planOwnerKeyRemoval} over `controlDatabase`, for a caller that already holds it. */
+  private async planOwnerKeyRemovalWith(controlDatabase: ControlDatabase, key: string): Promise<OwnerKeyRemovalPlan> {
     const [rows, owners, grants] = await Promise.all([
       controlDatabase.queryCadrePeers(), controlDatabase.queryOwnerKeyRows(), controlDatabase.listOwnerGrantStatuses()
     ]);
-    const plan = planOwnerKeyRemoval({
+    return planOwnerKeyRemoval({
       key,
       rows,
       owners,
@@ -8924,7 +9508,6 @@ export class CadreNode implements SAppIdLookup {
       selfOwnerKey: this.ownerSignerEnrolledIn(new Set(owners.map((owner) => owner.key)))?.publicKey ?? null,
       anchor: this.trustedOwnerStore?.all() ?? new Set(),
     });
-    return { plan, rows };
   }
 
   /**
@@ -8934,12 +9517,14 @@ export class CadreNode implements SAppIdLookup {
    * the only rebinding `OwnerKey.NoUpdate` allows); peers through the owner re-touch
    * (`reauthorizePeer`), which rewrites `VouchOwner`/`VouchSig` and clears `VouchUsage`.
    *
-   * The peer re-touch keeps the row's `UpdatedAt` where it is. The owner branch of
-   * `CadrePeer.AuthorizedUpdate` does not require a bump, and bumping a self-published row
-   * would leave its `Sig` unverifiable, so unresolvable and unlisted as self-published, until
-   * the machine's next heartbeat (the NOTE on that constraint); the write-while-alone drain
-   * bumps because it re-issues an otherwise unchanged row, whereas here the voucher itself
-   * changes. A row never self-published carries no stamp to keep and gets the clock.
+   * The peer re-touch is the re-vouch mode of `reauthorizePeer`, which leaves the row's
+   * `UpdatedAt` untouched and writes whether or not the machine has self-published. The owner
+   * branch of `CadrePeer.AuthorizedUpdate` does not require a bump, and bumping a self-published
+   * row would leave its `Sig` unverifiable, so unresolvable and unlisted as self-published, until
+   * the machine's next heartbeat (the NOTE on that constraint); the write-while-alone drain's
+   * re-broadcast mode bumps because it re-issues an otherwise unchanged row, whereas here the
+   * voucher itself changes. A dependent whose row vanished since the plan is reported absent and
+   * skipped.
    *
    * A failure rethrows and stops the call before the removal; re-vouches already made stay
    * (the row is only re-signed by a current owner) and the caller retries. An owner re-vouch
@@ -8953,7 +9538,6 @@ export class CadreNode implements SAppIdLookup {
   private async revouchDependents(
     service: SeedBootstrapService,
     revouch: OwnerKeyDependents,
-    rows: readonly CadrePeerRow[],
     sign: OwnerSign,
   ): Promise<void> {
     for (const key of revouch.owners) {
@@ -8964,9 +9548,7 @@ export class CadreNode implements SAppIdLookup {
       }
     }
     for (const dependent of revouch.peers) {
-      const row = rows.find((candidate) => candidate.peerId === dependent);
-      const updatedAt = row !== undefined && row.updatedAt > 0 ? row.updatedAt : Date.now();
-      await service.reauthorizePeer(dependent, updatedAt, sign);
+      await service.reauthorizePeer(dependent, 'revouch', sign);
     }
   }
 
@@ -8993,6 +9575,10 @@ export class CadreNode implements SAppIdLookup {
       throw new Error('CadreNode must be started before planning a machine removal');
     }
     const machines = await this.readMachines(this.controlDatabase);
+    // NOTE: the invitation and usage lists come from the membership views, so on a node that
+    // heard of a row with no storage event (outside the block's cohort) an invitation issued
+    // elsewhere in the last MEMBERSHIP_VIEW_MAX_AGE_MS can be missing and left unwithdrawn. If
+    // removal must close that window, read both tables fresh here.
     const [invites, usages, owners] = await Promise.all([
       this.controlDatabase.listCadreInviteStatuses(),
       this.controlDatabase.queryCadreInviteUsages(),
@@ -9224,12 +9810,13 @@ export class CadreNode implements SAppIdLookup {
    * that connection from the addresses it was handed, on this launch or a later
    * one.
