@serfab/cadre-core 1.17.0 → 1.19.0

package/dist/control-database.js

@@ -4,16 +4,19 @@ import { Database, FunctionFlags, TEXT_RETURN, createScalarFunction, registerPlu
 import cryptoPlugin from '@optimystic/quereus-plugin-crypto/plugin';
 import optimysticPlugin from '@optimystic/quereus-plugin-optimystic/plugin';
 import { digest, randomBytes } from '@optimystic/quereus-plugin-crypto';
-import { APPLY_CONTROL_SCHEMA, CONTROL_SCHEMA_DECLARATION, controlSchemaFileDeclaration } from './control-schema.js';
+import { createEmptyCollections } from '@serfab/quereus-plugin-sereus';
+import { APPLY_CONTROL_SCHEMA, CONTROL_SCHEMA_DECLARATION, CONTROL_SCHEMA_NAME, controlSchemaFileDeclaration } from './control-schema.js';
 import { refuseIncompatibleControlStore } from './control-schema-version.js';
 import { canonicalDatetime } from './canonical-datetime.js';
 import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, ownerGrantRowFields, CONTROL_TABLES } from './control-authorization.js';
 import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
 import { verifyCadreInviteRow, verifyOwnerGrantRow } from './peer-authorization.js';
 import { OWNER_KEY_MAX_LABEL } from './owner-key-export.js';
-import { retryControlWrite, SCHEMA_INIT_RETRY_POLICY } from './control-write-retry.js';
+import { retryControlWrite, LOST_UPDATE_RETRY_POLICY, SCHEMA_INIT_RETRY_POLICY } from './control-write-retry.js';
 import { isCohortUnreachableRead, retryControlRead } from './control-read-retry.js';
 import { chainMessages } from './control-retry.js';
+import { TableWatchRegistry } from './table-change-watch.js';
+import { MembershipView } from './membership-view.js';
 const log = debug('sereus:cadre:control-db');
 const timing = debug('sereus:cadre:timing');
 /**
@@ -42,12 +45,11 @@ export function generateStampId(peerId) {
  * present locally.
  *
  * Consent is bound to the strand's one-off `StampId` (see the consent branch of
- * `Strand.AuthorizedInsert`), so the writer must read the live row before inserting.
- * The ordinary "host strand has not converged on this responder yet" case is caught
- * earlier and reported as `missing` by `ControlFormationUsageRecorder.resolveStrand`;
- * reaching here means the row vanished between that check and the write, which is a
- * genuine race and is surfaced rather than left to fail the deferred `StrandExists`
- * CHECK at commit (which would drop the write with a far less legible error).
+ * `Strand.AuthorizedInsert`), so a writer not handed the stamp reads the live row before
+ * inserting, and throws this when the row is absent rather than leaving it to fail the
+ * deferred `StrandExists` CHECK at commit (a far less legible error). The formation
+ * responder hands the stamp over from `ControlFormationUsageRecorder.resolveStrand`, which
+ * reports an absent row as `missing`; a row removed after that read fails the CHECK instead.
  */
 export class MissingHostStrandError extends Error {
     constructor(strandId, token) {
@@ -87,16 +89,16 @@ export class FormationAbortedError extends Error {
  * the write, inside {@link ControlDatabase.redeemInvitation} /
  * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
  * ({@link ControlDatabase.redeemCadreInvite}) and an owner grant
- * ({@link ControlDatabase.redeemOwnerGrant}), and off the unlocked pre-check
- * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
- * pass — and off nothing else. It exists because
+ * ({@link ControlDatabase.redeemOwnerGrant}), and off the unlocked re-check
+ * `ControlFormationUsageRecorder.authorizeUsage` runs after an outside approval, before the
+ * manager issues a membership pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
  * schema's own count-based cap clause, which the manager reports as a retryable
  * `Formation conflict, retry` — telling the joiner to retry something that can never succeed.
  * Two redemptions of one token racing on the SAME node serialize behind the local write
- * queue, so the loser reads the winner's committed row and is refused here by name —
- * `StrandFormationManager.validateToken`'s `isTokenUsed` check cannot catch that, since it
- * ran before either redemption wrote anything.
+ * queue, so the loser reads the winner's committed row and is refused here by name — the
+ * use count `StrandFormationManager.validateToken` reads cannot catch that, since it was
+ * read before either redemption wrote anything.
  */
 export class InvitationExhaustedError extends Error {
     constructor(token, usesRecorded, totalUses) {
@@ -382,10 +384,9 @@ const GUARDED_KEY_COLUMN = {
 const ISSUED_TABLE_REASON = { CadreInvite: 'cadre-invite', OwnerGrant: 'owner-grant' };
 /**
  * The exact bytes an owner signs to append one `Revocation` tombstone — `Revocation.Authorized`
- * binds the whole (TableName, RowKey, StampId) row under its own domain tag. Shared by every
- * tombstone writer (a guarded removal, an issued row's withdrawal, the ledger marker) so the
- * field order lives in one place; the base64url verifier is `peer-authorization.ts`'s
- * `revocationDigest`.
+ * binds the whole (TableName, RowKey, StampId) row under its own domain tag. Shared by both
+ * tombstone writers (a guarded removal, an issued row's withdrawal) so the field order lives
+ * in one place; the base64url verifier is `peer-authorization.ts`'s `revocationDigest`.
  */
 function revocationTombstoneMessage(partyId, ref) {
     return buildAuthorizationMessage('CadreControl.Revocation', 'remove', partyId, [ref.tableName, ref.rowKey, ref.stampId]);
@@ -441,7 +442,8 @@ function keyConflictPattern(table) {
  * {@link CadreNode.publishStrand} uses this to tell "my own earlier publish already
  * landed" (re-read, and no-op when the row matches) apart from every other rejection —
  * an unauthorized signer, a retired stamp — which must keep surfacing. For `JoinedStrand`
- * the same test tells "another machine of this party already published this join" apart.
+ * the same test tells "another machine of this party already published this join" apart, and
+ * for `StrandPartyKey` it tells a founding that this party's key for the id is already seated.
  *
  * Matched by TEXT, not by type: the typed engine error does not survive the trip out of
  * optimystic (same constraint the retry classifiers in `control-write-retry.ts` document).
@@ -496,28 +498,16 @@ export class PendingJoinChangedError extends Error {
     }
 }
 /**
- * The one `CadreControl.Revocation` row that retires nothing, filed once by an owner
- * ({@link ControlDatabase.openRevocationLedger}) so the table is never a never-written
- * block. The schema's table comment says why that matters and why the row can never read
- * as a retirement; `RowIsGone` pins this exact triple.
+ * A `CadreControl.Revocation` row that retires nothing, which parties founded before
+ * `control-collections-created-at-cadre-founding` may hold: an owner filed it so the table
+ * had a collection, which genesis now creates. Nothing files it now. `RowIsGone` still admits
+ * this exact triple, and {@link ControlDatabase.queryRevocations} skips it.
  */
-export const REVOCATION_LEDGER_MARKER = {
+const REVOCATION_LEDGER_MARKER = {
     tableName: 'Revocation',
     rowKey: 'ledger',
     stampId: 'opened',
 };
-/**
- * The rejection a second insert of the ledger marker produces: the optimystic vtab's
- * primary-key wording (see {@link keyConflictPattern}), naming both columns of
- * `Revocation`'s composite key. Applied only to the marker's own insert, whose key
- * ('Revocation', 'opened') no row but the marker can hold (`RowIsGone`), and `Revocation`
- * has no other unique constraint.
- */
-const REVOCATION_LEDGER_CONFLICT = /UNIQUE constraint failed: Revocation\.TableName, Revocation\.StampId\b/i;
-/** Did the ledger marker's insert fail because the marker is already filed? Text-matched, failing closed, like {@link isStrandIdConflict}. */
-function isRevocationLedgerConflict(error) {
-    return errorChainMatches(error, REVOCATION_LEDGER_CONFLICT);
-}
 /** Whether any message in `error`'s cause chain matches `pattern`; false for a non-`Error`. */
 function errorChainMatches(error, pattern) {
     return error instanceof Error && chainMessages(error).some(message => pattern.test(message));
@@ -580,7 +570,74 @@ export const REAPABLE_TABLES = ['CadrePeer', 'DeviceToken', 'ValidationKey', 'Jo
  */
 const REAPABLE_TABLE_SET = new Set(REAPABLE_TABLES);
 const isReapableTable = (table) => REAPABLE_TABLE_SET.has(table);
-/** Every `CadreInvite` column, in the order {@link cadreInviteRowOf} reads them; callers append their `where`. */
+/**
+ * The full-table scans the `Revocation`, `CadrePeer` and `OwnerKey` membership views load
+ * ({@link ControlDatabase.readMembershipRows}); the four chain tables' scans sit beside their
+ * row mappers below. Specs rig these reads by their text: `from CadreControl.Revocation`, and
+ * the `CadrePeer` scan by its `select PeerId, Multiaddr, StampId` prefix, which no other
+ * `CadrePeer` statement shares.
+ */
+const REVOCATION_SELECT_SQL = 'select TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig from CadreControl.Revocation';
+const CADRE_PEER_SELECT_SQL = 'select PeerId, Multiaddr, StampId, VouchOwner, VouchSig, VouchUsage, PublicKey, UpdatedAt, Profile, Sig from CadreControl.CadrePeer';
+const OWNER_KEY_SELECT_SQL = 'select Key, Label, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.OwnerKey';
+/** A stored `CadrePeer` row as a {@link CadrePeerRow}. */
+function cadrePeerRowOf(row) {
+    return {
+        peerId: row.PeerId,
+        publicKey: row.PublicKey ?? null,
+        multiaddr: row.Multiaddr ?? null,
+        updatedAt: row.UpdatedAt ?? 0,
+        profile: row.Profile ?? null,
+        sig: row.Sig ?? null,
+        stampId: row.StampId ?? null,
+        vouchOwner: row.VouchOwner ?? null,
+        vouchSig: row.VouchSig ?? null,
+        vouchUsage: row.VouchUsage ?? null,
+    };
+}
+/** A {@link CadrePeerRow} as the address record its machine signed ({@link PeerAddressRecord}); see {@link ControlDatabase.queryPeerRecord} for the coalescing. */
+function peerAddressRecordOf(row) {
+    const multiaddr = row.multiaddr ?? '';
+    return {
+        peerId: row.peerId,
+        publicKey: row.publicKey ?? '',
+        addrs: multiaddr.length > 0 ? multiaddr.split(',') : [],
+        updatedAt: row.updatedAt,
+        profile: row.profile,
+        sig: row.sig ?? '',
+    };
+}
+/**
+ * {@link ControlDatabase.reauthorizeCadrePeer}'s decision over the row as read: the row to write,
+ * or the {@link CadrePeerRetouchOutcome} that says why nothing is written — no readable row (a
+ * stampless row counts, since the voucher digest binds the stamp), or a self-published row in
+ * `'rebroadcast'` mode. One function so the pre-check outside the lock and the re-check inside it
+ * cannot disagree.
