@serfab/cadre-core 1.17.0 → 1.19.0

package/dist/control-database.d.ts

@@ -2,9 +2,12 @@ import { Database } from '@quereus/quereus';
 import type { SqlParameters } from '@quereus/quereus';
 import type { Libp2p } from '@libp2p/interface';
 import type { IRepo } from '@optimystic/db-core';
-import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, OwnerGrantRow, OwnerGrantUsageRow, OwnerGrantRedemptionResult, OwnerGrantStatus, SeedPeer, MachineRemovalResult } from './types.js';
+import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, DeviceTokenRecord, DeviceTokenRow, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, OwnerGrantRow, OwnerGrantUsageRow, OwnerGrantRedemptionResult, OwnerGrantStatus, SeedPeer, MachineRemovalResult } from './types.js';
 import type { ControlTable, RevocableTable, BoundControlDomain, ControlAction, CadreInviteSignedFields, OwnerGrantSignedFields } from './control-authorization.js';
+import type { ControlWriteRetryOptions } from './control-write-retry.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
+import type { TableChangeWatch, TableChangeWatchOptions } from './table-change-watch.js';
+import type { FormationInviteFacts } from './formation-token.js';
 export type { ControlTable, RevocableTable, ControlDomain, ControlAction } from './control-authorization.js';
 /**
  * Generate a unique stamp ID for transaction authorization.
@@ -18,12 +21,11 @@ export declare function generateStampId(peerId: string): string;
  * present locally.
  *
  * Consent is bound to the strand's one-off `StampId` (see the consent branch of
- * `Strand.AuthorizedInsert`), so the writer must read the live row before inserting.
- * The ordinary "host strand has not converged on this responder yet" case is caught
- * earlier and reported as `missing` by `ControlFormationUsageRecorder.resolveStrand`;
- * reaching here means the row vanished between that check and the write, which is a
- * genuine race and is surfaced rather than left to fail the deferred `StrandExists`
- * CHECK at commit (which would drop the write with a far less legible error).
+ * `Strand.AuthorizedInsert`), so a writer not handed the stamp reads the live row before
+ * inserting, and throws this when the row is absent rather than leaving it to fail the
+ * deferred `StrandExists` CHECK at commit (a far less legible error). The formation
+ * responder hands the stamp over from `ControlFormationUsageRecorder.resolveStrand`, which
+ * reports an absent row as `missing`; a row removed after that read fails the CHECK instead.
  */
 export declare class MissingHostStrandError extends Error {
     readonly strandId: string;
@@ -59,16 +61,16 @@ export declare class FormationAbortedError extends Error {
  * the write, inside {@link ControlDatabase.redeemInvitation} /
  * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
  * ({@link ControlDatabase.redeemCadreInvite}) and an owner grant
- * ({@link ControlDatabase.redeemOwnerGrant}), and off the unlocked pre-check
- * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
- * pass — and off nothing else. It exists because
+ * ({@link ControlDatabase.redeemOwnerGrant}), and off the unlocked re-check
+ * `ControlFormationUsageRecorder.authorizeUsage` runs after an outside approval, before the
+ * manager issues a membership pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
  * schema's own count-based cap clause, which the manager reports as a retryable
  * `Formation conflict, retry` — telling the joiner to retry something that can never succeed.
  * Two redemptions of one token racing on the SAME node serialize behind the local write
- * queue, so the loser reads the winner's committed row and is refused here by name —
- * `StrandFormationManager.validateToken`'s `isTokenUsed` check cannot catch that, since it
- * ran before either redemption wrote anything.
+ * queue, so the loser reads the winner's committed row and is refused here by name — the
+ * use count `StrandFormationManager.validateToken` reads cannot catch that, since it was
+ * read before either redemption wrote anything.
  */
 export declare class InvitationExhaustedError extends Error {
     readonly token: string;
@@ -324,6 +326,56 @@ export declare function ownerKeyLabel(label: string | null | undefined): string
  * other control writes, sign outside the lock and re-check the stamp inside it.
  */
 export type ControlSign = (message: Uint8Array) => string | Promise<string>;
+/**
+ * Signs this node's own address record over its `CadrePeer` row as it stands —
+ * {@link ControlDatabase.updateSelfPeerRecord}'s callback, run inside the locked write body on
+ * every attempt, so the record written is always stamped past the row that was actually read.
+ */
+export type SelfRecordSigner = (current: PeerAddressRecord) => PeerAddressRecord;
+/**
+ * Which owner re-touch {@link ControlDatabase.reauthorizeCadrePeer} makes over a `CadrePeer` row:
+ *
+ * - `'rebroadcast'` — the write-while-alone drain re-emitting a row that committed local-only. It
+ *   bumps `UpdatedAt` so the row goes out as a fresh transaction, and writes only while the row's
+ *   `Sig` is null: once the machine has self-published, the row is its to refresh, and a bump
+ *   without a re-sign would leave its signature unverifiable.
+ * - `'revouch'` — an owner rebinding the row's voucher to its own key before the vouching key is
+ *   removed (`CadreNode.removeOwner`). Written whether or not the machine has self-published, and
+ *   leaves `UpdatedAt` untouched, so a self-signed record stays verifiable.
+ */
+export type CadrePeerRetouchMode = 'rebroadcast' | 'revouch';
+/**
+ * What {@link ControlDatabase.reauthorizeCadrePeer} found and did: the row was re-touched; no
+ * readable row exists (absent, or its stamp retired); or — `'rebroadcast'` only — the machine has
+ * self-published since, so the row is no longer the owner's to re-emit. The two no-write outcomes
+ * are decided over the row as read inside the locked body, so a caller can act on them.
+ */
+export type CadrePeerRetouchOutcome = 'retouched' | 'absent' | 'self-published';
+/** A formation invitation written with a founding ({@link FoundingRows}), bound to the strand founded. */
+export interface FoundingInvite {
+    /** The invitation token, the `FormationInvite` primary key. */
+    token: string;
+    /** The sApp a redeemed strand will use. */
+    sAppId: string;
+    /** Epoch ms after which it cannot be redeemed; omit for never. */
+    expiresAtMs?: number;
+    /** How many redemptions it allows; omit for unlimited. */
+    totalUses?: number;
+    /** Web hook sent the disclosure; a `ValidationKey` then signs off each redemption. */
+    validationUrl?: string;
+}
+/** The control rows one founding writes together; see {@link ControlDatabase.insertFoundingRows}. */
+export interface FoundingRows {
+    strand: {
+        id: string;
+        type: 'o' | 'c';
+        memberPrivateKey?: string;
+    };
+    /** This party's membership identity key for a closed strand; absent for an open strand, or when a stored key is adopted. */
+    partyKey?: string;
+    /** A formation invitation bound to this strand (its `StrandId` is `strand.id`). */
+    formationInvite?: FoundingInvite;
+}
 /** What an owner asks {@link ControlDatabase.insertCadreInvite} (or {@link ControlDatabase.signCadreInvite}) to sign. */
 export interface CadreInviteFields {
     /** The invitation public key (base64url ed25519), the row's primary key. */
@@ -336,14 +388,15 @@ export interface CadreInviteFields {
     totalUses?: number | null;
 }
 /** The control tables keyed by a strand id whose repeat insert a caller may treat as idempotent. */
-type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
+type StrandIdTable = Extract<RevocableTable, 'Strand' | 'StrandPartyKey' | 'JoinedStrand'>;
 /**
  * Did this write to `table` fail because the strand id is already seated there?
  *
  * {@link CadreNode.publishStrand} uses this to tell "my own earlier publish already
  * landed" (re-read, and no-op when the row matches) apart from every other rejection —
  * an unauthorized signer, a retired stamp — which must keep surfacing. For `JoinedStrand`
- * the same test tells "another machine of this party already published this join" apart.
+ * the same test tells "another machine of this party already published this join" apart, and
+ * for `StrandPartyKey` it tells a founding that this party's key for the id is already seated.
  *
  * Matched by TEXT, not by type: the typed engine error does not survive the trip out of
  * optimystic (same constraint the retry classifiers in `control-write-retry.ts` document).
@@ -390,17 +443,6 @@ export declare class PendingJoinChangedError extends Error {
     readonly live: PendingJoin | null;
     constructor(id: string, live: PendingJoin | null);
 }
-/**
- * The one `CadreControl.Revocation` row that retires nothing, filed once by an owner
- * ({@link ControlDatabase.openRevocationLedger}) so the table is never a never-written
- * block. The schema's table comment says why that matters and why the row can never read
- * as a retirement; `RowIsGone` pins this exact triple.