    *
-   * Nothing is dialed here: the drone has not received the seed yet. After
-   * delivering it, call {@link reconcileControlCohort} to dial straight away;
-   * otherwise the next timed reconcile pass does. A pass already in flight is
-   * joined rather than restarted, and one that listed siblings before this add
-   * does not dial the drone, so a caller waiting for the connection should allow
-   * for one more timed pass.
+   * Nothing is dialed here: the drone has not received the seed yet. Its `CadrePeer`
+   * insert is a membership change, so a reconcile pass dials the retained addresses
+   * within about 50 ms of this call returning, whether or not the caller runs one, and
+   * a failed dial is retried on the redial ladder (15 s, 30 s, 60 s, then every
+   * backstop). A caller that wants to await the connection calls
+   * {@link reconcileControlCohort} itself, twice in a row: a call made while a pass is
+   * in flight joins it, and that pass may have listed siblings before this add.
    */
   async addDrone(options: AddDroneOptions): Promise<DroneInitResult> {
     if (!this.seedBootstrapService) {
@@ -9275,12 +9862,19 @@ export class CadreNode implements SAppIdLookup {
    * by the node (its anchored branch), the row insert is a no-op on an existing row
    * (`ControlDatabase.insertCadrePeer`), and the dial target is replaced, not duplicated.
    *
-   * The first dial is kicked (not awaited) so it happens now rather than on the next
-   * timed reconcile pass; a caller that wants to wait for the connection awaits
-   * {@link reconcileControlCohort} itself, with `addDrone`'s caveat that a pass already
-   * in flight is joined rather than restarted. The claimed node dials this one back too,
-   * as the seed's minter, when this node has a listen or relay address; a phone
-   * with neither is reached by its own reconcile pass alone.
+   * Once it has acknowledged, the node restarts into this party (cadre-cli's
+   * `restartIntoClaimedParty`), closing the connection the claim used. The dial target puts
+   * the address that connection was dialed on first, so every later dial tries the address
+   * that just worked before the others (a QR code lists public addresses before LAN ones, and
+   * a home router often drops a connection to its own public address from inside). A
+   * reconcile pass is kicked (not awaited) now, and the vouch's `CadrePeer` insert starts
+   * another about 50 ms later; for the first {@link CONTROL_COHORT_REDIAL_MS} after the
+   * acknowledgement this node also retries the node every second while it restarts
+   * ({@link redialClaimedNode}). A caller that wants to wait for the connection awaits
+   * {@link reconcileControlCohort} itself, with `addDrone`'s caveat that a pass already in
+   * flight is joined rather than restarted. The claimed node dials this one back too, as the
+   * seed's minter, when this node has a listen or relay address; a phone with neither is
+   * reached by its own dials alone.
    *
    * @throws {ClaimRefusedError} when the node was reached and refused the claim.
    * @throws {PeerUnreachableError} when the node was never reached.
@@ -9295,6 +9889,7 @@ export class CadreNode implements SAppIdLookup {
     if (!signer) {
       throw new Error('Owner key required to create seeds');
     }
+    let dialAddrs = target.multiaddrs;
     await signer.approve({ partyId: this.partyId, action: `Claim the node ${target.peerId} for the cadre` }, async (sign) => {
       const seed = await service.createSeed(sign);
       const proof = claimProof(secret, target.peerId, seed.signerKey, seedDigest(seed));
@@ -9303,14 +9898,91 @@ export class CadreNode implements SAppIdLookup {
       if (!ack.accepted) {
         throw new ClaimRefusedError(target.peerId, ack.reason ?? 'no reason given', ack.code);
       }
+      // Read before anything else is awaited: the node's restart closes the connection.
+      dialAddrs = this.connectedAddrFirst(target.peerId, target.multiaddrs);
       log('claimNode: %s accepted the claim; vouching it into the cadre', target.peerId);
       // The wrapper queues the write for re-replication: a phone claiming its first
       // always-on node has no control connection yet, so the insert commits local-only.