+ */
+function retouchTarget(row, mode) {
+    if (row === null || row.stampId === null) {
+        return 'absent';
+    }
+    if (mode === 'rebroadcast' && row.sig !== null) {
+        return 'self-published';
+    }
+    return { stampId: row.stampId, updatedAt: row.updatedAt };
+}
+/** A stored `Revocation` row as a {@link RevocationRow}; the caller has already skipped {@link REVOCATION_LEDGER_MARKER}. */
+function revocationRowOf(row) {
+    return {
+        tableName: row.TableName,
+        rowKey: row.RowKey,
+        stampId: row.StampId,
+        reissuedAt: row.ReissuedAt ?? 0,
+        signerKey: row.SignerKey,
+        signerSig: row.SignerSig,
+    };
+}
+/**
+ * Every `CadreInvite` column, in the order {@link cadreInviteRowOf} reads them: the full scan the
+ * `CadreInvite` membership view loads, and the base the point reads append their `where` to.
+ */
 const CADRE_INVITE_SELECT_SQL = 'select Key, PeerId, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.CadreInvite';
 /**
  * A stored `CadreInvite` row as a {@link CadreInviteRow}. `ExpiresAt` is kept as the
@@ -598,6 +655,8 @@ function cadreInviteRowOf(row) {
         stampId: row.StampId,
     };
 }
+/** The full scan the `CadreInviteUsage` membership view loads, in the order {@link cadreInviteUsageRowOf} reads it. */
+const CADRE_INVITE_USAGE_SELECT_SQL = 'select UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, InviteSig, PeerSig from CadreControl.CadreInviteUsage';
 /** A stored `CadreInviteUsage` row as a {@link CadreInviteUsageRow}. */
 function cadreInviteUsageRowOf(row) {
     return {
@@ -610,7 +669,7 @@ function cadreInviteUsageRowOf(row) {
         peerSig: row.PeerSig,
     };
 }
-/** Every `OwnerGrant` column, in the order {@link ownerGrantRowOf} reads them; callers append their `where`. */
+/** Every `OwnerGrant` column, in the order {@link ownerGrantRowOf} reads them; as {@link CADRE_INVITE_SELECT_SQL}, the view's scan and the point read's base. */
 const OWNER_GRANT_SELECT_SQL = 'select Key, Label, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.OwnerGrant';
 /** A stored `OwnerGrant` row as an {@link OwnerGrantRow}; `ExpiresAt` kept canonical, as {@link cadreInviteRowOf} keeps it. */
 function ownerGrantRowOf(row) {
@@ -624,6 +683,8 @@ function ownerGrantRowOf(row) {
         stampId: row.StampId,
     };
 }
+/** The full scan the `OwnerGrantUsage` membership view loads, in the order {@link ownerGrantUsageRowOf} reads it. */
+const OWNER_GRANT_USAGE_SELECT_SQL = 'select UsageStampId, GrantKey, SeatedKey, SeatedStampId, GrantSig, OwnerSig from CadreControl.OwnerGrantUsage';
 /** A stored `OwnerGrantUsage` row as an {@link OwnerGrantUsageRow}. */
 function ownerGrantUsageRowOf(row) {
     return {
@@ -768,12 +829,33 @@ export class ControlDatabase {
     constructor(config) {
         this.db = null;
         this.collectionFactory = null;
+        this.txnBridge = null;
         this.initialized = false;
         this.membershipListener = null;
         this.guardedDeleteListener = null;
         this.controlWriteAbandonedListener = null;
         /** Tail of the local-write chain — see {@link withWriteLock}. */
         this.writeQueue = Promise.resolve();
+        /** Subscriptions handed out by {@link watchTables}. */
+        this.tableWatches = new TableWatchRegistry();
+        /** The cached membership tables; see {@link readMembershipRows}. */
+        this.revocationView = this.membershipView(REVOCATION_SELECT_SQL, 'revocations');
+        this.cadrePeerView = this.membershipView(CADRE_PEER_SELECT_SQL, 'cadre-peers');
+        this.ownerKeyView = this.membershipView(OWNER_KEY_SELECT_SQL, 'owner-keys');
+        this.cadreInviteView = this.membershipView(CADRE_INVITE_SELECT_SQL, 'cadre-invites');
+        this.cadreInviteUsageView = this.membershipView(CADRE_INVITE_USAGE_SELECT_SQL, 'cadre-invite-usages');
+        this.ownerGrantView = this.membershipView(OWNER_GRANT_SELECT_SQL, 'owner-grants');
+        this.ownerGrantUsageView = this.membershipView(OWNER_GRANT_USAGE_SELECT_SQL, 'owner-grant-usages');
+        /** Each membership view by the qualified table it copies, for {@link watchMembershipViews}, {@link watchMembershipTables} and {@link invalidateMembershipViews}. */
+        this.membershipViews = new Map([
+            ['CadreControl.Revocation', this.revocationView],
+            ['CadreControl.CadrePeer', this.cadrePeerView],
+            ['CadreControl.OwnerKey', this.ownerKeyView],
+            ['CadreControl.CadreInvite', this.cadreInviteView],
+            ['CadreControl.CadreInviteUsage', this.cadreInviteUsageView],
+            ['CadreControl.OwnerGrant', this.ownerGrantView],
+            ['CadreControl.OwnerGrantUsage', this.ownerGrantUsageView],
+        ]);
         /**
          * Locked write bodies currently running (see {@link runWriteBody}); what
          * {@link readRowsOnce} consults to route an unlocked read around a write that has
@@ -809,6 +891,7 @@ export class ControlDatabase {
             return;
         }
         log('Initializing ControlDatabase for party: %s', this.config.partyId);
+        this.invalidateMembershipViews();
         // Create database instance
         this.db = new Database();
         // Register crypto plugin (provides digest, sign, verify functions)
@@ -836,6 +919,7 @@ export class ControlDatabase {
         // Before hydrate: a warm restart parses the persisted CHECK text, which calls party_id().
         registerPartyIdFunction(this.db, this.config.partyId);
         this.collectionFactory = pluginResult.collectionFactory;
+        this.txnBridge = pluginResult.txnBridge;
         // Inject the libp2p node into the collection factory
         t0 = performance.now();
         this.collectionFactory.registerLibp2pNode(networkName, this.config.libp2pNode, this.config.coordinatedRepo);
@@ -882,9 +966,45 @@ export class ControlDatabase {
         t0 = performance.now();
         await this.loadSchema();
         timing('[controlDb] loadSchema: %dms', Math.round(performance.now() - t0));
+        this.watchMembershipViews();
         this.initialized = true;
         log('ControlDatabase initialized successfully');
     }
+    /**
+     * Drop a membership view whenever its table changes: a commit made here, or a change this
+     * node's storage takes in from elsewhere. `onInvalidate` is the whole consumer, so the run
+     * does nothing; no backstop, since {@link MEMBERSHIP_VIEW_MAX_AGE_MS} bounds what the
+     * subscription cannot hear. {@link close} disposes it with the rest.
+     */
+    watchMembershipViews() {
+        this.tableWatches.watch(this.db, [...this.membershipViews.keys()], () => Promise.resolve(), {
+            label: 'membership-view',
+            onInvalidate: (table) => this.membershipViews.get(table)?.invalidate(),
+        });
+    }
+    /**
+     * {@link watchTables} on the membership tables: the seven the membership views copy
+     * (`CadrePeer`, `OwnerKey`, `Revocation`, `CadreInvite`, `CadreInviteUsage`, `OwnerGrant`,
+     * `OwnerGrantUsage`), which are exactly what the membership gate and the owner-anchor sync
+     * read. `CadreNode.start` takes its gate watch here, so the gate hears every table its
+     * reads can depend on and no list of them lives outside this class.
+     */
+    watchMembershipTables(onChange, options) {
+        return this.watchTables([...this.membershipViews.keys()], onChange, options);
+    }
+    /**
+     * Empty every membership view, so the next read of each loads afresh and no load in
+     * flight installs. Besides {@link initialize} and {@link close}, `CadreNode` calls it when
+     * a sibling becomes reachable (its identify on a new connection): a machine that was offline
+     * while that sibling committed learns of the commit only when it next reads the block from
+     * storage, and dropping the views makes the pass that starts then read now rather than after
+     * `MEMBERSHIP_VIEW_MAX_AGE_MS`.
+     */
+    invalidateMembershipViews() {
+        for (const view of this.membershipViews.values()) {
+            view.invalidate();
+        }
+    }
     async loadSchema() {
         let declaration;
         if (this.config.schemaPath) {
@@ -897,10 +1017,12 @@ export class ControlDatabase {
         }
         // Declaring runs no DDL; it only records the declaration the check and the apply both read.
         await this.db.exec(declaration);
-        // A warm store this build cannot apply to without losing data is refused HERE, before the
-        // apply runs anything: the optimystic module refuses most changes to an existing table
-        // part-way through an apply, and a dropped table takes its rows. Migrating a store in place
-        // (control-store-migrates-on-start) widens this check to let catalog-only changes through.