- */
-export declare const REVOCATION_LEDGER_MARKER: {
-    readonly tableName: "Revocation";
-    readonly rowKey: "ledger";
-    readonly stampId: "opened";
-};
 /**
  * Project `CadrePeer` rows into the {@link SeedPeer} list a seed, or a cadre invitation
  * redemption reply, carries. `minterPeerId` is the machine minting the seed or answering the
@@ -431,16 +473,8 @@ export declare function projectSeedPeers(rows: readonly CadrePeerRow[], minterPe
 export declare const REAPABLE_TABLES: readonly ["CadrePeer", "DeviceToken", "ValidationKey", "JoinedStrand", "JoinRequest"];
 export type ReapableTable = (typeof REAPABLE_TABLES)[number];
 /** A `FormationInvite` row as {@link ControlDatabase.queryFormationInvite} reads it. */
-export interface FormationInviteRow {
+export interface FormationInviteRow extends FormationInviteFacts {
     token: string;
-    sAppId: string;
-    /** Parsed epoch ms of the stored `datetime`; null when the invitation never expires. */
-    expiresAtMs: number | null;
-    /** Null is unlimited. */
-    totalUses: number | null;
-    validationUrl: string | null;
-    /** A bound invitation's host strand; null on the responder-provisions path. */
-    strandId: string | null;
 }
 /**
  * Notified after a membership write (a `CadreControl.CadrePeer` or `OwnerKey` row, see
@@ -513,6 +547,7 @@ export interface ControlDatabaseConfig {
 export declare class ControlDatabase {
     private db;
     private collectionFactory;
+    private txnBridge;
     private readonly config;
     private initialized;
     private membershipListener;
@@ -520,6 +555,18 @@ export declare class ControlDatabase {
     private controlWriteAbandonedListener;
     /** Tail of the local-write chain — see {@link withWriteLock}. */
     private writeQueue;
+    /** Subscriptions handed out by {@link watchTables}. */
+    private readonly tableWatches;
+    /** The cached membership tables; see {@link readMembershipRows}. */
+    private readonly revocationView;
+    private readonly cadrePeerView;
+    private readonly ownerKeyView;
+    private readonly cadreInviteView;
+    private readonly cadreInviteUsageView;
+    private readonly ownerGrantView;
+    private readonly ownerGrantUsageView;
+    /** Each membership view by the qualified table it copies, for {@link watchMembershipViews}, {@link watchMembershipTables} and {@link invalidateMembershipViews}. */
+    private readonly membershipViews;
     /**
      * Locked write bodies currently running (see {@link runWriteBody}); what
      * {@link readRowsOnce} consults to route an unlocked read around a write that has
@@ -546,6 +593,30 @@ export declare class ControlDatabase {
      * Initialize the database - load schema and register plugins
      */
     initialize(): Promise<void>;
+    /**
+     * Drop a membership view whenever its table changes: a commit made here, or a change this
+     * node's storage takes in from elsewhere. `onInvalidate` is the whole consumer, so the run
+     * does nothing; no backstop, since {@link MEMBERSHIP_VIEW_MAX_AGE_MS} bounds what the
+     * subscription cannot hear. {@link close} disposes it with the rest.
+     */
+    private watchMembershipViews;
+    /**
+     * {@link watchTables} on the membership tables: the seven the membership views copy
+     * (`CadrePeer`, `OwnerKey`, `Revocation`, `CadreInvite`, `CadreInviteUsage`, `OwnerGrant`,
+     * `OwnerGrantUsage`), which are exactly what the membership gate and the owner-anchor sync
+     * read. `CadreNode.start` takes its gate watch here, so the gate hears every table its
+     * reads can depend on and no list of them lives outside this class.
+     */
+    watchMembershipTables(onChange: () => Promise<void>, options: TableChangeWatchOptions): TableChangeWatch;
+    /**
+     * Empty every membership view, so the next read of each loads afresh and no load in
+     * flight installs. Besides {@link initialize} and {@link close}, `CadreNode` calls it when
+     * a sibling becomes reachable (its identify on a new connection): a machine that was offline
+     * while that sibling committed learns of the commit only when it next reads the block from
+     * storage, and dropping the views makes the pass that starts then read now rather than after
+     * `MEMBERSHIP_VIEW_MAX_AGE_MS`.
+     */
+    invalidateMembershipViews(): void;
     private loadSchema;
     /** Apply the declared control schema, retrying transient cohort failures. */
     private applyControlSchema;
@@ -679,6 +750,39 @@ export declare class ControlDatabase {
      * under-lock callback seam is ever added, audit its read graph the same way.
      */
     private readRows;
+    /**
+     * {@link readRows}, also saying whether the attempt that answered took the committed-read
+     * path — which a {@link MembershipView} load needs, since it may not keep such rows (see
+     * {@link membershipView}).
+     */
+    private readRowsRouted;
+    /**
+     * A view over one membership table, loaded by its full scan `sql` through {@link readRows}'s
+     * funnel. Rows a committed read served are never kept: that read may initialize an untouched
+     * table provisionally, and the Optimystic plugin arms a table's replicated-change bridge only
+     * on its full initialization (`OptimysticTable.initializeForCommittedRead`), so no later change
+     * event would ever drop them.
+     */
+    private membershipView;
+    /**
+     * A membership table's raw rows, from its {@link MembershipView}: `Revocation`, `CadrePeer`
+     * and `OwnerKey`, the tables every membership, owner and peer-record read starts from, and
+     * `CadreInvite`, `CadreInviteUsage`, `OwnerGrant` and `OwnerGrantUsage`, the chains every
+     * membership refresh verifies invitation-admitted machines and grant-seated owner keys through.
+     * Callers build fresh result objects from them and never mutate them.
+     *
+     * Reads the table directly instead when a caller under the write lock (`retry: false`) has an
+     * explicit transaction open: such a read sees the transaction's own uncommitted rows, which
+     * the view does not hold, and a rollback fires no change event, so keeping them would cache
+     * rows that never existed. No reader of these tables runs inside {@link inTransaction} today;
+     * this keeps one added later, or a spec's raw-handle transaction, correct.
+     *
+     * Reads that stay plain SQL on purpose: {@link queryStampId} (sees retired rows), the
+     * schema's CHECK constraints, which read inside the committing transaction, the redemption's
+     * one read of the held credential row ({@link queryCadreInvite},
+     * {@link queryOwnerGrant}), and the indexed usage counts.
+     */
+    private readMembershipRows;
     /**
      * Query all strands from the control database
      */
@@ -690,6 +794,14 @@ export declare class ControlDatabase {
      * validated invitee during provision-then-record formation.
      */
     queryStrand(strandId: string): Promise<StrandRow | null>;
+    /**
+     * {@link queryStrand} plus the row's `StampId`, in one read: the formation responder
+     * resolves a bound invite's host strand with it and later records consent against that
+     * stamp ({@link recordFormationUsage}'s `strandStampId`) without reading the row again.
+     */
+    queryStrandWithStamp(strandId: string): Promise<(StrandRow & {
+        StampId: string;
+    }) | null>;
     /**
      * Every strand this party joined from another party (`CadreControl.JoinedStrand`), shaped
      * as a {@link StrandRow} so a reader can treat it like one of the party's own. A joiner
@@ -735,6 +847,9 @@ export declare class ControlDatabase {
      *
      * Deliberately RAW (no retired-stamp filter, unlike {@link getOwnerKeys}): the genesis
      * insert is refused by the schema whenever any physical row exists, so this must see one.
+     * Served from the `OwnerKey` membership view ({@link readMembershipRows}), which holds every
+     * physical row, so a genesis caller's pre-check and {@link ensureOwnerKey}'s re-check share
+     * one storage read.
      */
     hasOwnerKey(): Promise<boolean>;
     /**
@@ -742,9 +857,44 @@ export declare class ControlDatabase {
      * the party has none yet. Returns true if it inserted, false if an owner
      * key already existed (so a repeat `--owner` start is a no-op).