+      // NOTE: accepted tradeoff — the node's own signed record is not carried in the
+      // acknowledgement and written with this vouch: it would be signed before the node
+      // restarts, so its addresses may not be the restarted node's (a new relay reservation),
+      // and the write-while-alone drain re-sends only rows whose `Sig` is null
+      // (drainPendingPeerWrites, reconstructAuthoredMembership), so a vouch carrying it would
+      // never reach this cadre's other members. The node publishes its record once it has
+      // restarted. Revisit if the drain ever re-sends signed rows.
       await this.vouchPeer(target.peerId, target.multiaddrs, sign);
     });
-    this.retainDialTarget(target.peerId, target.multiaddrs, 'claimNode');
+    this.retainDialTarget(target.peerId, dialAddrs, 'claimNode');
     void this.reconcileControlCohort().catch((error) =>
       log('claimNode: reconcile kick after claiming %s failed: %o', target.peerId, error));
+    void this.redialClaimedNode(target.peerId).catch((error) =>
+      log('claimNode: redialing %s while it restarts failed: %o', target.peerId, error));
+  }
+
+  /**
+   * `addrs` with the address this node's open connection to `peerId` was dialed on moved to
+   * the front, when it is one of them; `addrs` unchanged otherwise. Compared without a
+   * trailing `/p2p/<peerId>`, which a QR code's address may or may not carry ({@link addrKey}).
+   */
+  private connectedAddrFirst(peerId: string, addrs: string[]): string[] {
+    const controlNode = this.controlNode;
+    if (!controlNode) {
+      return addrs;
+    }
+    const remote = peerIdFromString(peerId);
+    const connected = new Set(controlNode.getConnections(remote).map((c) => addrKey(c.remoteAddr.toString(), remote)));
+    const index = addrs.findIndex((addr) => connected.has(addrKey(addr, remote)));
+    return index <= 0 ? addrs : [addrs[index], ...addrs.slice(0, index), ...addrs.slice(index + 1)];
+  }
+
+  /**
+   * Retry a node this node has just claimed ({@link claimNode}) once every
+   * {@link CLAIM_RESTART_REDIAL_STEP_MS} for {@link CONTROL_COHORT_REDIAL_MS} after it accepted.
+   * The node restarts into this party right after it acknowledges, and while it does, a
+   * reconcile pass's dial either fails or opens a connection the restarting node closes at
+   * once. The first failure puts the pass's next redial 15 s out ({@link armReconcileWake}),
+   * and an owner that cannot be dialed has no other way back to the node.
+   *
+   * Each step dials once from the retained dial target, unless a connection to the node is
+   * open: the one the claim used until the restart closes it, or one to the restarted node
+   * that has not identified yet. A dial that connects does not end the loop, because the
+   * restarting node may still close it. The loop ends once the node has identified as serving
+   * this party's control database ({@link identifiedControlPeers}, which the placeholder node
+   * it ran before the claim never joins), at the window's end, when this node stops, or when
+   * the target is forgotten ({@link removePeer}). Steps run one after another, so a dial
+   * finishes on its own budget first. The redial streak is left alone: the ladder carries on
+   * after the window. One loop per peer: a repeated claim while one runs starts none.
+   */
+  private async redialClaimedNode(peerId: string): Promise<void> {
+    if (this.claimRedialPeers.has(peerId)) {
+      return;
+    }
+    this.claimRedialPeers.add(peerId);
+    try {
+      const endsAt = Date.now() + CONTROL_COHORT_REDIAL_MS;
+      while (Date.now() < endsAt && await this.redialClaimedNodeStep(peerId)) {
+        await new Promise<void>((resolve) => {
+          const timer = setTimeout(resolve, CLAIM_RESTART_REDIAL_STEP_MS);
+          // Node-only: a stop mid-window must not keep the event loop alive for the step.