+        // The apply below is also the MIGRATION of a warm store written under an older control
+        // schema version: its diff runs each version's changes in order, every one applied to a
+        // table's catalog record without a row rewritten, and ends by recording this build's version
+        // on the store. A store the apply must not touch is refused HERE, before it runs anything: one
+        // a newer release migrated (this machine is the one to update), one from before migrations,
+        // or one whose diff would rewrite or discard rows (`control-schema-version.ts`).
         await refuseIncompatibleControlStore(this.db, this.config.partyId);
         await this.applyControlSchema();
         log('Schema loaded and executed');
@@ -943,6 +1065,20 @@ export class ControlDatabase {
         // argument is a statement about the pair, not about Quereus alone — pinned by
         // `test/control-schema-apply-unwind.spec.ts`.
         //
+        // The same argument covers the statements a MIGRATION runs (`control-schema-version.ts`'s
+        // `catalog-only` kinds, from Optimystic 1.16.0): the plugin's `alterTable` arms (add column,
+        // drop column, add and drop CHECK) and the tag change write the table's catalog record under
+        // the batch's per-statement checkpoint, so a step that throws withdraws its own write, and a
+        // batch whose commit fails is discarded whole and the tables it wrote re-persist on their next
+        // touch. A change the record already holds — another machine migrated first — is adopted with
+        // nothing written, and an undo of an adopted change touches this machine's catalog only. The
+        // one arm Quereus marks irreversible is `drop column`: once it has run, a later failure
+        // unwinds nothing (the apply reports the schema as partially migrated), the plugin's
+        // `endSchemaBatch` commits the steps that landed — or, when that commit fails, marks their
+        // tables to re-persist on next touch — and the retry's diff runs only the steps still
+        // missing. No row is lost either way: rows keep a dropped column's field until they are
+        // rewritten, and nothing reads it.
+        //
         // Only the "cohort did not answer, nothing committed" class is retried; the classifier
         // vetoes indeterminate commits and does not match `Missing block`, which is a durable
         // convergence fault a retry cannot heal (tracked separately) and must keep propagating.
@@ -1034,8 +1170,9 @@ export class ControlDatabase {
      * statement to its transaction opening.
      */
     async readRowsOnce(sql, params, underWriteLock) {
+        const committed = this.writeInFlight(underWriteLock);
         let iterator;
-        if (this.writeInFlight(underWriteLock)) {
+        if (committed) {
             log('read-eval: a write is in flight (%s), asking for a committed read: %s', this.db.getAutocommit() ? 'locked body running, no transaction open yet' : 'transaction open', sql);
             iterator = this.db.eval(sql, params, { readConcurrency: 'committed' });
         }
@@ -1046,7 +1183,7 @@ export class ControlDatabase {
         for await (const row of iterator) {
             rows.push(row);
         }
-        return rows;
+        return { rows, committed };
     }
     /**
      * Whether a control read should ask for a committed read — see {@link readRowsOnce}.
@@ -1104,7 +1241,15 @@ export class ControlDatabase {
      * held, and its membership read is opted out at {@link queryCadrePeers}. If another
      * under-lock callback seam is ever added, audit its read graph the same way.
      */
-    readRows(sql, params, label, retry = true) {
+    async readRows(sql, params, label, retry = true) {
+        return (await this.readRowsRouted(sql, params, label, retry)).rows;
+    }
+    /**
+     * {@link readRows}, also saying whether the attempt that answered took the committed-read
+     * path — which a {@link MembershipView} load needs, since it may not keep such rows (see
+     * {@link membershipView}).
+     */
+    readRowsRouted(sql, params, label, retry) {
         // `retry: false` marks the reads that may run inside a locked write body, which is
         // also what readRowsOnce's committed-read routing must know (see writeInFlight).
         // NOTE: the membership-gate refresh passes it on EVERY trigger, including the
@@ -1119,6 +1264,44 @@ export class ControlDatabase {
         // it changes log attribution only, never behaviour (same layering as lockedWithRetry).
         return retryControlRead(() => this.readRowsOnce(sql, params, false), { ...this.controlReadRetryPacing, label });
     }
+    /**
+     * A view over one membership table, loaded by its full scan `sql` through {@link readRows}'s
+     * funnel. Rows a committed read served are never kept: that read may initialize an untouched
+     * table provisionally, and the Optimystic plugin arms a table's replicated-change bridge only
+     * on its full initialization (`OptimysticTable.initializeForCommittedRead`), so no later change
+     * event would ever drop them.
+     */
+    membershipView(sql, label) {
+        return new MembershipView(async (retry) => {
+            const { rows, committed } = await this.readRowsRouted(sql, undefined, label, retry);
+            return { rows, installable: !committed };
+        });
+    }
+    /**
+     * A membership table's raw rows, from its {@link MembershipView}: `Revocation`, `CadrePeer`
+     * and `OwnerKey`, the tables every membership, owner and peer-record read starts from, and
+     * `CadreInvite`, `CadreInviteUsage`, `OwnerGrant` and `OwnerGrantUsage`, the chains every
+     * membership refresh verifies invitation-admitted machines and grant-seated owner keys through.
+     * Callers build fresh result objects from them and never mutate them.
+     *
+     * Reads the table directly instead when a caller under the write lock (`retry: false`) has an
+     * explicit transaction open: such a read sees the transaction's own uncommitted rows, which
+     * the view does not hold, and a rollback fires no change event, so keeping them would cache
+     * rows that never existed. No reader of these tables runs inside {@link inTransaction} today;
+     * this keeps one added later, or a spec's raw-handle transaction, correct.
+     *
+     * Reads that stay plain SQL on purpose: {@link queryStampId} (sees retired rows), the
+     * schema's CHECK constraints, which read inside the committing transaction, the redemption's
+     * one read of the held credential row ({@link queryCadreInvite},
+     * {@link queryOwnerGrant}), and the indexed usage counts.
+     */
+    readMembershipRows(view, retry) {
+        this.ensureInitialized();
+        if (!retry && !this.db.getAutocommit()) {
+            return view.readThrough(retry);
+        }
+        return view.read(retry);
+    }
     /**
      * Query all strands from the control database
      */
@@ -1138,6 +1321,16 @@ export class ControlDatabase {
         const rows = await this.readRows(`select ${STRAND_COLUMNS} from CadreControl.Strand where Id = ?`, [strandId], 'strand');
         return rows.length === 0 ? null : strandRow(rows[0]);
     }
+    /**
+     * {@link queryStrand} plus the row's `StampId`, in one read: the formation responder
+     * resolves a bound invite's host strand with it and later records consent against that
+     * stamp ({@link recordFormationUsage}'s `strandStampId`) without reading the row again.
+     */
+    async queryStrandWithStamp(strandId) {
+        this.ensureInitialized();
+        const rows = await this.readRows(`select ${STRAND_COLUMNS}, StampId from CadreControl.Strand where Id = ?`, [strandId], 'strand-with-stamp');
+        return rows.length === 0 ? null : { ...strandRow(rows[0]), StampId: rows[0].StampId };
+    }
     /**
      * Every strand this party joined from another party (`CadreControl.JoinedStrand`), shaped
      * as a {@link StrandRow} so a reader can treat it like one of the party's own. A joiner
@@ -1216,19 +1409,29 @@ export class ControlDatabase {
      *
      * Deliberately RAW (no retired-stamp filter, unlike {@link getOwnerKeys}): the genesis
      * insert is refused by the schema whenever any physical row exists, so this must see one.
+     * Served from the `OwnerKey` membership view ({@link readMembershipRows}), which holds every
+     * physical row, so a genesis caller's pre-check and {@link ensureOwnerKey}'s re-check share
+     * one storage read.
      */
     async hasOwnerKey() {
         this.ensureInitialized();
-        for (const row of await this.readRows('select count(1) as Count from CadreControl.OwnerKey', undefined, 'owner-key-exists')) {
-            return row.Count > 0;
-        }
-        return false;
+        return (await this.readMembershipRows(this.ownerKeyView, true)).length > 0;
     }
     /**
      * Idempotent genesis: insert `key` as the founding owner key only when
      * the party has none yet. Returns true if it inserted, false if an owner
      * key already existed (so a repeat `--owner` start is a no-op).
      *
+     * Before the insert, gives every control table its empty collection
+     * ({@link commitEmptyControlCollections}). A collection committed while a machine is alone
+     * forks if another machine creates the same collection independently; before genesis the
+     * party has no owner, so no other machine can have been admitted and none can hold any of
+     * its collections. The order makes the step repeatable: a crash between it and the insert
+     * leaves no `OwnerKey` row, so the next start runs genesis again and commits only the
+     * collections still missing, while a founder restart finds the row and commits nothing, so
+     * it can never write an empty second history beside a table another machine has since
+     * written. A failure propagates with nothing inserted.
+     *
      * @param label - the user's name for the key ({@link insertOwnerKey}).
      */
     async ensureOwnerKey(key, label) {
@@ -1238,9 +1441,40 @@ export class ControlDatabase {
             log('Owner key already present; skipping genesis insert');
             return false;
         }
+        // Two locked steps one after the other: the lock is not re-entrant, and the insert takes it itself.
+        await this.commitEmptyControlCollections();
         await this.insertOwnerKey(trimmed, label);
         return true;
     }
+    /**
+     * Commit an empty collection for every `CadreControl` table, index tree and unique-enforcement
+     * tree that has none, so a read of a table nobody has written is answered from this machine's
+     * storage instead of asking the block's cohort to prove the collection absent — a round trip
+     * per read on a party of several machines, and an error or a wait while they are offline.
+     * Joining machines get these collections the ordinary way, by reading them from the cohort.
+     *
+     * Under the write lock: the helper commits whatever is staged in those collections outside any
+     * SQL transaction, which is sound only while nothing else writes.
+     *
+     * Parties founded before this step, and tables a later control schema version adds, have no
+     * such collections, and nothing creates them later: the start-time schema apply runs on every
+     * machine, possibly alone, where committing one would be exactly the fork genesis avoids.