      *
+     * Before the insert, gives every control table its empty collection
+     * ({@link commitEmptyControlCollections}). A collection committed while a machine is alone
+     * forks if another machine creates the same collection independently; before genesis the
+     * party has no owner, so no other machine can have been admitted and none can hold any of
+     * its collections. The order makes the step repeatable: a crash between it and the insert
+     * leaves no `OwnerKey` row, so the next start runs genesis again and commits only the
+     * collections still missing, while a founder restart finds the row and commits nothing, so
+     * it can never write an empty second history beside a table another machine has since
+     * written. A failure propagates with nothing inserted.
+     *
      * @param label - the user's name for the key ({@link insertOwnerKey}).
      */
     ensureOwnerKey(key: string, label?: string): Promise<boolean>;
+    /**
+     * Commit an empty collection for every `CadreControl` table, index tree and unique-enforcement
+     * tree that has none, so a read of a table nobody has written is answered from this machine's
+     * storage instead of asking the block's cohort to prove the collection absent — a round trip
+     * per read on a party of several machines, and an error or a wait while they are offline.
+     * Joining machines get these collections the ordinary way, by reading them from the cohort.
+     *
+     * Under the write lock: the helper commits whatever is staged in those collections outside any
+     * SQL transaction, which is sound only while nothing else writes.
+     *
+     * Parties founded before this step, and tables a later control schema version adds, have no
+     * such collections, and nothing creates them later: the start-time schema apply runs on every
+     * machine, possibly alone, where committing one would be exactly the fork genesis avoids.
+     *
+     * NOTE: one `sync()` per collection, in sequence: 32 collections for today's schema (17 tables,
+     * 3 indexes, 12 `unique` columns). Measured 2026-10-20 on a lone `CadreNode` over the network
+     * transactor (started, then `ensureOwnerKey` alone, 3 runs each): 64–105 ms in memory and
+     * 750–820 ms on `FileRawStorage`, about 25 ms per collection on disk, roughly 1/75 of the edge
+     * node's 60 s `DEFAULT_OWNER_GENESIS_TIMEOUT_MS`. Under the whole cadre-core suite's load (151
+     * geneses) it took a median of 159 ms and at most 4.6 s. If genesis latency starts to matter
+     * (phone flash under launch contention runs 50–90 ms per storage operation, see the NOTE in
+     * `initialize`), ask Optimystic for an API that commits them as one batch, the one strand
+     * founding would use too; do not build a private batching path.
+     */
+    private commitEmptyControlCollections;
     /**
      * Collect every owner key (`CadreControl.OwnerKey.Key`) as a set.
      *
@@ -783,9 +933,8 @@ export declare class ControlDatabase {
      *
      * @param retired - the retired `OwnerKey` stamps, when the caller has already read the
      *   tombstones (`CadreNode.syncOwnerAnchor` reads {@link queryRevocations} for their
-     *   signers); omitted, they are read here. Before the ledger marker is filed every
-     *   `Revocation` read is a cohort consult, so the sync passing its own set keeps the
-     *   membership refresh at one such read for the anchor.
+     *   signers); omitted, they are read here. Both come from the same `Revocation` view
+     *   ({@link readMembershipRows}), so passing the set saves only the filtering.
      */
     queryOwnerKeyRows(retry?: boolean, retired?: ReadonlySet<string>): Promise<OwnerKeyRow[]>;
     /**
@@ -800,12 +949,8 @@ export declare class ControlDatabase {
      * {@link queryRevokedStamps} rather than inlining the SQL, so tests can interpose on
      * that seam to model the replicated live-row-plus-tombstone merge state.
      *
-     * NOTE: runs a second query (the retired-stamp set) per call, on the membership-gate
-     * refresh path. Its cost is storage consults, not rows (see {@link queryRevokedStamps}):
-     * while `Revocation` has never been written every call consults the cohort about it, and
-     * the ledger marker ({@link openRevocationLedger}) is what makes it a held block. Folding
-     * the exclusion into one statement would not help (it reads the same block), and caching
-     * the set would hide a tombstone arriving by replication.
+     * Both tables come from their membership views ({@link readMembershipRows}), so a call after
+     * the first costs no storage read until one of the two tables changes.
      *
      * NOTE: this filter is HAND-MIRRORED by the gate suites' fake control databases
      * (`test/membership-gate-helpers.ts` and `test/cadre-node-authorized-surface.spec.ts`),
@@ -866,17 +1011,18 @@ export declare class ControlDatabase {
      * guard. A read retrying there would sleep its backoff HOLDING the write lock
      * (`retryControlWrite`'s contract is that backoff sleeps happen with no lock held), and
      * the write funnel already re-runs the body's reads when it re-runs the body. The
-     * unlocked callers — the public stamp readers, {@link reauthorizeCadrePeer} and
-     * {@link reapRevokedRow}, whose stamp reads run BEFORE their locks are taken — keep the
-     * default retried path. Explicit per call rather than an ambient flag: unlocked reads
-     * run concurrently with a locked body, so `this`-state cannot tell the two apart.
+     * unlocked callers — the public stamp readers and {@link reapRevokedRow}, whose stamp
+     * read runs BEFORE its lock is taken — keep the default retried path. Explicit per call
+     * rather than an ambient flag: unlocked reads run concurrently with a locked body, so
+     * `this`-state cannot tell the two apart. The same flag threads through
+     * {@link findCadrePeerRow} for the two writers that read the whole row inside their body.
      */
     private queryStampId;
     /**
      * `CadrePeer` stamp nonce — read by {@link SeedBootstrapService.removePeer} as its
      * row-present gate before it delegates to {@link deleteCadrePeer}. The in-class
-     * `CadrePeer` writers ({@link insertCadrePeer}, {@link reauthorizeCadrePeer}) go
-     * straight to {@link queryStampId}.
+     * `CadrePeer` writers go straight to {@link queryStampId} ({@link insertCadrePeer}) or read
+     * the whole row ({@link reauthorizeCadrePeer}, through {@link findCadrePeerRow}).
      */
     queryCadrePeerStampId(peerId: string): Promise<string | null>;
     /**
@@ -913,33 +1059,34 @@ export declare class ControlDatabase {
      * ({@link queryCadrePeers}, {@link queryPeerRecord},
      * {@link CadreNode.resolveDeviceToken}) drop any row whose stamp appears here.
      *
-     * NOTE: the per-call cost that matters is the storage layer's, not the row count. While
-     * `Revocation` has never been written, this node does not hold its block, and Optimystic
-     * consults a block's cohort on every read of a block it does not hold: 1 consult per
-     * call (measured), each a round trip to every other member on a multi-machine party. The
-     * ledger marker ({@link openRevocationLedger}) ends that — a held block is re-consulted
-     * at most once per read-repair window (10 s). Do not cache the set instead: a cache
-     * cannot see a tombstone arriving by replication, so it would delay a revocation. The
-     * row count only grows (append-only) but stays small while removals are rare; revisit if
+     * Served from the `Revocation` membership view ({@link readMembershipRows}), dropped by
+     * every change to the table, local or replicated into this node's storage, so a tombstone
+     * arriving by replication is seen on the next call. The cost that matters is the storage
+     * layer's, paid by a cold view's load: while `Revocation` has never been written, this node
+     * does not hold its block, and Optimystic consults a block's cohort on every read of a block
+     * it does not hold, each a round trip to every other member on a multi-machine party. The row
+     * count only grows (append-only) but stays small while removals are rare; revisit if
      * removals become routine and the scan itself shows up in a profile.
      *
      * An isolated node that has never received the `Revocation` block reads it as holding no
-     * revocations instead of throwing — see {@link readRevokedStampRows}.
+     * revocations instead of throwing — see {@link readRevocationRowsOrNone}.
      *
      * `retry: false` is forwarded by {@link queryCadrePeers} for the one caller that reads
      * under the write lock — see that method's note.
      */
     queryRevokedStamps(tableName: RevocableTable, retry?: boolean): Promise<Set<string>>;
     /**
-     * The `Revocation` scan behind {@link queryRevokedStamps}, answering NO ROWS when the read
-     * fails `cohort-unreachable` ({@link isCohortUnreachableRead}): this node does not hold
+     * The `Revocation` rows behind {@link queryRevokedStamps}, answering NO ROWS when the view's
+     * load fails `cohort-unreachable` ({@link isCohortUnreachableRead}): this node does not hold
      * the block and could ask no other cohort member about it. Every other failure rethrows.