+          (timer as { unref?: () => void }).unref?.();
+        });
+      }
+    } finally {
+      this.claimRedialPeers.delete(peerId);
+    }
+  }
+
+  /** One step of {@link redialClaimedNode}; false ends the loop. */
+  private async redialClaimedNodeStep(peerId: string): Promise<boolean> {
+    const controlNode = this.controlNode;
+    const target = this.bootstrapPeerStore?.all().get(peerId);
+    if (!this._running || !controlNode || !target || this.identifiedControlPeers.has(peerId)) {
+      return false;
+    }
+    if (controlNode.getConnections(peerIdFromString(peerId)).length === 0) {
+      await this.dialBootstrapPeer(peerId, target.addrs, 'claimNode(redial)');
+    }
+    return true;
   }
 
   /**
@@ -9481,11 +10153,13 @@ export class CadreNode implements SAppIdLookup {
    * Steps: refuse an invitation for another party; pin its `ownerKeys` into the node-local
    * anchor (`'invite'` provenance — the pin sticks even if the redemption then fails, as it
    * does for a seed invite, so a later attempt or seed from the same owner is anchored);
-   * sign the request; dial the listed members in order (`redeemAtMembers`); on
-   * acceptance verify the reply against the pinned keys, merge its dial hints into the peer
-   * store, retain the answering member as a cold-start dial target, refresh the membership
-   * gate and start a cohort reconcile pass. This node then syncs the control database over
-   * the connection it already holds, the same unified behaviour as after a seed.
+   * sign the request, which carries this node's own signed address record; dial the listed
+   * members in order (`redeemAtMembers`); on acceptance verify the reply against the pinned
+   * keys, merge its dial hints into the peer store, retain the answering member as a
+   * cold-start dial target and start a cohort reconcile pass. This node then syncs the control
+   * database over the connection it already holds, the same unified behaviour as after a seed.
+   * The member writes the record on this node's `CadrePeer` row when its signature verifies, so
+   * the row resolves to this node's addresses from its admission.
    *
    * A device that is already a member (a restart with the invitation still configured) is
    * answered as accepted by the member's idempotent redemption, with no second usage row.
@@ -9529,12 +10203,20 @@ export class CadreNode implements SAppIdLookup {
     }
     await this.trustOwnerKeys(invitation.ownerKeys, 'invite');
     const pinned = new Set(invitation.ownerKeys);
+    const selfPeerId = controlNode.peerId.toString();
+    // The addresses a publish would carry, sanitized before signing: the member stores the
+    // signature only over the exact list it stores.
+    const record = this.signSelfRecord(selfPeerId, signer, sanitizeAddrs(await this.collectSelfAddrs()), null);
     const request = signRedeemRequest(
       invitation,
       { peerKey: signer.publicKeyB64, peerPrivateKey: signer.privateKeyB64 },
-      generateStampId(controlNode.peerId.toString()),
-      await this.resolveInviteAddresses()
+      generateStampId(selfPeerId),
+      record
     );
+    // Before dialing, not on acceptance: the member's commit can reach this node before its
+    // reply does, and a reconcile pass that reads the row first must find it current. A record
+    // no member wrote matches no row, so a failed redemption leaves nothing to undo.
+    this.lastSignedSelfRecord = record;
     const { reply, memberPeerId, memberAddr } = await redeemInPasses(controlNode, {
       invitation,
       request,
@@ -9546,7 +10228,6 @@ export class CadreNode implements SAppIdLookup {
     });
     log('Cadre invitation %s redeemed at %s', invitation.invite.key, memberAddr);
 
-    const selfPeerId = controlNode.peerId.toString();
     await mergeSeedPeers(controlNode, reply.peers.filter((peer) => peer.peerId !== selfPeerId));
     if (memberPeerId !== null) {
       // Every address the bundle gave the answering member, so a restart has the same choices.
@@ -9555,9 +10236,8 @@ export class CadreNode implements SAppIdLookup {
         .map((addr) => addr.toString());
       this.retainDialTarget(memberPeerId, memberAddrs, 'redeemCadreInvitation');
     }
-    // The pins above flip nothing yet (this node holds no rows), but the rows about to
-    // replicate in are judged against them; refresh so the snapshot is not stale when they land.