+     *
+     * NOTE: one `sync()` per collection, in sequence: 32 collections for today's schema (17 tables,
+     * 3 indexes, 12 `unique` columns). Measured 2026-10-20 on a lone `CadreNode` over the network
+     * transactor (started, then `ensureOwnerKey` alone, 3 runs each): 64–105 ms in memory and
+     * 750–820 ms on `FileRawStorage`, about 25 ms per collection on disk, roughly 1/75 of the edge
+     * node's 60 s `DEFAULT_OWNER_GENESIS_TIMEOUT_MS`. Under the whole cadre-core suite's load (151
+     * geneses) it took a median of 159 ms and at most 4.6 s. If genesis latency starts to matter
+     * (phone flash under launch contention runs 50–90 ms per storage operation, see the NOTE in
+     * `initialize`), ask Optimystic for an API that commits them as one batch, the one strand
+     * founding would use too; do not build a private batching path.
+     */
+    async commitEmptyControlCollections() {
+        const t0 = performance.now();
+        const committed = await this.withWriteLock(() => createEmptyCollections(this.db, this.txnBridge, [CONTROL_SCHEMA_NAME]));
+        log('Committed %d empty control collections in %dms', committed, Math.round(performance.now() - t0));
+    }
     /**
      * Collect every owner key (`CadreControl.OwnerKey.Key`) as a set.
      *
@@ -1281,16 +1515,14 @@ export class ControlDatabase {
      *
      * @param retired - the retired `OwnerKey` stamps, when the caller has already read the
      *   tombstones (`CadreNode.syncOwnerAnchor` reads {@link queryRevocations} for their
-     *   signers); omitted, they are read here. Before the ledger marker is filed every
-     *   `Revocation` read is a cohort consult, so the sync passing its own set keeps the
-     *   membership refresh at one such read for the anchor.
+     *   signers); omitted, they are read here. Both come from the same `Revocation` view
+     *   ({@link readMembershipRows}), so passing the set saves only the filtering.
      */
     async queryOwnerKeyRows(retry = true, retired) {
         this.ensureInitialized();
         const revoked = retired ?? await this.queryRevokedStamps('OwnerKey', retry);
         const rows = [];
-        const sql = 'select Key, Label, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.OwnerKey';
-        for (const row of await this.readRows(sql, undefined, 'owner-keys', retry)) {
+        for (const row of await this.readMembershipRows(this.ownerKeyView, retry)) {
             const stampId = row.StampId ?? null;
             if (stampId === null) {
                 log('queryOwnerKeyRows: dropping OwnerKey row %s with no StampId', row.Key);
@@ -1322,12 +1554,8 @@ export class ControlDatabase {
      * {@link queryRevokedStamps} rather than inlining the SQL, so tests can interpose on
      * that seam to model the replicated live-row-plus-tombstone merge state.
      *
-     * NOTE: runs a second query (the retired-stamp set) per call, on the membership-gate
-     * refresh path. Its cost is storage consults, not rows (see {@link queryRevokedStamps}):
-     * while `Revocation` has never been written every call consults the cohort about it, and
-     * the ledger marker ({@link openRevocationLedger}) is what makes it a held block. Folding
-     * the exclusion into one statement would not help (it reads the same block), and caching
-     * the set would hide a tombstone arriving by replication.
+     * Both tables come from their membership views ({@link readMembershipRows}), so a call after
+     * the first costs no storage read until one of the two tables changes.
      *
      * NOTE: this filter is HAND-MIRRORED by the gate suites' fake control databases
      * (`test/membership-gate-helpers.ts` and `test/cadre-node-authorized-surface.spec.ts`),
@@ -1350,27 +1578,12 @@ export class ControlDatabase {
         this.ensureInitialized();
         const revoked = await this.queryRevokedStamps('CadrePeer', retry);
         const rows = [];
-        // The proof columns lead and the record columns follow, so this scan keeps a prefix no
-        // other `CadrePeer` statement shares (`queryPeerRecord` starts `PeerId, PublicKey`): the
-        // read-retry spec rigs the membership scan by that prefix.
-        const sql = 'select PeerId, Multiaddr, StampId, VouchOwner, VouchSig, VouchUsage, PublicKey, UpdatedAt, Profile, Sig from CadreControl.CadrePeer';
-        for (const row of await this.readRows(sql, undefined, 'cadre-peers', retry)) {
-            const stampId = row.StampId ?? null;
-            if (stampId !== null && revoked.has(stampId)) {
+        for (const row of await this.readMembershipRows(this.cadrePeerView, retry)) {
+            const peer = cadrePeerRowOf(row);
+            if (peer.stampId !== null && revoked.has(peer.stampId)) {
                 continue;
             }
-            rows.push({
-                peerId: row.PeerId,
-                publicKey: row.PublicKey ?? null,
-                multiaddr: row.Multiaddr ?? null,
-                updatedAt: row.UpdatedAt ?? 0,
-                profile: row.Profile ?? null,
-                sig: row.Sig ?? null,
-                stampId,
-                vouchOwner: row.VouchOwner ?? null,
-                vouchSig: row.VouchSig ?? null,
-                vouchUsage: row.VouchUsage ?? null,
-            });
+            rows.push(peer);
         }
         return rows;
     }
@@ -1424,10 +1637,11 @@ export class ControlDatabase {
      * guard. A read retrying there would sleep its backoff HOLDING the write lock
      * (`retryControlWrite`'s contract is that backoff sleeps happen with no lock held), and
      * the write funnel already re-runs the body's reads when it re-runs the body. The
-     * unlocked callers — the public stamp readers, {@link reauthorizeCadrePeer} and
-     * {@link reapRevokedRow}, whose stamp reads run BEFORE their locks are taken — keep the
-     * default retried path. Explicit per call rather than an ambient flag: unlocked reads
-     * run concurrently with a locked body, so `this`-state cannot tell the two apart.
+     * unlocked callers — the public stamp readers and {@link reapRevokedRow}, whose stamp
+     * read runs BEFORE its lock is taken — keep the default retried path. Explicit per call
+     * rather than an ambient flag: unlocked reads run concurrently with a locked body, so
+     * `this`-state cannot tell the two apart. The same flag threads through
+     * {@link findCadrePeerRow} for the two writers that read the whole row inside their body.
      */
     async queryStampId(table, keyValue, retry = true) {
         this.ensureInitialized();
@@ -1440,8 +1654,8 @@ export class ControlDatabase {
     /**
      * `CadrePeer` stamp nonce — read by {@link SeedBootstrapService.removePeer} as its
      * row-present gate before it delegates to {@link deleteCadrePeer}. The in-class
-     * `CadrePeer` writers ({@link insertCadrePeer}, {@link reauthorizeCadrePeer}) go
-     * straight to {@link queryStampId}.
+     * `CadrePeer` writers go straight to {@link queryStampId} ({@link insertCadrePeer}) or read
+     * the whole row ({@link reauthorizeCadrePeer}, through {@link findCadrePeerRow}).
      */
     queryCadrePeerStampId(peerId) {
         return this.queryStampId('CadrePeer', peerId);
@@ -1496,18 +1710,17 @@ export class ControlDatabase {
      * ({@link queryCadrePeers}, {@link queryPeerRecord},
      * {@link CadreNode.resolveDeviceToken}) drop any row whose stamp appears here.
      *
-     * NOTE: the per-call cost that matters is the storage layer's, not the row count. While
-     * `Revocation` has never been written, this node does not hold its block, and Optimystic
-     * consults a block's cohort on every read of a block it does not hold: 1 consult per
-     * call (measured), each a round trip to every other member on a multi-machine party. The
-     * ledger marker ({@link openRevocationLedger}) ends that — a held block is re-consulted
-     * at most once per read-repair window (10 s). Do not cache the set instead: a cache
-     * cannot see a tombstone arriving by replication, so it would delay a revocation. The
-     * row count only grows (append-only) but stays small while removals are rare; revisit if
+     * Served from the `Revocation` membership view ({@link readMembershipRows}), dropped by
+     * every change to the table, local or replicated into this node's storage, so a tombstone
+     * arriving by replication is seen on the next call. The cost that matters is the storage
+     * layer's, paid by a cold view's load: while `Revocation` has never been written, this node
+     * does not hold its block, and Optimystic consults a block's cohort on every read of a block
+     * it does not hold, each a round trip to every other member on a multi-machine party. The row
+     * count only grows (append-only) but stays small while removals are rare; revisit if
      * removals become routine and the scan itself shows up in a profile.
      *
      * An isolated node that has never received the `Revocation` block reads it as holding no
-     * revocations instead of throwing — see {@link readRevokedStampRows}.
+     * revocations instead of throwing — see {@link readRevocationRowsOrNone}.
      *
      * `retry: false` is forwarded by {@link queryCadrePeers} for the one caller that reads
      * under the write lock — see that method's note.
@@ -1515,21 +1728,25 @@ export class ControlDatabase {
     async queryRevokedStamps(tableName, retry = true) {
         this.ensureInitialized();
         const stamps = new Set();
-        for (const row of await this.readRevokedStampRows(tableName, retry)) {
-            stamps.add(row.StampId);
+        for (const row of await this.readRevocationRowsOrNone(retry)) {
+            if (row.TableName === tableName) {
+                stamps.add(row.StampId);
+            }
         }
         return stamps;
     }
     /**
-     * The `Revocation` scan behind {@link queryRevokedStamps}, answering NO ROWS when the read
-     * fails `cohort-unreachable` ({@link isCohortUnreachableRead}): this node does not hold
+     * The `Revocation` rows behind {@link queryRevokedStamps}, answering NO ROWS when the view's
+     * load fails `cohort-unreachable` ({@link isCohortUnreachableRead}): this node does not hold
      * the block and could ask no other cohort member about it. Every other failure rethrows.
      * The retry in {@link readRows} runs first, so a node whose connectivity returns within
-     * the read budget still gets the real answer.
+     * the read budget still gets the real answer. The empty answer is never installed in the
+     * view (a failed load keeps nothing), so the next call asks again.
      *
      * Without this, a machine cut off from every other machine in its party before it ever
-     * received the block — the block does not exist anywhere until the owner files the
-     * ledger marker ({@link openRevocationLedger}) on a connected reconcile pass — cannot
+     * received the block — a joining machine gets it only by reading it from the cohort, and
+     * on a party founded before genesis created every control collection it exists nowhere
+     * until the first tombstone or the marker ({@link REVOCATION_LEDGER_MARKER}) — cannot
      * answer ANY membership, peer-record or device-token lookup, although it holds those
      * rows locally.