      * The retry in {@link readRows} runs first, so a node whose connectivity returns within
-     * the read budget still gets the real answer.
+     * the read budget still gets the real answer. The empty answer is never installed in the
+     * view (a failed load keeps nothing), so the next call asks again.
      *
      * Without this, a machine cut off from every other machine in its party before it ever
-     * received the block — the block does not exist anywhere until the owner files the
-     * ledger marker ({@link openRevocationLedger}) on a connected reconcile pass — cannot
+     * received the block — a joining machine gets it only by reading it from the cohort, and
+     * on a party founded before genesis created every control collection it exists nowhere
+     * until the first tombstone or the marker ({@link REVOCATION_LEDGER_MARKER}) — cannot
      * answer ANY membership, peer-record or device-token lookup, although it holds those
      * rows locally.
      *
@@ -958,12 +1105,12 @@ export declare class ControlDatabase {
      *
      * NOTE: an isolated node pays the whole read retry (up to
      * `CONTROL_READ_RETRY_BUDGET_MS`, plus the slow attempt that exhausted it) before this
-     * answers, and {@link queryPeerRecord} then issues its row scan on top. If an isolated
-     * node's lookups are seen exceeding the admission gate's 2 s deadline
-     * (`ADMISSION_DECISION_TIMEOUT_MS`), skip the retry for this read when the first attempt
-     * fails `cohort-unreachable`.
+     * answers, on every call since the answer is not kept, and {@link queryPeerRecord} may then
+     * load the `CadrePeer` view on top. If an isolated node's lookups are seen exceeding the
+     * admission gate's 2 s deadline (`ADMISSION_DECISION_TIMEOUT_MS`), skip the retry for this
+     * read when the first attempt fails `cohort-unreachable`.
      */
-    private readRevokedStampRows;
+    private readRevocationRowsOrNone;
     /**
      * Every locally-held `CadreControl.Revocation` tombstone — identity triple, its
      * `ReissuedAt` counter and the stored signer pair. Consumed by the cohort-growth re-issue
@@ -972,17 +1119,18 @@ export declare class ControlDatabase {
      * `where`, so the composite-primary-key point-lookup hazard (see the statement comment in
      * {@link reissueRevocations}) does not arise. Unlocked, like every other read.
      *
-     * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}): it retires nothing, so
-     * neither sweep may reap or re-sign it, and skipping it keeps `RevocationRow.tableName`
-     * a {@link RevocableTable}. Filtered on `TableName` alone, in TypeScript: `RowIsGone`
-     * admits no other row under `'Revocation'`.
+     * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}) an older party may hold: it
+     * retires nothing, so neither sweep may reap or re-sign it, and skipping it keeps
+     * `RevocationRow.tableName` a {@link RevocableTable}. Filtered on `TableName` alone, in
+     * TypeScript: `RowIsGone` admits no other row under `'Revocation'`.
      *
      * `retry: false` from a caller that reads under the write lock, for the reason on
      * {@link queryCadrePeers}.
      */
     queryRevocations(retry?: boolean): Promise<RevocationRow[]>;
     /**
-     * Read a single peer's address record (the full `CadrePeer` row) by PeerId.
+     * Read a single peer's address record (the full `CadrePeer` row) by PeerId, found in the
+     * `CadrePeer` membership view ({@link readMembershipRows}).
      *
      * Returns null when no row exists, or when the row's `StampId` is retired in
      * `CadreControl.Revocation` — a revoked peer reads as absent, so the resolver
@@ -998,10 +1146,22 @@ export declare class ControlDatabase {
      * The split `addrs` re-join to the exact stored `Multiaddr` (split-on-`,` is
      * the inverse of join-on-`,`), so the resolver re-verifies over the same bytes
      * the publisher signed.
+     *
+     * `retry: false` from the one caller that reads under the write lock,
+     * {@link updateSelfPeerRecord}'s body, for the reason on {@link queryCadrePeers}.
+     */
+    queryPeerRecord(peerId: string, retry?: boolean): Promise<PeerAddressRecord | null>;
+    /**
+     * One readable `CadrePeer` row by PeerId from the membership view, or null when no row exists
+     * or its stamp is retired in `Revocation` — the single-row read behind {@link queryPeerRecord}
+     * and the two writers that decide over the row inside their locked body
+     * ({@link updateSelfPeerRecord}, {@link reauthorizeCadrePeer}). Same retired-stamp rule as
+     * {@link queryCadrePeers}, and the same `retry` contract.
      */
-    queryPeerRecord(peerId: string): Promise<PeerAddressRecord | null>;
+    private findCadrePeerRow;
     /**
-     * Apply a peer's own self-signed address-record update to an existing row.
+     * Apply a peer's own self-signed address-record update to its existing row: read the row
+     * under the write lock, have `sign` build the record over it, and write that record.
      *
      * Authorization is carried entirely by the record: the `Sig` column (verified
      * by the `AuthorizedUpdate` self-branch against the stored `PublicKey`) plus
@@ -1010,6 +1170,21 @@ export declare class ControlDatabase {
      * exists. `PublicKey` is intentionally not in the SET list (it is immutable on
      * self-update and the constraint enforces `new.PublicKey = old.PublicKey`).
      *
+     * The read, the decision and the signature all run INSIDE the locked body, which is what
+     * lets it opt into {@link LOST_UPDATE_RETRY_POLICY}: the row has a second writer, the owner's
+     * re-touch ({@link reauthorizeCadrePeer}), and the two fire together while a cadre starts.
+     * When this write loses that race the commit is refused as a lost update and re-run, and the
+     * re-run reads the row the rival left — including its bumped `UpdatedAt`, which a record
+     * signed before the race could no longer exceed — and signs past it. A record signed outside
+     * the body would be re-presented unchanged and refused again, this time by the schema's
+     * monotonic rule, which is correctly never retried. The row's read inside is `retry: false`
+     * (see {@link queryStampId}'s NOTE).
+     *
+     * Returns the record actually written, so the caller's bookkeeping describes the row rather
+     * than the first record it signed; null, and nothing written, when no readable row exists:
+     * the row is absent, or its stamp is retired in `Revocation` (a revoked node reads its own row
+     * as absent every heartbeat, and must not refresh it).
+     *
      * Deliberately NOT wrapped in {@link mutateCadrePeer}, the one `CadrePeer` mutator that
      * is not: it only ever touches THIS node's own row (sole caller
      * `CadreNode.publishSelfRecord`), and `CadreNode.listAuthorizedMembers` filters self out
@@ -1022,8 +1197,11 @@ export declare class ControlDatabase {
      * row, and a self insert happens once at startup, so the wasted refresh is a single read
      * — cheaper than a conditional carve-out inside the shared writer. Only the repeating
      * path is worth exempting.
+     *
+     * @param peerId - the row to refresh: this node's own.
+     * @param sign - builds the signed record over the row as read; called once per attempt.
      */
-    updateSelfPeerRecord(record: PeerAddressRecord): Promise<void>;
+    updateSelfPeerRecord(peerId: string, sign: SelfRecordSigner): Promise<PeerAddressRecord | null>;
     /**
      * Read a single peer's device push token (the full `DeviceToken` row) by PeerId.
      *
@@ -1146,6 +1324,13 @@ export declare class ControlDatabase {
      * body, and a row whose stamp is already retired (held without its delete) is skipped rather
      * than tombstoned twice. Nothing to remove writes nothing and returns all false.
      *
+     * Opted into {@link LOST_UPDATE_RETRY_POLICY} for the reason on {@link deleteCadrePeer}: every
+     * stamp and signature is minted inside the body, and the invitation keys come from the
+     * caller's plan, which a self-publish does not touch (a withdrawal of an invitation withdrawn
+     * since collides on `Revocation`'s primary key — a constraint failure, never retried, as
+     * before). A lost update after a sibling tree of the transaction already synced arrives as a
+     * partial commit and stays declined.
+     *
      * The caller decides which invitations the machine could use, from its plan
      * (`CadreNode.planMachineRemoval`).
      */
@@ -1180,6 +1365,28 @@ export declare class ControlDatabase {
      * @param memberPrivateKey - Optional private key for membership in closed strands
      */
     insertStrand(strandId: string, type: 'o' | 'c', ownerKey: string, signMessage: ControlSign, memberPrivateKey?: string): Promise<void>;
+    /** The stamped, owner-signed `Strand` insert that {@link insertStrand} and {@link insertFoundingRows} run. */
+    private signStrandInsert;
+    /**
+     * Insert one founding's control rows — the `Strand` row, a closed strand's `StrandPartyKey`
+     * row, and a formation invitation bound to the strand — in ONE transaction: one commit, and
+     * never a strand row without the key or invitation written beside it.