-    await this.refreshMembershipGate('invitation-redeemed');
+    // No gate refresh here: the rows about to replicate in are judged against the pins above
+    // when they land, by the gate watch's refresh and the head refresh of this pass.
     void this.reconcileControlCohort().catch((error) =>
       log('redeemCadreInvitation: the post-redemption reconcile pass failed: %o', error));
     return { peerId: memberPeerId, redeemedAt: new Date().toISOString() };
@@ -9737,25 +10417,31 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * {@link redeemOwnerGrant}'s local path: the alone refusal, the seat, the liveness refusal,
-   * then one approval around the consent signature and the write. Every refusal comes before
-   * the approval, so a prompting signer never asks for a redemption this node would refuse.
+   * {@link redeemOwnerGrant}'s local path: the alone refusal, the seat (only when this node holds
+   * no grant row), the liveness refusal, then one approval around the consent signature and the
+   * write. Every refusal comes before the approval, so a prompting signer never asks for a
+   * redemption this node would refuse. The held row is read once and carried into the liveness
+   * check and the write, as the member handler carries it (`MemberRedemptionHandler`).
    */
   private async redeemOwnerGrantLocally(controlDatabase: ControlDatabase, bundle: OwnerGrantBundle, signer: OwnerSigner): Promise<RedeemOwnerGrantResult> {
     if (await this.ownerKeyWriteAlone()) {
       throw new OwnerKeyAddRefusedError(signer.publicKey, 'alone');
     }
-    await refusingUnsyncedGrant(() => controlDatabase.seatOwnerGrant(bundle.grant));
+    const held = await controlDatabase.queryOwnerGrant(bundle.grant.key);
+    if (held === null) {
+      await refusingUnsyncedGrant(() => controlDatabase.seatOwnerGrant(bundle.grant));
+    }
     // The write answers a key that is already an owner without reading the grant, so only a
     // key that is not one needs the grant live (the same permissive pre-check the handler's
     // admission uses; the write enforces every condition).
-    if (!(await controlDatabase.getOwnerKeys()).has(signer.publicKey) && !await controlDatabase.isOwnerGrantLive(bundle.grant)) {
+    if (!(await controlDatabase.getOwnerKeys()).has(signer.publicKey) && !await controlDatabase.isOwnerGrantLive(bundle.grant, held)) {
       throw new OwnerGrantRejectedError('grant-spent', 'The grant is expired, withdrawn, exhausted, or its issuer is no longer an owner');
     }
     const { alreadyOwner } = await signer.approve(ownerGrantApproval(bundle), async (sign) => {
       const request = await this.signOwnerGrantRequest(bundle, signer, sign);
       return await refusingUnsyncedGrant(() => controlDatabase.redeemOwnerGrant({
         grantKey: bundle.grant.key,
+        ...(held ? { held } : {}),
         seatedKey: signer.publicKey,
         usageStampId: request.usageStampId,
         grantSig: request.grantSig,
@@ -9950,8 +10636,7 @@ export class CadreNode implements SAppIdLookup {
       // Overridden on the same grounds: only this node holds the running strand
       // instance's database and this party's `StrandPartyKey` identity, and a wrong
       // issuer here would admit joiners under someone else's authority.
-      issueMembershipInvite: (strandId: string, signal?: AbortSignal) =>
-        this.issueStrandMembershipInvite(strandId, signal)
+      issueMembershipInvite: (host, signal) => this.issueStrandMembershipInvite(host, signal)
     });
 
     const previous = this.strandSolicitationService;
@@ -10259,10 +10944,17 @@ export class CadreNode implements SAppIdLookup {
       selfId: this.controlNode!.peerId.toString(),
       linkRoundTripMs: this.config.network?.linkRoundTripMs,
       isOwner: () => this.isOwner(),
-      // NOTE: one owner-key read and one pending-join read (three tables) per pass (30 s); for a
-      // party that never asked for a join the second reads never-written blocks, which consults
-      // the cohort. If it shows up in a device profile, poll more slowly while the tables read empty.
       readRows: () => database().queryPendingJoins(),
+      // What `isOwner` and `queryPendingJoins` read: the owner keys, the joins and their
+      // outcomes, and the tombstones both filter by. A dismissal writes its tombstone with the
+      // request's delete, but the two can replicate separately.