      *
@@ -1548,20 +1765,20 @@ export class ControlDatabase {
      *
      * NOTE: an isolated node pays the whole read retry (up to
      * `CONTROL_READ_RETRY_BUDGET_MS`, plus the slow attempt that exhausted it) before this
-     * answers, and {@link queryPeerRecord} then issues its row scan on top. If an isolated
-     * node's lookups are seen exceeding the admission gate's 2 s deadline
-     * (`ADMISSION_DECISION_TIMEOUT_MS`), skip the retry for this read when the first attempt
-     * fails `cohort-unreachable`.
+     * answers, on every call since the answer is not kept, and {@link queryPeerRecord} may then
+     * load the `CadrePeer` view on top. If an isolated node's lookups are seen exceeding the
+     * admission gate's 2 s deadline (`ADMISSION_DECISION_TIMEOUT_MS`), skip the retry for this
+     * read when the first attempt fails `cohort-unreachable`.
      */
-    async readRevokedStampRows(tableName, retry) {
+    async readRevocationRowsOrNone(retry) {
         try {
-            return await this.readRows('select StampId from CadreControl.Revocation where TableName = ?', [tableName], 'revoked-stamps', retry);
+            return await this.readMembershipRows(this.revocationView, retry);
         }
         catch (error) {
             if (!isCohortUnreachableRead(error)) {
                 throw error;
             }
-            log('revoked-stamps(%s): no cohort member reachable and the Revocation block is not held here; reading as no revocations known: %s', tableName, error);
+            log('revoked-stamps: no cohort member reachable and the Revocation block is not held here; reading as no revocations known: %s', error);
             return [];
         }
     }
@@ -1573,10 +1790,10 @@ export class ControlDatabase {
      * `where`, so the composite-primary-key point-lookup hazard (see the statement comment in
      * {@link reissueRevocations}) does not arise. Unlocked, like every other read.
      *
-     * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}): it retires nothing, so
-     * neither sweep may reap or re-sign it, and skipping it keeps `RevocationRow.tableName`
-     * a {@link RevocableTable}. Filtered on `TableName` alone, in TypeScript: `RowIsGone`
-     * admits no other row under `'Revocation'`.
+     * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}) an older party may hold: it
+     * retires nothing, so neither sweep may reap or re-sign it, and skipping it keeps
+     * `RevocationRow.tableName` a {@link RevocableTable}. Filtered on `TableName` alone, in
+     * TypeScript: `RowIsGone` admits no other row under `'Revocation'`.
      *
      * `retry: false` from a caller that reads under the write lock, for the reason on
      * {@link queryCadrePeers}.
@@ -1584,24 +1801,16 @@ export class ControlDatabase {
     async queryRevocations(retry = true) {
         this.ensureInitialized();
         const rows = [];
-        const sql = 'select TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig from CadreControl.Revocation';
-        for (const row of await this.readRows(sql, undefined, 'revocations', retry)) {
-            if (row.TableName === REVOCATION_LEDGER_MARKER.tableName) {
-                continue;
+        for (const row of await this.readMembershipRows(this.revocationView, retry)) {
+            if (row.TableName !== REVOCATION_LEDGER_MARKER.tableName) {
+                rows.push(revocationRowOf(row));
             }
-            rows.push({
-                tableName: row.TableName,
-                rowKey: row.RowKey,
-                stampId: row.StampId,
-                reissuedAt: row.ReissuedAt ?? 0,
-                signerKey: row.SignerKey,
-                signerSig: row.SignerSig,
-            });
         }
         return rows;
     }
     /**
-     * Read a single peer's address record (the full `CadrePeer` row) by PeerId.
+     * Read a single peer's address record (the full `CadrePeer` row) by PeerId, found in the
+     * `CadrePeer` membership view ({@link readMembershipRows}).
      *
      * Returns null when no row exists, or when the row's `StampId` is retired in
      * `CadreControl.Revocation` — a revoked peer reads as absent, so the resolver
@@ -1617,29 +1826,34 @@ export class ControlDatabase {
      * The split `addrs` re-join to the exact stored `Multiaddr` (split-on-`,` is
      * the inverse of join-on-`,`), so the resolver re-verifies over the same bytes
      * the publisher signed.
+     *
+     * `retry: false` from the one caller that reads under the write lock,
+     * {@link updateSelfPeerRecord}'s body, for the reason on {@link queryCadrePeers}.
+     */
+    async queryPeerRecord(peerId, retry = true) {
+        const row = await this.findCadrePeerRow(peerId, retry);
+        return row === null ? null : peerAddressRecordOf(row);
+    }
+    /**
+     * One readable `CadrePeer` row by PeerId from the membership view, or null when no row exists
+     * or its stamp is retired in `Revocation` — the single-row read behind {@link queryPeerRecord}
+     * and the two writers that decide over the row inside their locked body
+     * ({@link updateSelfPeerRecord}, {@link reauthorizeCadrePeer}). Same retired-stamp rule as
+     * {@link queryCadrePeers}, and the same `retry` contract.
      */
-    async queryPeerRecord(peerId) {
+    async findCadrePeerRow(peerId, retry) {
         this.ensureInitialized();
-        const revoked = await this.queryRevokedStamps('CadrePeer');
-        for (const row of await this.readRows('select PeerId, PublicKey, Multiaddr, UpdatedAt, Profile, Sig, StampId from CadreControl.CadrePeer where PeerId = ?', [peerId], 'peer-record')) {
-            const stampId = row.StampId ?? null;
-            if (stampId !== null && revoked.has(stampId)) {
-                return null;
-            }
-            const multiaddr = row.Multiaddr ?? '';
-            return {
-                peerId: row.PeerId,
-                publicKey: row.PublicKey ?? '',
-                addrs: multiaddr.length > 0 ? multiaddr.split(',') : [],
-                updatedAt: row.UpdatedAt ?? 0,
-                profile: row.Profile ?? null,
-                sig: row.Sig ?? '',
-            };
+        const revoked = await this.queryRevokedStamps('CadrePeer', retry);
+        const row = (await this.readMembershipRows(this.cadrePeerView, retry)).find((candidate) => candidate.PeerId === peerId);
+        if (row === undefined) {
+            return null;
         }
-        return null;
+        const peer = cadrePeerRowOf(row);
+        return peer.stampId !== null && revoked.has(peer.stampId) ? null : peer;
     }
     /**
-     * Apply a peer's own self-signed address-record update to an existing row.
+     * Apply a peer's own self-signed address-record update to its existing row: read the row
+     * under the write lock, have `sign` build the record over it, and write that record.
      *
      * Authorization is carried entirely by the record: the `Sig` column (verified
      * by the `AuthorizedUpdate` self-branch against the stored `PublicKey`) plus
@@ -1648,6 +1862,21 @@ export class ControlDatabase {
      * exists. `PublicKey` is intentionally not in the SET list (it is immutable on
      * self-update and the constraint enforces `new.PublicKey = old.PublicKey`).
      *
+     * The read, the decision and the signature all run INSIDE the locked body, which is what
+     * lets it opt into {@link LOST_UPDATE_RETRY_POLICY}: the row has a second writer, the owner's
+     * re-touch ({@link reauthorizeCadrePeer}), and the two fire together while a cadre starts.
+     * When this write loses that race the commit is refused as a lost update and re-run, and the
+     * re-run reads the row the rival left — including its bumped `UpdatedAt`, which a record
+     * signed before the race could no longer exceed — and signs past it. A record signed outside
+     * the body would be re-presented unchanged and refused again, this time by the schema's
+     * monotonic rule, which is correctly never retried. The row's read inside is `retry: false`
+     * (see {@link queryStampId}'s NOTE).
+     *
+     * Returns the record actually written, so the caller's bookkeeping describes the row rather
+     * than the first record it signed; null, and nothing written, when no readable row exists:
+     * the row is absent, or its stamp is retired in `Revocation` (a revoked node reads its own row
+     * as absent every heartbeat, and must not refresh it).
+     *
      * Deliberately NOT wrapped in {@link mutateCadrePeer}, the one `CadrePeer` mutator that
      * is not: it only ever touches THIS node's own row (sole caller
      * `CadreNode.publishSelfRecord`), and `CadreNode.listAuthorizedMembers` filters self out
@@ -1660,17 +1889,43 @@ export class ControlDatabase {
      * row, and a self insert happens once at startup, so the wasted refresh is a single read
      * — cheaper than a conditional carve-out inside the shared writer. Only the repeating
      * path is worth exempting.
+     *
+     * @param peerId - the row to refresh: this node's own.
+     * @param sign - builds the signed record over the row as read; called once per attempt.
      */
-    async updateSelfPeerRecord(record) {
+    async updateSelfPeerRecord(peerId, sign) {
         this.ensureInitialized();
-        const multiaddr = record.addrs.join(',');
-        await this.execWrite(`
-      update CadreControl.CadrePeer
-        with context OwnerKey = null, Signature = ?
-        set Multiaddr = ?, UpdatedAt = ?, Profile = ?, Sig = ?
-        where PeerId = ?
-    `, [record.sig, multiaddr, record.updatedAt, record.profile, record.sig, record.peerId], 'self-record-update');
-        log('Self peer record updated: %s (updatedAt=%d)', record.peerId, record.updatedAt);
+        const written = await this.lockedWithRetry(async () => {
+            // retry: false — inside the locked write body (see queryStampId's NOTE).
+            // NOTE: this read of the Revocation and CadrePeer views is charged to the retry budget,
+            // so a cold view load that waits out a per-peer read deadline leaves the attempt no room
+            // for its one retry (the 14.7 s abandonment the policy's doc cites). The caller's read
+            // outside the funnel warms the views, so this is a cache hit except when a table change
+            // between the two reads dropped them — the racing case itself. If that residual ever
+            // matters, measure which phase of the losing attempt pays the deadline first; the
+            // retired-stamp check cannot simply move outside, since `publishSelfRecord`'s insert
+            // path reads a revoked node's row as absent and relies on this body to skip it.
+            const current = await this.queryPeerRecord(peerId, false);
+            if (current === null) {
+                return null;
+            }
+            const record = sign(current);
+            // Bare `exec` — inside the non-re-entrant write lock (see insertCadrePeer).