+     *
+     * Each row is stamped and signed exactly as its single-row writer ({@link insertStrand},
+     * {@link insertStrandPartyKey}, {@link insertFormationInvite}) does it, and all of that — the
+     * invitation's {@link canonicalDatetime} read included — happens BEFORE the write lock is
+     * taken: signing may prompt the user, and the lock held across a prompt would stall every
+     * other control write. A {@link lockedWithRetry} re-run re-presents the same signed rows.
+     *
+     * No row's `AuthorizedInsert` reads another of these rows (`StrandPartyKey` and
+     * `FormationInvite` check only `OwnerKey` and `Revocation`), so their order is free; the
+     * `Strand` row goes first, so a founding repeated over a stored row is refused on `Strand.Id`.
+     *
+     * A uniqueness rejection rolls the whole transaction back. The caller resolves it and writes
+     * again: a `Strand.Id` conflict is another founder's row, a `StrandPartyKey.Id` conflict a key
+     * stored with no strand row ({@link isStrandIdConflict}; see `CadreNode.publishStrand`).
+     */
+    insertFoundingRows(rows: FoundingRows, ownerKey: string, signMessage: ControlSign): Promise<void>;
     /**
      * Delete a strand from the control database using an owner signature.
      *
@@ -1238,6 +1445,8 @@ export declare class ControlDatabase {
      *   with the owner's private key, returning a base64url signature.
      */
     insertStrandPartyKey(strandId: string, privateKey: string, ownerKey: string, signMessage: ControlSign): Promise<void>;
+    /** The stamped, owner-signed `StrandPartyKey` insert that {@link insertStrandPartyKey} and {@link insertFoundingRows} run. */
+    private signStrandPartyKeyInsert;
     /**
      * Owner-signed removal of one `StrandPartyKey` row — the party's own membership
      * identity for that strand, stored nowhere else, so this is as destructive as
@@ -1405,32 +1614,44 @@ export declare class ControlDatabase {
         profile: NodeProfile | null;
     }, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
-     * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
-     * rewrite `VouchOwner`/`VouchSig` under the owner branch of `CadrePeer.AuthorizedUpdate`
-     * (a signature over the SAME `'vouch'`-tagged digest {@link insertCadrePeer} builds), so
-     * the row is re-emitted as a fresh, broadcasting transaction.
-     *
-     * This is the write-while-alone re-replication primitive: a membership row that committed
-     * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it grows, by
-     * re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because the row
-     * already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness stamp
-     * and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact (the
-     * owner branch requires them kept: they are the machine's own claim) — so it is safe
-     * over a row whose peer has not self-published (`Sig` null); the caller must skip a row
-     * that already carries a self-`Sig` (that row is the owning peer's to refresh, and bumping
-     * `UpdatedAt` without re-signing would invalidate its self-signature).
-     *
-     * Signs over the row's CURRENT `StampId` (unchanged by the re-touch), read BEFORE the lock
-     * is taken. An absent row returns `false` WITHOUT notifying: nothing was written, so the
-     * membership snapshot cannot have changed.
-     *
-     * NOTE: that stamp read is outside the lock, same as {@link deleteGuardedRow}'s. A writer
-     * that removes the row in between makes the `update` match nothing, and this still returns
-     * `true` and notifies — harmless today (the sole caller, the write-while-alone drain, only
-     * logs the result, and a spurious notify just re-reads the member set), and a remove-then-
-     * re-add in the same window fails loudly instead, since the signature binds the retired
-     * stamp. If a caller ever acts on `true` as proof the row was written, fold the stamp read
-     * into the locked body.
+     * Owner "re-touch" of an existing `CadrePeer` membership row: rewrite `VouchOwner`/`VouchSig`
+     * (and, re-broadcasting, bump `UpdatedAt`) under the owner branch of
+     * `CadrePeer.AuthorizedUpdate` — a signature over the SAME `'vouch'`-tagged digest
+     * {@link insertCadrePeer} builds — so the row is re-emitted as a fresh, broadcasting
+     * transaction, or stands on a different owner's voucher.
+     *
+     * Re-broadcasting is the write-while-alone re-replication primitive: a membership row that
+     * committed local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it
+     * grows, by re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because
+     * the row already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness
+     * stamp and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact
+     * (the owner branch requires them kept: they are the machine's own claim) — so it is safe
+     * over a row whose peer has not self-published (`Sig` null), and this method itself skips a
+     * row that already carries a self-`Sig` (that row is the owning peer's to refresh, and
+     * bumping `UpdatedAt` without re-signing would invalidate its self-signature).
+     *
+     * The two modes ({@link CadrePeerRetouchMode}) differ in what they write: `'rebroadcast'`
+     * bumps `UpdatedAt` to `max(now, current + 1)` from the row read inside the body and writes
+     * only while the row's `Sig` is null; `'revouch'` leaves `UpdatedAt` out of the `set` list and
+     * writes whether or not the machine has self-published (the owner branch has no monotonic
+     * rule, so the column simply keeps its value).
+     *
+     * The row read (stamp, `Sig`, `UpdatedAt`), the mode's decision and the signature over the
+     * row's CURRENT `StampId` (unchanged by the re-touch) all run INSIDE the locked body, which is
+     * what lets both modes opt into {@link LOST_UPDATE_RETRY_POLICY}: the row's other writer is
+     * the machine's own publish ({@link updateSelfPeerRecord}), and the drain's re-broadcast fires
+     * at the moment that publish does. A re-run after losing to it reads the self-signed row and
+     * reports `'self-published'` instead of writing the owner branch over it — which would rewrite
+     * `UpdatedAt` under a `Sig` signed over the old value and make the record unverifiable to
+     * resolvers until the machine's next heartbeat. The decision has to be the body's for that;
+     * a caller's pre-check outside the lock is only a fast path (see below).
+     *
+     * An absent row — none, or its stamp retired, or a stampless row no writer produces — is
+     * `'absent'`. Checked once outside the lock too, as `'self-published'` is: the common case
+     * writes nothing, takes no lock and does NOT notify, so an absent target stays quiet
+     * ({@link SeedBootstrapService.removePeer} keeps the same gate for the same reason). The
+     * in-body re-check covers the race; a no-write outcome reached there notifies spuriously,
+     * which only re-reads the member set.
      *
      * Notifies like the insert/remove paths even though this is "only" a re-touch: it rewrites
      * VouchOwner/VouchSig, which the authorized-membership predicate judges on, so it CAN
@@ -1453,12 +1674,13 @@ export declare class ControlDatabase {
      * VouchOwner/VouchSig) rather than inherit this rebinding.
      *
      * @param peerId - the membership row to re-touch.
-     * @param updatedAt - the strictly-increasing freshness stamp to write.
+     * @param mode - re-broadcast or re-vouch ({@link CadrePeerRetouchMode}).
      * @param ownerKey - public key of the re-vouching owner, rewritten into `VouchOwner`.
-     * @param signMessage - ed25519-signs the raw message bytes with that owner's private key.
-     * @returns `true` when the row was re-touched, `false` when no row exists (no notify).
+     * @param signMessage - ed25519-signs the raw message bytes with that owner's private key;
+     *   called inside the lock, once per attempt (the NOTE on {@link ControlSign}).
+     * @returns what was found and done ({@link CadrePeerRetouchOutcome}).
      */
-    reauthorizeCadrePeer(peerId: string, updatedAt: number, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
+    reauthorizeCadrePeer(peerId: string, mode: CadrePeerRetouchMode, ownerKey: string, signMessage: ControlSign): Promise<CadrePeerRetouchOutcome>;
     /**
      * Owner-signed removal of one `CadrePeer` membership row, notifying the membership
      * listener once it has committed.
@@ -1478,6 +1700,12 @@ export declare class ControlDatabase {
      *
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
+     *
+     * Opted into {@link LOST_UPDATE_RETRY_POLICY}: the row's machine may publish its own record
+     * at the moment of the removal (its first publish lands about a second after it starts), and
+     * the removal that loses is refused as a lost update. {@link deleteGuardedRow} reads the stamp
+     * and signs inside the body, and a self-publish never changes the stamp the `'remove'` digest
+     * binds, so the re-run reads the published row and removes it.