+      watchChanges: (onChange, options) => database().watchTables([
+        'CadreControl.JoinRequest',
+        'CadreControl.JoinSuccess',
+        'CadreControl.JoinFailure',
+        'CadreControl.OwnerKey',
+        'CadreControl.Revocation',
+      ], onChange, options),
       readRow: (id) => database().queryPendingJoin(id),
       attempt: (join) => this.formStrand(this.pendingJoinInvitation(join), parseStoredDisclosure(join)),
       record: (expected, outcome) => ownerWrite(`Record the outcome of the pending join ${expected.Id}`,
@@ -10328,6 +11020,13 @@ export class CadreNode implements SAppIdLookup {
    * token is spent, and a join no store names would vanish at the next restart.
    */
   private async rememberFormedStrand(result: FormStrandResult): Promise<void> {
+    // NOTE: accepted tradeoff — the party-wide `JoinedStrand` row is not written here, in
+    // formStrand's own approval, but later by an owner machine's connected reconcile pass
+    // (`JoinedStrandSession.syncWithParty`). That publish is gated on a control connection so a
+    // machine cut off from its own party never commits it alone, and during formStrand the
+    // count always includes the connection to the other party's responder, so the gate would
+    // always pass here. Non-owner and signer-less machines need this local path regardless.
+    // Revisit if the gate can tell a connection to this party's own machines from any other.
     try {
       await this.joinedStrands!.remember({
         Id: result.strandId,
@@ -10371,7 +11070,7 @@ export class CadreNode implements SAppIdLookup {
    */
   private async adoptFormationMembershipInvite(strandId: string, invite: StrandMembershipInvite): Promise<void> {
     try {
-      await this.ensureStrandPartyKey(strandId);
+      this.formedPartyKeys.set(strandId, await this.ensureStrandPartyKey(strandId));
     } catch (error) {
       throw new FormationPostApprovalError(
         strandId,
@@ -10422,6 +11121,10 @@ export class CadreNode implements SAppIdLookup {
    * implements): mint a single-use `Strand.Invite` against the LIVE host strand so a
    * validated joiner can seat its own `Strand.Member` row.
    *
+   * `host` is the strand as the formation session resolved it from its `Strand` row, read
+   * once there; this method reads no `Strand` row of its own. A row removed in between is
+   * refused when the consent row is written (the `StrandExists` CHECK).
+   *
    * - Open host strand → `null` (no members, nothing to invite into).
    * - Closed host strand whose founder launch was refused as pre-split
    *   ({@link strandLaunchRefusals}) → rethrow the recorded `PreSplitStrandIdentityError`;
@@ -10470,19 +11173,14 @@ export class CadreNode implements SAppIdLookup {
    * not a retry.
    */
   private async issueStrandMembershipInvite(
-    strandId: string,
+    host: BoundHostStrand,
     signal?: AbortSignal
   ): Promise<StrandMembershipInvite | null> {
+    const { strandId } = host;
     if (!this.controlDatabase) {
       throw new Error(`Cannot issue a membership invitation for strand ${strandId}: control database unavailable`);
     }
-    const row = await this.controlDatabase.queryStrand(strandId);
-    if (!row) {
-      // The bound resolution saw this row moments ago; a vanished row is a concurrent
-      // unpublish — reject rather than invite into a strand this party just removed.
-      throw new Error(`Cannot issue a membership invitation for strand ${strandId}: its Strand row is gone`);
-    }
-    if (row.Type !== 'c') {
+    if (host.strandType !== 'c') {
       return null;
     }
     const refusal = this.strandLaunchRefusals.get(strandId);
@@ -10504,8 +11202,8 @@ export class CadreNode implements SAppIdLookup {
         'not live on this responder (not launched, or still starting)'
       );
     }
-    if (row.MemberPrivateKey) {
-      await assertNotPreSplitStrand(db, strandId, strandMemberKeyPair(row.MemberPrivateKey).publicKeyB64);
+    if (host.memberPrivateKey) {
+      await assertNotPreSplitStrand(db, strandId, strandMemberKeyPair(host.memberPrivateKey).publicKeyB64);
     }
     if (signal?.aborted) {
       throw new Error(