+            await this.db.exec(`
+        update CadreControl.CadrePeer
+          with context OwnerKey = null, Signature = ?
+          set Multiaddr = ?, UpdatedAt = ?, Profile = ?, Sig = ?
+          where PeerId = ?
+      `, [record.sig, record.addrs.join(','), record.updatedAt, record.profile, record.sig, peerId]);
+            return record;
+        }, LOST_UPDATE_RETRY_POLICY, 'self-record-update');
+        if (written === null) {
+            log('Self peer record not updated: no readable CadrePeer row for %s (absent, or its stamp retired)', peerId);
+        }
+        else {
+            log('Self peer record updated: %s (updatedAt=%d)', peerId, written.updatedAt);
+        }
+        return written;
     }
     /**
      * Read a single peer's device push token (the full `DeviceToken` row) by PeerId.
@@ -1903,6 +2158,13 @@ export class ControlDatabase {
      * body, and a row whose stamp is already retired (held without its delete) is skipped rather
      * than tombstoned twice. Nothing to remove writes nothing and returns all false.
      *
+     * Opted into {@link LOST_UPDATE_RETRY_POLICY} for the reason on {@link deleteCadrePeer}: every
+     * stamp and signature is minted inside the body, and the invitation keys come from the
+     * caller's plan, which a self-publish does not touch (a withdrawal of an invitation withdrawn
+     * since collides on `Revocation`'s primary key — a constraint failure, never retried, as
+     * before). A lost update after a sibling tree of the transaction already synced arrives as a
+     * partial commit and stays declined.
+     *
      * The caller decides which invitations the machine could use, from its plan
      * (`CadreNode.planMachineRemoval`).
      */
@@ -1935,7 +2197,7 @@ export class ControlDatabase {
                 removedDeviceToken: removed.has('DeviceToken'),
                 withdrawnInvitations: withdrawals.map((withdrawal) => withdrawal.ref.rowKey),
             };
-        });
+        }, LOST_UPDATE_RETRY_POLICY);
     }
     /**
      * The guarded removals {@link removeMachine} runs, signed over each row's current stamp:
@@ -1986,6 +2248,12 @@ export class ControlDatabase {
     async insertStrand(strandId, type, ownerKey, signMessage, memberPrivateKey) {
         this.ensureInitialized();
         log('Inserting strand: %s (type: %s)', strandId, type);
+        const insert = await this.signStrandInsert(strandId, type, ownerKey, signMessage, memberPrivateKey);
+        await this.execWrite(insert.sql, insert.params, 'strand-insert');
+        log('Strand inserted: %s', strandId);
+    }
+    /** The stamped, owner-signed `Strand` insert that {@link insertStrand} and {@link insertFoundingRows} run. */
+    async signStrandInsert(strandId, type, ownerKey, signMessage, memberPrivateKey) {
         // Generate a unique stamp ID using the peer ID for distributed uniqueness
         const peerId = this.config.libp2pNode.peerId.toString();
         const stampId = generateStampId(peerId);
@@ -1997,12 +2265,53 @@ export class ControlDatabase {
         const signature = await signMessage(message);
         // StampId is a real, unique column (single-use anti-replay), no longer a context value.
         // FounderOwnerKey must equal the signing owner or the constraint rejects the row.
-        await this.execWrite(`
-      insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey, FounderPeerId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?, ?)
-    `, [ownerKey, signature, strandId, type, memberPrivateKey ?? null, stampId, ownerKey, peerId], 'strand-insert');
-        log('Strand inserted: %s', strandId);
+        return {
+            sql: `
+        insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey, FounderPeerId)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?, ?, ?, ?)
+      `,
+            params: [ownerKey, signature, strandId, type, memberPrivateKey ?? null, stampId, ownerKey, peerId],
+        };
+    }
+    /**
+     * Insert one founding's control rows — the `Strand` row, a closed strand's `StrandPartyKey`
+     * row, and a formation invitation bound to the strand — in ONE transaction: one commit, and
+     * never a strand row without the key or invitation written beside it.
+     *
+     * Each row is stamped and signed exactly as its single-row writer ({@link insertStrand},
+     * {@link insertStrandPartyKey}, {@link insertFormationInvite}) does it, and all of that — the
+     * invitation's {@link canonicalDatetime} read included — happens BEFORE the write lock is
+     * taken: signing may prompt the user, and the lock held across a prompt would stall every
+     * other control write. A {@link lockedWithRetry} re-run re-presents the same signed rows.
+     *
+     * No row's `AuthorizedInsert` reads another of these rows (`StrandPartyKey` and
+     * `FormationInvite` check only `OwnerKey` and `Revocation`), so their order is free; the
+     * `Strand` row goes first, so a founding repeated over a stored row is refused on `Strand.Id`.
+     *
+     * A uniqueness rejection rolls the whole transaction back. The caller resolves it and writes
+     * again: a `Strand.Id` conflict is another founder's row, a `StrandPartyKey.Id` conflict a key
+     * stored with no strand row ({@link isStrandIdConflict}; see `CadreNode.publishStrand`).
+     */
+    async insertFoundingRows(rows, ownerKey, signMessage) {
+        this.ensureInitialized();
+        const { strand, partyKey, formationInvite } = rows;
+        log('Inserting founding rows: strand %s (type: %s, party key: %s, invitation: %s)', strand.id, strand.type, partyKey !== undefined, formationInvite !== undefined);
+        const inserts = [await this.signStrandInsert(strand.id, strand.type, ownerKey, signMessage, strand.memberPrivateKey)];
+        if (partyKey !== undefined) {
+            inserts.push(await this.signStrandPartyKeyInsert(strand.id, partyKey, ownerKey, signMessage));
+        }
+        if (formationInvite) {
+            const { token, sAppId, ...options } = formationInvite;
+            inserts.push(await this.signFormationInviteInsert(token, sAppId, ownerKey, signMessage, { ...options, strandId: strand.id }));
+        }
+        // Bare `exec`: the lock is held, and `execWrite` would take it again and self-deadlock.
+        await this.lockedWithRetry(() => this.inTransaction('found strand', async () => {
+            for (const insert of inserts) {
+                await this.db.exec(insert.sql, insert.params);
+            }
+        }), {}, 'strand-found');
+        log('Founding rows inserted: strand %s', strand.id);
     }
     /**
      * Delete a strand from the control database using an owner signature.
@@ -2091,18 +2400,25 @@ export class ControlDatabase {
     async insertStrandPartyKey(strandId, privateKey, ownerKey, signMessage) {
         this.ensureInitialized();
         log('Inserting strand party key for strand: %s', strandId);
-        const peerId = this.config.libp2pNode.peerId.toString();
-        const stampId = generateStampId(peerId);
+        const insert = await this.signStrandPartyKeyInsert(strandId, privateKey, ownerKey, signMessage);
+        await this.execWrite(insert.sql, insert.params, 'strand-party-key-insert');
+        log('Strand party key inserted for strand: %s', strandId);
+    }
+    /** The stamped, owner-signed `StrandPartyKey` insert that {@link insertStrandPartyKey} and {@link insertFoundingRows} run. */
+    async signStrandPartyKeyInsert(strandId, privateKey, ownerKey, signMessage) {
+        const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
         // Field order MUST match the schema's StrandPartyKey `AuthorizedInsert` verify:
         // Id, PrivateKey, StampId.
         const message = buildAuthorizationMessage('CadreControl.StrandPartyKey', 'add', this.config.partyId, [strandId, privateKey, stampId]);
         const signature = await signMessage(message);
-        await this.execWrite(`
-      insert into CadreControl.StrandPartyKey (Id, PrivateKey, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?)
-    `, [ownerKey, signature, strandId, privateKey, stampId], 'strand-party-key-insert');
-        log('Strand party key inserted for strand: %s', strandId);
+        return {
+            sql: `
+        insert into CadreControl.StrandPartyKey (Id, PrivateKey, StampId)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?)
+      `,
+            params: [ownerKey, signature, strandId, privateKey, stampId],
+        };
     }
     /**
      * Owner-signed removal of one `StrandPartyKey` row — the party's own membership
@@ -2386,32 +2702,44 @@ export class ControlDatabase {
         });
     }
     /**
-     * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
-     * rewrite `VouchOwner`/`VouchSig` under the owner branch of `CadrePeer.AuthorizedUpdate`
-     * (a signature over the SAME `'vouch'`-tagged digest {@link insertCadrePeer} builds), so
-     * the row is re-emitted as a fresh, broadcasting transaction.
-     *
-     * This is the write-while-alone re-replication primitive: a membership row that committed
-     * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it grows, by
-     * re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because the row
-     * already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness stamp
-     * and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact (the
-     * owner branch requires them kept: they are the machine's own claim) — so it is safe
-     * over a row whose peer has not self-published (`Sig` null); the caller must skip a row
-     * that already carries a self-`Sig` (that row is the owning peer's to refresh, and bumping
-     * `UpdatedAt` without re-signing would invalidate its self-signature).
-     *
-     * Signs over the row's CURRENT `StampId` (unchanged by the re-touch), read BEFORE the lock
-     * is taken. An absent row returns `false` WITHOUT notifying: nothing was written, so the
-     * membership snapshot cannot have changed.
-     *
-     * NOTE: that stamp read is outside the lock, same as {@link deleteGuardedRow}'s. A writer
-     * that removes the row in between makes the `update` match nothing, and this still returns
-     * `true` and notifies — harmless today (the sole caller, the write-while-alone drain, only
-     * logs the result, and a spurious notify just re-reads the member set), and a remove-then-
-     * re-add in the same window fails loudly instead, since the signature binds the retired
-     * stamp. If a caller ever acts on `true` as proof the row was written, fold the stamp read
-     * into the locked body.
+     * Owner "re-touch" of an existing `CadrePeer` membership row: rewrite `VouchOwner`/`VouchSig`
+     * (and, re-broadcasting, bump `UpdatedAt`) under the owner branch of
+     * `CadrePeer.AuthorizedUpdate` — a signature over the SAME `'vouch'`-tagged digest
+     * {@link insertCadrePeer} builds — so the row is re-emitted as a fresh, broadcasting
+     * transaction, or stands on a different owner's voucher.