      */
     deleteCadrePeer(peerId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
@@ -1539,9 +1767,8 @@ export declare class ControlDatabase {
     /**
      * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
      * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of an
-     * issued row's withdrawal ({@link withdrawIssuedRow}), whose row stays — or the ledger
-     * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
-     * lock and, where one is needed, the transaction.
+     * issued row's withdrawal ({@link withdrawIssuedRow}), whose row stays. The caller
+     * supplies the lock and, where one is needed, the transaction.
      *
      * `ReissuedAt` is named explicitly at 0 (the only value `FreshTombstone` accepts) rather
      * than leaning on the column default — the seat-at-zero rule is load-bearing for
@@ -1579,9 +1806,10 @@ export declare class ControlDatabase {
      * statement, and without the clause the reap would delete the owner's brand-new row.
      * With it the statement matches nothing and the reap is a silent no-op (the schema
      * branch would also refuse that delete, but as a constraint error thrown into a
-     * background sweep — matched-nothing is the better failure mode). Like
-     * {@link reauthorizeCadrePeer}, a race lost AFTER the guard still returns `true`;
-     * harmless — nothing was deleted, and the next sweep re-reads.
+     * background sweep — matched-nothing is the better failure mode). A race lost AFTER the
+     * guard still returns `true` here (unlike {@link reauthorizeCadrePeer}, which reads inside
+     * its lock and reports what it found); harmless — nothing was deleted, and the next sweep
+     * re-reads.
      *
      * Writes NOTHING to `Revocation`: `RevocationRecorded` is satisfied by the same
      * committed tombstone that authorizes the reap, so a reap files no second tombstone.
@@ -1608,7 +1836,7 @@ export declare class ControlDatabase {
      * present clause are the shape {@link redeemInvitation}'s consent-branch insert ships).
      *
      * Driven automatically by {@link reapRevokedRows}, which the periodic control-cohort
-     * reconcile pass runs while the node has at least one control connection.
+     * reconcile pass runs while a sibling is reachable (`CadreNode.hasReachableControlSibling`).
      */
     reapRevokedRow(table: ReapableTable, rowKey: string, stampId: string): Promise<boolean>;
     /**
@@ -1619,8 +1847,8 @@ export declare class ControlDatabase {
      * carry the delete (replaying a delete of an already-absent row is a no-op), so a node
      * that converged on a removal while holding the removed row keeps that row as inert
      * garbage until something walks the tombstones and drops it. `CadreNode`'s periodic
-     * control-cohort reconcile pass is that something, gated on the node having at least one
-     * control connection (a reap is a write, and a write committed alone is local-only).
+     * control-cohort reconcile pass is that something, gated on a sibling being reachable
+     * (a reap is a write, and a write committed alone is local-only).
      *
      * Enumerated UNLOCKED, deleted per-row LOCKED: {@link reapRevokedRow} takes the write
      * lock itself (via {@link mutateCadrePeer} / {@link execWrite}) and the lock is not
@@ -1653,12 +1881,11 @@ export declare class ControlDatabase {
      *
      * NOTE: cost is O(tombstones), not O(live rows) — one {@link queryRevocations} scan plus
      * one {@link queryStampId} point lookup per tombstone, and the empty early return makes
-     * the common case (a party that has never revoked anyone; {@link queryRevocations} skips
-     * the ledger marker) a single scan per pass. That scan consults the cohort on every pass
-     * only while `Revocation` has never been written; the ledger marker
-     * ({@link openRevocationLedger}), filed by the same connected pass, makes it a held block.
+     * the common case (a party that has never revoked anyone) a single scan per pass, served
+     * from the `Revocation` membership view
+     * ({@link readMembershipRows}) unless the table changed since the last read.
      * But `Revocation` is append-only and unbounded, so this is O(all tombstones ever) point
-     * lookups on every reconcile tick. Fine while revocations stay rare for a cadre-sized
+     * lookups on every connected reconcile pass. Fine while revocations stay rare for a cadre-sized
      * party; if the table ever grows, persist a node-local high-water mark of what has
      * already been reaped instead of re-scanning everything (the same bound the sweep in
      * `CadreNode.drainPendingRevocations` wants).
@@ -1693,44 +1920,6 @@ export declare class ControlDatabase {
      * Returns how many UPDATE statements ran (`rows.length` on success).
      */
     reissueRevocations(rows: readonly RevocationRow[], reissuedAt: number, ownerKey: string, signMessage: ControlSign): Promise<number>;
-    /**
-     * Owner-signed filing of the singleton `Revocation` ledger marker
-     * ({@link REVOCATION_LEDGER_MARKER}), the one row in that table that retires nothing.
-     *
-     * Why it exists: while `Revocation` has never been written, this node does not hold its
-     * block, and Optimystic consults a block's cohort on EVERY read of a block it does not
-     * hold — and every membership lookup, and every guarded insert's `NotRevoked` check,
-     * reads this table. Once any row exists the block is held and re-checked at most once per
-     * read-repair window, like every other populated table. The schema's table comment says
-     * why the row can never read as a retirement.
-     *
-     * Insert-if-absent, shaped like {@link reissueRevocations}: the signature is minted
-     * OUTSIDE the locked body so a retried attempt re-presents the same one, and the guard
-     * runs INSIDE it so it sees a concurrent local writer's committed row. The guard scans
-     * the `'Revocation'` rows and compares the stamp in TypeScript rather than seeking the
-     * full composite primary key, which is served as a point lookup that can miss an existing
-     * row on a networked database (tickets/backlog/debt-composite-pk-point-lookup-unreliable-untracked).
-     *
-     * Two owners filing at once: the loser either sees the marker in its guard or is refused
-     * on the primary key, and both answer `'already-open'`.
-     *
-     * The caller decides WHEN. A marker committed while the node is alone is local-only and
-     * can fork the collection, so {@link CadreNode} files it only while connected; this
-     * method does not look at connectivity.
-     *
-     * @param ownerKey - owner public key for the write context (`Revocation.Authorized`).
-     * @param signMessage - ed25519-signs the raw message bytes (no pre-hash) with that owner's
-     *   private key, returning a base64url signature.
-     * @returns `'opened'` when this call filed the marker, `'already-open'` when it was
-     *   already there.
-     */
-    openRevocationLedger(ownerKey: string, signMessage: ControlSign): Promise<RevocationLedgerOpenResult>;
-    /**
-     * Whether the ledger marker is present locally: a scan of the `'Revocation'` rows with the
-     * stamp compared in TypeScript (see {@link openRevocationLedger} for why not a seek).
-     * Called only inside the locked write body, so never retried (see queryStampId's NOTE).
-     */
-    private revocationLedgerFiled;
     /**
      * Run `body` between `beginTransaction` and `commit`, rolling back on failure.
      *
@@ -1762,8 +1951,21 @@ export declare class ControlDatabase {
      * {@link CadreNode}, which wires this in `start()` and clears it on teardown. A
      * second call replaces the first rather than fanning out, so a stale node can
      * never keep receiving notifications for a database it no longer owns.
+     *
+     * Only this database's own writes notify here, awaited inside the write so the gate is
+     * current before the write returns. A membership change replicated in from another
+     * machine reaches the gate through the subscription `CadreNode.start` takes on the
+     * membership tables ({@link watchTables}), a coalesced run up to 50 ms after the change
+     * lands in storage; one storage never hears of waits for the reconcile pass's backstop.
      */
     setMembershipChangeListener(listener: MembershipChangeListener | null): void;
+    /**
+     * Subscribe `onChange` to changes in control tables (`'CadreControl.Strand'`, …): commits
+     * made here and changes replicated into this node's storage alike, on the single-flight
+     * schedule `table-change-watch.ts` describes. {@link close} disposes every subscription
+     * still live before it drains the write queue.
+     */
+    watchTables(tables: readonly string[], onChange: () => Promise<void>, options: TableChangeWatchOptions): TableChangeWatch;
     /**
      * Wire (or clear, with null) the single listener notified after every committed
      * guarded-table delete. Same ownership contract as
@@ -1818,8 +2020,11 @@ export declare class ControlDatabase {
      * exhaustion.
      *
      * @param reason - Label for the log line only (e.g. `'peer-insert'`).
+     * @param policy - The retry policy, default unless the body has earned a wider one: the three
+     *   `CadrePeer` writers whose bodies re-read the row and decide inside pass
+     *   `LOST_UPDATE_RETRY_POLICY` (its `NOTE:` names them and the rule).
      */
-    mutateCadrePeer<T>(reason: string, body: () => Promise<T>): Promise<T>;
+    mutateCadrePeer<T>(reason: string, body: () => Promise<T>, policy?: ControlWriteRetryOptions): Promise<T>;
     /**
      * Run one local write under the database-wide write lock, serializing it against
      * every other local writer on this ControlDatabase.
@@ -1832,8 +2037,8 @@ export declare class ControlDatabase {
      * class: every public write method of this class runs its statement(s) under it, and
      * `SeedBootstrapService` reaches it through {@link execWrite} rather than touching the
      * `Database` directly, so it is covered too. The race is
-     * real, not theoretical: the background self-record publish on a control connection
-     * opening (`CadreNode.drainPendingControlReplication` → `registerSelf`) collided with
+     * real, not theoretical: the background self-record publish when a sibling becomes
+     * reachable (`CadreNode.drainPendingControlReplication` → `registerSelf`) collided with
      * a foreground `authorizePeer` — both `CadrePeer` inserts — and tripped the boundary
      * assert.
      *
@@ -1857,6 +2062,11 @@ export declare class ControlDatabase {
      * re-runnable means a retry re-runs the body's reads too, which is what makes it safe.
      * Signatures and stamp ids minted OUTSIDE the body are deliberately NOT re-minted per
      * attempt: a retry re-presents the exact signed message the first attempt presented.
+     * A body opted into `LOST_UPDATE_RETRY_POLICY` is the exception, and must mint INSIDE:
+     * its re-run is a re-decision over a row another writer changed, not a re-presentation of
+     * the same write, so its read of the row, its decision and its signature all run in the
+     * body ({@link updateSelfPeerRecord}, {@link reauthorizeCadrePeer}, {@link deleteGuardedRow}
+     * under {@link deleteCadrePeer}, {@link removeMachine}).
      */
     withWriteLock<T>(fn: () => Promise<T>): Promise<T>;
     /**
@@ -1882,9 +2092,14 @@ export declare class ControlDatabase {
      * `initialized` is set — so it reaches this method directly rather than through
      * {@link execWrite}, whose {@link ensureInitialized} would reject it. The write queue is
      * necessarily empty at that point, so the lock is uncontended there; it is taken anyway
-     * rather than carving out a lockless path. It is also the ONLY caller that passes a
-     * `policy` — everything else takes the default, whose classifier and attempt count are
-     * unchanged by that call site existing.
+     * rather than carving out a lockless path.
+     *
+     * Two policies reach here besides the default: `SCHEMA_INIT_RETRY_POLICY` from that one
+     * call site, and `LOST_UPDATE_RETRY_POLICY` from the `CadrePeer` writers that re-read the
+     * row inside their body ({@link updateSelfPeerRecord} directly; {@link reauthorizeCadrePeer},
+     * {@link deleteCadrePeer} and {@link removeMachine} through {@link mutateCadrePeer}'s
+     * policy parameter). Everything else takes the default, whose classifier and attempt count
+     * are unchanged by those call sites existing.
      *
      * `label` names the operation in this loop's debug lines and nothing else
      * ({@link ControlWriteRetryOptions.label}). Every call site in this class supplies one:
@@ -1987,6 +2202,11 @@ export declare class ControlDatabase {
         validationUrl?: string;
         strandId?: string;
     }): Promise<void>;
+    /**
+     * The stamped, owner-signed `FormationInvite` insert that {@link insertFormationInvite} and
+     * {@link insertFoundingRows} run. Reads the engine once, for the canonical `ExpiresAt`.
+     */
+    private signFormationInviteInsert;
     /**
      * Redeem a `FormationInvite` by inserting the `Strand` row and a matching
      * `FormationUsage` row **atomically, in one transaction**.
@@ -2057,14 +2277,13 @@ export declare class ControlDatabase {
      * Use {@link redeemInvitation} instead when the strand must be created by
      * consent atomically with the usage.
      *
-     * The strand's live `StampId` is read first and written onto the usage row:
+     * The strand's live `StampId` is written onto the usage row:
      * `FormationUsage.StrandExists` matches the (id, stamp) PAIR, and
      * `Strand.AuthorizedInsert`'s consent branch reads the same pair back, so a consent
-     * record authorizes exactly the strand ROW it was recorded against. A missing strand
-     * THROWS here rather than being left to the deferred `StrandExists` CHECK — the
-     * ordinary "host strand has not converged yet" case is already reported as `missing`
-     * by {@link ControlFormationUsageRecorder.resolveStrand}, so an absent row at this
-     * point is a genuine race and deserves a named error, not a silent rollback.
+     * record authorizes exactly the strand ROW it was recorded against. A caller that already
+     * read the stamp passes it (`strandStampId`); otherwise it is read here first, and a
+     * missing strand THROWS {@link MissingHostStrandError} rather than being left to the
+     * deferred `StrandExists` CHECK.
      *
      * The row is keyed by the joiner's own nonce (`UsageStampId` is the primary key), so this
      * path — the one production actually races on (a bound invite published by `cadre-web` /
@@ -2099,6 +2318,13 @@ export declare class ControlDatabase {
          * {@link queryFormationInvite} read; `null` means "no invite row" / unlimited.
          */
         totalUses?: number | null;
+        /**
+         * The host strand's `StampId`, when the caller already read the row
+         * ({@link queryStrandWithStamp}); `undefined` reads it here. A stamp is fixed for the life
+         * of its row, so one read earlier is the stamp `StrandExists` compares, unless the row was
+         * removed (and re-seated) in between, which that CHECK refuses at commit.
+         */
+        strandStampId?: string;
     }): Promise<FormationUsageResult>;
     /**
      * Refuse a redemption that would consume a seat the invite does not have.
@@ -2152,7 +2378,7 @@ export declare class ControlDatabase {
      * permissive PRE-check that runs ahead of it, and a transiently short read costs each of
      * them only a worse outcome for the ATTEMPT, never a seat the invitation did not pay for:
      * {@link assertSeatRemains} loses its named exhaustion error and falls back to the CHECK's
-     * generic refusal; `ControlFormationUsageRecorder.isTokenUsed` reports not-used and lets
+     * generic refusal; `ControlFormationUsageRecorder.readToken` reports a seat free and lets
      * the redemption proceed to the CHECK, which decides; {@link hasOutstandingFormationInvite}
      * holds the stranger-admission door open slightly longer.
      *
@@ -2178,12 +2404,12 @@ export declare class ControlDatabase {
     /**
      * Is any `FormationInvite` row still redeemable — unexpired AND with usage
      * below its `TotalUses`? A null `ExpiresAt` never expires and a null
-     * `TotalUses` is unlimited, matching {@link ControlFormationUsageRecorder}'s
-     * per-token semantics (`isTokenValid` / `isTokenUsed`).
+     * `TotalUses` is unlimited, matching the per-token semantics of `classifyTokenRead`
+     * (`formation-token.ts`).
      *
      * Answers the control-network connection gate's coarse "does this node expect
      * a stranger?" question, which has no token to ask about. The expiry
-     * comparison is `expiresAtMs <= now` — identical to `isTokenValid`'s — so an
+     * comparison is `expiresAtMs <= now` — identical to `isInviteExpired`'s — so an
      * invite the formation handler would reject can never hold the gate open.
      *
      * The scan is deliberately not pushed into SQL: nothing else here compares a
@@ -2263,8 +2489,10 @@ export declare class ControlDatabase {
      * the row is the holder's proof and never goes away; liveness is {@link hasLiveCadreInvite}'s
      * question, and `CadreInviteUsage.Authorized`'s at redemption.
      *
-     * `retry: false` is passed by {@link redeemCadreInvite}, which reads INSIDE its locked write
-     * body — the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
+     * A redemption reads the row once, before its write, and carries it into
+     * {@link isCadreInviteLive} and {@link redeemCadreInvite}. `retry: false` is passed by
+     * {@link redeemCadreInvite} when it was handed none and reads INSIDE its locked write body —
+     * the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
      */
     queryCadreInvite(key: string, retry?: boolean): Promise<CadreInviteRow | null>;
     /**
@@ -2278,7 +2506,7 @@ export declare class ControlDatabase {
     /**
      * Every `CadreInviteUsage` row this node holds — the redemption records the membership
      * predicate verifies invitation-admitted rows against. Same `retry` contract as
-     * {@link queryCadreInvites}.