+     *
+     * Re-broadcasting is the write-while-alone re-replication primitive: a membership row that
+     * committed local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it
+     * grows, by re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because
+     * the row already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness
+     * stamp and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact
+     * (the owner branch requires them kept: they are the machine's own claim) — so it is safe
+     * over a row whose peer has not self-published (`Sig` null), and this method itself skips a
+     * row that already carries a self-`Sig` (that row is the owning peer's to refresh, and
+     * bumping `UpdatedAt` without re-signing would invalidate its self-signature).
+     *
+     * The two modes ({@link CadrePeerRetouchMode}) differ in what they write: `'rebroadcast'`
+     * bumps `UpdatedAt` to `max(now, current + 1)` from the row read inside the body and writes
+     * only while the row's `Sig` is null; `'revouch'` leaves `UpdatedAt` out of the `set` list and
+     * writes whether or not the machine has self-published (the owner branch has no monotonic
+     * rule, so the column simply keeps its value).
+     *
+     * The row read (stamp, `Sig`, `UpdatedAt`), the mode's decision and the signature over the
+     * row's CURRENT `StampId` (unchanged by the re-touch) all run INSIDE the locked body, which is
+     * what lets both modes opt into {@link LOST_UPDATE_RETRY_POLICY}: the row's other writer is
+     * the machine's own publish ({@link updateSelfPeerRecord}), and the drain's re-broadcast fires
+     * at the moment that publish does. A re-run after losing to it reads the self-signed row and
+     * reports `'self-published'` instead of writing the owner branch over it — which would rewrite
+     * `UpdatedAt` under a `Sig` signed over the old value and make the record unverifiable to
+     * resolvers until the machine's next heartbeat. The decision has to be the body's for that;
+     * a caller's pre-check outside the lock is only a fast path (see below).
+     *
+     * An absent row — none, or its stamp retired, or a stampless row no writer produces — is
+     * `'absent'`. Checked once outside the lock too, as `'self-published'` is: the common case
+     * writes nothing, takes no lock and does NOT notify, so an absent target stays quiet
+     * ({@link SeedBootstrapService.removePeer} keeps the same gate for the same reason). The
+     * in-body re-check covers the race; a no-write outcome reached there notifies spuriously,
+     * which only re-reads the member set.
      *
      * Notifies like the insert/remove paths even though this is "only" a re-touch: it rewrites
      * VouchOwner/VouchSig, which the authorized-membership predicate judges on, so it CAN
@@ -2434,29 +2762,46 @@ export class ControlDatabase {
      * VouchOwner/VouchSig) rather than inherit this rebinding.
      *
      * @param peerId - the membership row to re-touch.
-     * @param updatedAt - the strictly-increasing freshness stamp to write.
+     * @param mode - re-broadcast or re-vouch ({@link CadrePeerRetouchMode}).
      * @param ownerKey - public key of the re-vouching owner, rewritten into `VouchOwner`.
-     * @param signMessage - ed25519-signs the raw message bytes with that owner's private key.
-     * @returns `true` when the row was re-touched, `false` when no row exists (no notify).
+     * @param signMessage - ed25519-signs the raw message bytes with that owner's private key;
+     *   called inside the lock, once per attempt (the NOTE on {@link ControlSign}).
+     * @returns what was found and done ({@link CadrePeerRetouchOutcome}).
      */
-    async reauthorizeCadrePeer(peerId, updatedAt, ownerKey, signMessage) {
+    async reauthorizeCadrePeer(peerId, mode, ownerKey, signMessage) {
         this.ensureInitialized();
-        const stampId = await this.queryStampId('CadrePeer', peerId);
-        if (stampId === null) {
-            log('reauthorizeCadrePeer: no CadrePeer row for %s (nothing to re-touch)', peerId);
-            return false;
+        const outside = retouchTarget(await this.findCadrePeerRow(peerId, true), mode);
+        if (typeof outside === 'string') {
+            log('reauthorizeCadrePeer(%s): %s for %s (nothing to write)', mode, outside, peerId);
+            return outside;
         }
-        const signature = await signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, stampId]));
-        await this.mutateCadrePeer('peer-reauthorize', async () => {
+        return await this.mutateCadrePeer('peer-reauthorize', async () => {
+            // retry: false — inside the locked write body (see queryStampId's NOTE).
+            const target = retouchTarget(await this.findCadrePeerRow(peerId, false), mode);
+            if (typeof target === 'string') {
+                log('reauthorizeCadrePeer(%s): %s for %s since the pre-check (nothing to write)', mode, target, peerId);
+                return target;
+            }
+            const signature = await signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, target.stampId]));
             // Bare `exec` — inside the non-re-entrant write lock (see insertCadrePeer).
-            await this.db.exec(`
-        update CadreControl.CadrePeer
-          with context OwnerKey = ?, Signature = ?
-          set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?, VouchUsage = null
-          where PeerId = ?
-      `, [ownerKey, signature, updatedAt, ownerKey, signature, peerId]);
-        });
-        return true;
+            if (mode === 'rebroadcast') {
+                await this.db.exec(`
+          update CadreControl.CadrePeer
+            with context OwnerKey = ?, Signature = ?
+            set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?, VouchUsage = null
+            where PeerId = ?
+        `, [ownerKey, signature, Math.max(Date.now(), target.updatedAt + 1), ownerKey, signature, peerId]);
+            }
+            else {
+                await this.db.exec(`
+          update CadreControl.CadrePeer
+            with context OwnerKey = ?, Signature = ?
+            set VouchOwner = ?, VouchSig = ?, VouchUsage = null
+            where PeerId = ?
+        `, [ownerKey, signature, ownerKey, signature, peerId]);
+            }
+            return 'retouched';
+        }, LOST_UPDATE_RETRY_POLICY);
     }
     /**
      * Owner-signed removal of one `CadrePeer` membership row, notifying the membership
@@ -2477,9 +2822,15 @@ export class ControlDatabase {
      *
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
+     *
+     * Opted into {@link LOST_UPDATE_RETRY_POLICY}: the row's machine may publish its own record
+     * at the moment of the removal (its first publish lands about a second after it starts), and
+     * the removal that loses is refused as a lost update. {@link deleteGuardedRow} reads the stamp
+     * and signs inside the body, and a self-publish never changes the stamp the `'remove'` digest
+     * binds, so the re-run reads the published row and removes it.
      */
     deleteCadrePeer(peerId, ownerKey, signMessage) {
-        return this.mutateCadrePeer('peer-remove', () => this.deleteGuardedRow('CadrePeer', peerId, ownerKey, signMessage));
+        return this.mutateCadrePeer('peer-remove', () => this.deleteGuardedRow('CadrePeer', peerId, ownerKey, signMessage), LOST_UPDATE_RETRY_POLICY);
     }
     /**
      * Owner-signed removal of one peer's `DeviceToken` row (logout / token invalidation).
@@ -2566,9 +2917,8 @@ export class ControlDatabase {
     /**
      * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
      * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of an
-     * issued row's withdrawal ({@link withdrawIssuedRow}), whose row stays — or the ledger
-     * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
-     * lock and, where one is needed, the transaction.
+     * issued row's withdrawal ({@link withdrawIssuedRow}), whose row stays. The caller
+     * supplies the lock and, where one is needed, the transaction.
      *
      * `ReissuedAt` is named explicitly at 0 (the only value `FreshTombstone` accepts) rather
      * than leaning on the column default — the seat-at-zero rule is load-bearing for
@@ -2622,9 +2972,10 @@ export class ControlDatabase {
      * statement, and without the clause the reap would delete the owner's brand-new row.
      * With it the statement matches nothing and the reap is a silent no-op (the schema
      * branch would also refuse that delete, but as a constraint error thrown into a
-     * background sweep — matched-nothing is the better failure mode). Like
-     * {@link reauthorizeCadrePeer}, a race lost AFTER the guard still returns `true`;
-     * harmless — nothing was deleted, and the next sweep re-reads.
+     * background sweep — matched-nothing is the better failure mode). A race lost AFTER the
+     * guard still returns `true` here (unlike {@link reauthorizeCadrePeer}, which reads inside
+     * its lock and reports what it found); harmless — nothing was deleted, and the next sweep
+     * re-reads.
      *
      * Writes NOTHING to `Revocation`: `RevocationRecorded` is satisfied by the same
      * committed tombstone that authorizes the reap, so a reap files no second tombstone.
@@ -2651,7 +3002,7 @@ export class ControlDatabase {
      * present clause are the shape {@link redeemInvitation}'s consent-branch insert ships).
      *
      * Driven automatically by {@link reapRevokedRows}, which the periodic control-cohort
-     * reconcile pass runs while the node has at least one control connection.
+     * reconcile pass runs while a sibling is reachable (`CadreNode.hasReachableControlSibling`).
      */
     async reapRevokedRow(table, rowKey, stampId) {
         this.ensureInitialized();
@@ -2709,8 +3060,8 @@ export class ControlDatabase {
      * carry the delete (replaying a delete of an already-absent row is a no-op), so a node
      * that converged on a removal while holding the removed row keeps that row as inert
      * garbage until something walks the tombstones and drops it. `CadreNode`'s periodic
-     * control-cohort reconcile pass is that something, gated on the node having at least one
-     * control connection (a reap is a write, and a write committed alone is local-only).
+     * control-cohort reconcile pass is that something, gated on a sibling being reachable
+     * (a reap is a write, and a write committed alone is local-only).
      *
      * Enumerated UNLOCKED, deleted per-row LOCKED: {@link reapRevokedRow} takes the write
      * lock itself (via {@link mutateCadrePeer} / {@link execWrite}) and the lock is not
@@ -2743,12 +3094,11 @@ export class ControlDatabase {
      *
      * NOTE: cost is O(tombstones), not O(live rows) — one {@link queryRevocations} scan plus
      * one {@link queryStampId} point lookup per tombstone, and the empty early return makes
-     * the common case (a party that has never revoked anyone; {@link queryRevocations} skips
-     * the ledger marker) a single scan per pass. That scan consults the cohort on every pass
-     * only while `Revocation` has never been written; the ledger marker
-     * ({@link openRevocationLedger}), filed by the same connected pass, makes it a held block.