+     * {@link queryCadreInvites}; both come from their membership views ({@link readMembershipRows}).
      */
     queryCadreInviteUsages(retry?: boolean): Promise<CadreInviteUsageRow[]>;
     /**
@@ -2306,14 +2534,19 @@ export declare class ControlDatabase {
     hasLiveCadreInvite(nowMs?: number): Promise<boolean>;
     /**
      * Is this one cadre invitation still redeemable here — the conditions
-     * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is the one this node
-     * holds under `invite.key`; when it holds none, `invite` itself (a bundle's copy, not seated
-     * yet), but only if its issuer signature verifies, because an unsigned copy would otherwise be
-     * judged by whichever owner it names as issuer. A permissive pre-check like
-     * {@link countCadreInviteUsage}: {@link seatCadreInvite} and the redemption's own write are
-     * what enforce every condition.
+     * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is `held`, the one this
+     * node holds under `invite.key` ({@link queryCadreInvite}, read by the caller); when it holds
+     * none, `invite` itself (a bundle's copy, not seated yet), but only if its issuer signature
+     * verifies, because an unsigned copy would otherwise be judged by whichever owner it names as
+     * issuer. A permissive pre-check like {@link countCadreInviteUsage}: {@link seatCadreInvite}
+     * and the redemption's own write are what enforce every condition.
+     *
+     * The use count read here is read again inside the redemption's write lock
+     * ({@link assertCadreInviteSeatRemains}), on purpose: this one decides whether the device is
+     * pushed the control store before the write, so the holder of a spent invitation is refused
+     * without being sent anything; the in-lock one decides the seat, against a concurrent redemption.
      */
-    isCadreInviteLive(invite: CadreInviteRow, nowMs?: number): Promise<boolean>;
+    isCadreInviteLive(invite: CadreInviteRow, held: CadreInviteRow | null, nowMs?: number): Promise<boolean>;
     /**
      * The body of {@link isCadreInviteLive} and {@link isOwnerGrantLive}: is `row` (the one held,
      * or a verified bundle copy; null for neither) still open and under its use cap?
@@ -2394,11 +2627,27 @@ export declare class ControlDatabase {
      */
     redeemCadreInvite(params: {
         inviteKey: string;
+        /**
+         * The row this node holds under `inviteKey`, read before the call ({@link queryCadreInvite});
+         * omitted, it is read inside the locked body. Never a bundle's copy: the requester chooses a
+         * copy's `TotalUses` and `IssuerKey`, and the seat check must judge the stored cap. The
+         * schema refuses every update and delete of the row (`NoUpdate`, `NoDelete`), so the earlier
+         * read is the row a locked read would return; withdrawal is a `Revocation` row, which the schema's
+         * `NotRevoked` and `Authorized` checks still read at commit.
+         */
+        held?: CadreInviteRow;
         peerId: string;
         /** The device's ed25519 public key (base64url); `peerId` is its identity multihash. */
         peerKey: string;
         /** The device's dialable addresses, if known; stored comma-joined as `authorizePeer` does. */
         multiaddrs?: string[];
+        /**
+         * The rest of the device's own signed address record over `multiaddrs`, already verified by
+         * the caller (`admittedRecord` in `cadre-invite-protocol.ts`): stored as the row's
+         * `UpdatedAt`, `Sig` and `Profile`, so the row resolves to the device's addresses from its
+         * admission. Omitted, the row is written unsigned, `UpdatedAt` at this machine's clock.
+         */
+        record?: Pick<PeerAddressRecord, 'updatedAt' | 'profile' | 'sig'>;
         /** Single-use nonce minted by the device; both signatures cover it. */
         usageStampId: string;
         /** The holder's signature with the invitation private key over the `'redeem'` digest. */
@@ -2458,7 +2707,9 @@ export declare class ControlDatabase {
     /**
      * Read one `OwnerGrant` row by key, or null when absent. Withdrawn rows are returned too,
      * as {@link queryCadreInvite} returns them: the row is the holder's proof and never goes
-     * away. `retry: false` is passed by {@link redeemOwnerGrant}, inside its locked body.
+     * away. Read once per redemption and carried into {@link isOwnerGrantLive} and
+     * {@link redeemOwnerGrant}; `retry: false` is passed by {@link redeemOwnerGrant} when it was
+     * handed none and reads inside its locked body.
      */
     queryOwnerGrant(key: string, retry?: boolean): Promise<OwnerGrantRow | null>;
     /**
@@ -2467,7 +2718,7 @@ export declare class ControlDatabase {
      * `retry: false` is forwarded from the membership-gate refresh for {@link queryCadrePeers}' reason.
      */
     queryOwnerGrants(retry?: boolean): Promise<OwnerGrantRow[]>;
-    /** Every `OwnerGrantUsage` row this node holds — the redemption records a grant-seated `OwnerKey` row is verified against. Same `retry` contract as {@link queryOwnerGrants}. */
+    /** Every `OwnerGrantUsage` row this node holds — the redemption records a grant-seated `OwnerKey` row is verified against. Same `retry` contract as {@link queryOwnerGrants}; both come from their membership views ({@link readMembershipRows}). */
     queryOwnerGrantUsages(retry?: boolean): Promise<OwnerGrantUsageRow[]>;
     /**
      * How many times an owner grant has been redeemed (its `OwnerGrantUsage` rows), served
@@ -2477,12 +2728,14 @@ export declare class ControlDatabase {
     countOwnerGrantUsage(key: string, retry?: boolean): Promise<number>;
     /**
      * Is this one owner grant still redeemable here — not withdrawn, unexpired, uses left, issuer
-     * still an owner — judged as {@link isCadreInviteLive} judges an invitation: by the row this
-     * node holds under `grant.key`, else by `grant` itself (a bundle's copy, not seated yet)
-     * when its issuer signature verifies. A permissive pre-check; {@link seatOwnerGrant} and the
-     * redemption's own write enforce every condition.
+     * still an owner — judged as {@link isCadreInviteLive} judges an invitation: by `held`, the row
+     * this node holds under `grant.key` ({@link queryOwnerGrant}, read by the caller), else by
+     * `grant` itself (a bundle's copy, not seated yet) when its issuer signature verifies. A
+     * permissive pre-check; {@link seatOwnerGrant} and the redemption's own write enforce every
+     * condition. Its use count is read again inside the write lock, for
+     * {@link isCadreInviteLive}'s reason.
      */
-    isOwnerGrantLive(grant: OwnerGrantRow, nowMs?: number): Promise<boolean>;
+    isOwnerGrantLive(grant: OwnerGrantRow, held: OwnerGrantRow | null, nowMs?: number): Promise<boolean>;
     /**
      * Every `OwnerGrant` row this node holds with its standing — recorded redemptions, withdrawal,
      * and whether it is still redeemable — for an owner's listing, as {@link listCadreInviteStatuses}.
@@ -2534,6 +2787,8 @@ export declare class ControlDatabase {
      */
     redeemOwnerGrant(params: {
         grantKey: string;
+        /** The row this node holds under `grantKey`, read before the call; omitted, it is read inside the locked body. Never a bundle's copy, for {@link redeemCadreInvite}'s reason. */
+        held?: OwnerGrantRow;
         /** The owner key to seat (base64url ed25519): the holder generated it, or already holds it. */
         seatedKey: string;
         /** Single-use nonce minted by the holder; both signatures cover it. */
@@ -2549,7 +2804,10 @@ export declare class ControlDatabase {
     /**
      * Close the database and cleanup resources.
      *
-     * Drains the local-write chain first: {@link withWriteLock} can park a write behind
+     * Disposes every {@link watchTables} subscription before anything else, so a commit that
+     * lands while the write chain drains schedules no run, and again before dropping the handle.
+     *
+     * Then drains the local-write chain: {@link withWriteLock} can park a write behind
      * others across an await, and a queued closure evaluates `this.db!` only when it
      * finally runs — so nulling the handle out from under it would throw a TypeError on a
      * null handle instead of committing. The tail never rejects (it swallows both