+     * the common case (a party that has never revoked anyone) a single scan per pass, served
+     * from the `Revocation` membership view
+     * ({@link readMembershipRows}) unless the table changed since the last read.
      * But `Revocation` is append-only and unbounded, so this is O(all tombstones ever) point
-     * lookups on every reconcile tick. Fine while revocations stay rare for a cadre-sized
+     * lookups on every connected reconcile pass. Fine while revocations stay rare for a cadre-sized
      * party; if the table ever grows, persist a node-local high-water mark of what has
      * already been reaped instead of re-scanning everything (the same bound the sweep in
      * `CadreNode.drainPendingRevocations` wants).
@@ -2856,69 +3206,6 @@ export class ControlDatabase {
             return executed;
         }, {}, 'revocation-reissue');
     }
-    /**
-     * Owner-signed filing of the singleton `Revocation` ledger marker
-     * ({@link REVOCATION_LEDGER_MARKER}), the one row in that table that retires nothing.
-     *
-     * Why it exists: while `Revocation` has never been written, this node does not hold its
-     * block, and Optimystic consults a block's cohort on EVERY read of a block it does not
-     * hold — and every membership lookup, and every guarded insert's `NotRevoked` check,
-     * reads this table. Once any row exists the block is held and re-checked at most once per
-     * read-repair window, like every other populated table. The schema's table comment says
-     * why the row can never read as a retirement.
-     *
-     * Insert-if-absent, shaped like {@link reissueRevocations}: the signature is minted
-     * OUTSIDE the locked body so a retried attempt re-presents the same one, and the guard
-     * runs INSIDE it so it sees a concurrent local writer's committed row. The guard scans
-     * the `'Revocation'` rows and compares the stamp in TypeScript rather than seeking the
-     * full composite primary key, which is served as a point lookup that can miss an existing
-     * row on a networked database (tickets/backlog/debt-composite-pk-point-lookup-unreliable-untracked).
-     *
-     * Two owners filing at once: the loser either sees the marker in its guard or is refused
-     * on the primary key, and both answer `'already-open'`.
-     *
-     * The caller decides WHEN. A marker committed while the node is alone is local-only and
-     * can fork the collection, so {@link CadreNode} files it only while connected; this
-     * method does not look at connectivity.
-     *
-     * @param ownerKey - owner public key for the write context (`Revocation.Authorized`).
-     * @param signMessage - ed25519-signs the raw message bytes (no pre-hash) with that owner's
-     *   private key, returning a base64url signature.
-     * @returns `'opened'` when this call filed the marker, `'already-open'` when it was
-     *   already there.
-     */
-    async openRevocationLedger(ownerKey, signMessage) {
-        this.ensureInitialized();
-        const signature = await signMessage(revocationTombstoneMessage(this.config.partyId, REVOCATION_LEDGER_MARKER));
-        try {
-            return await this.lockedWithRetry(async () => {
-                if (await this.revocationLedgerFiled()) {
-                    return 'already-open';
-                }
-                // execTombstone is a bare `exec`: already inside the write lock, which is NOT re-entrant.
-                await this.execTombstone(REVOCATION_LEDGER_MARKER, signature, ownerKey);
-                log('Revocation ledger marker filed');
-                return 'opened';
-            }, {}, 'revocation-ledger-open');
-        }
-        catch (error) {
-            if (!isRevocationLedgerConflict(error)) {
-                throw error;
-            }
-            log('Revocation ledger marker already filed (refused on the primary key, most likely by another owner filing first): %s', error);
-            return 'already-open';
-        }
-    }
-    /**
-     * Whether the ledger marker is present locally: a scan of the `'Revocation'` rows with the
-     * stamp compared in TypeScript (see {@link openRevocationLedger} for why not a seek).
-     * Called only inside the locked write body, so never retried (see queryStampId's NOTE).
-     */
-    async revocationLedgerFiled() {
-        const { tableName, stampId } = REVOCATION_LEDGER_MARKER;
-        const rows = await this.readRows('select StampId from CadreControl.Revocation where TableName = ?', [tableName], 'revocation-ledger', false);
-        return rows.some(row => row.StampId === stampId);
-    }
     /**
      * Run `body` between `beginTransaction` and `commit`, rolling back on failure.
      *
@@ -2966,10 +3253,26 @@ export class ControlDatabase {
      * {@link CadreNode}, which wires this in `start()` and clears it on teardown. A
      * second call replaces the first rather than fanning out, so a stale node can
      * never keep receiving notifications for a database it no longer owns.
+     *
+     * Only this database's own writes notify here, awaited inside the write so the gate is
+     * current before the write returns. A membership change replicated in from another
+     * machine reaches the gate through the subscription `CadreNode.start` takes on the
+     * membership tables ({@link watchTables}), a coalesced run up to 50 ms after the change
+     * lands in storage; one storage never hears of waits for the reconcile pass's backstop.
      */
     setMembershipChangeListener(listener) {
         this.membershipListener = listener;
     }
+    /**
+     * Subscribe `onChange` to changes in control tables (`'CadreControl.Strand'`, …): commits
+     * made here and changes replicated into this node's storage alike, on the single-flight
+     * schedule `table-change-watch.ts` describes. {@link close} disposes every subscription
+     * still live before it drains the write queue.
+     */
+    watchTables(tables, onChange, options) {
+        this.ensureInitialized();
+        return this.tableWatches.watch(this.db, tables, onChange, options);
+    }
     /**
      * Wire (or clear, with null) the single listener notified after every committed
      * guarded-table delete. Same ownership contract as
@@ -3028,8 +3331,11 @@ export class ControlDatabase {
      * exhaustion.
      *
      * @param reason - Label for the log line only (e.g. `'peer-insert'`).
+     * @param policy - The retry policy, default unless the body has earned a wider one: the three
+     *   `CadrePeer` writers whose bodies re-read the row and decide inside pass
+     *   `LOST_UPDATE_RETRY_POLICY` (its `NOTE:` names them and the rule).
      */
-    async mutateCadrePeer(reason, body) {
+    async mutateCadrePeer(reason, body, policy = {}) {
         this.ensureInitialized();
         return this.lockedWithRetry(async () => {
             this.assertCommitBoundary(reason, 'on entry to');
@@ -3037,7 +3343,7 @@ export class ControlDatabase {
             this.assertCommitBoundary(reason, 'on return from');
             await this.notifyMembershipChanged(reason);
             return result;
-        }, {}, reason);
+        }, policy, reason);
     }
     /**
      * Run one local write under the database-wide write lock, serializing it against
@@ -3051,8 +3357,8 @@ export class ControlDatabase {
      * class: every public write method of this class runs its statement(s) under it, and
      * `SeedBootstrapService` reaches it through {@link execWrite} rather than touching the
      * `Database` directly, so it is covered too. The race is
-     * real, not theoretical: the background self-record publish on a control connection
-     * opening (`CadreNode.drainPendingControlReplication` → `registerSelf`) collided with
+     * real, not theoretical: the background self-record publish when a sibling becomes
+     * reachable (`CadreNode.drainPendingControlReplication` → `registerSelf`) collided with
      * a foreground `authorizePeer` — both `CadrePeer` inserts — and tripped the boundary
      * assert.
      *
@@ -3076,6 +3382,11 @@ export class ControlDatabase {
      * re-runnable means a retry re-runs the body's reads too, which is what makes it safe.
      * Signatures and stamp ids minted OUTSIDE the body are deliberately NOT re-minted per
      * attempt: a retry re-presents the exact signed message the first attempt presented.
+     * A body opted into `LOST_UPDATE_RETRY_POLICY` is the exception, and must mint INSIDE:
+     * its re-run is a re-decision over a row another writer changed, not a re-presentation of
+     * the same write, so its read of the row, its decision and its signature all run in the
+     * body ({@link updateSelfPeerRecord}, {@link reauthorizeCadrePeer}, {@link deleteGuardedRow}
+     * under {@link deleteCadrePeer}, {@link removeMachine}).
      */
     async withWriteLock(fn) {
         // Chain behind the current tail regardless of how it settled, then park a
@@ -3116,9 +3427,14 @@ export class ControlDatabase {
      * `initialized` is set — so it reaches this method directly rather than through
      * {@link execWrite}, whose {@link ensureInitialized} would reject it. The write queue is
      * necessarily empty at that point, so the lock is uncontended there; it is taken anyway
-     * rather than carving out a lockless path. It is also the ONLY caller that passes a
-     * `policy` — everything else takes the default, whose classifier and attempt count are
-     * unchanged by that call site existing.
+     * rather than carving out a lockless path.
+     *
+     * Two policies reach here besides the default: `SCHEMA_INIT_RETRY_POLICY` from that one
+     * call site, and `LOST_UPDATE_RETRY_POLICY` from the `CadrePeer` writers that re-read the
+     * row inside their body ({@link updateSelfPeerRecord} directly; {@link reauthorizeCadrePeer},
+     * {@link deleteCadrePeer} and {@link removeMachine} through {@link mutateCadrePeer}'s
+     * policy parameter). Everything else takes the default, whose classifier and attempt count
+     * are unchanged by those call sites existing.
      *
      * `label` names the operation in this loop's debug lines and nothing else
      * ({@link ControlWriteRetryOptions.label}). Every call site in this class supplies one:
@@ -3249,6 +3565,15 @@ export class ControlDatabase {
     async insertFormationInvite(token, sAppId, ownerKey, signMessage, options = {}) {
         this.ensureInitialized();
         log('Inserting formation invite: %s', token);
+        const insert = await this.signFormationInviteInsert(token, sAppId, ownerKey, signMessage, options);
+        await this.execWrite(insert.sql, insert.params, 'formation-invite-insert');
+        log('Formation invite inserted: %s', token);
+    }
+    /**
+     * The stamped, owner-signed `FormationInvite` insert that {@link insertFormationInvite} and
+     * {@link insertFoundingRows} run. Reads the engine once, for the canonical `ExpiresAt`.
+     */
+    async signFormationInviteInsert(token, sAppId, ownerKey, signMessage, options) {
         const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
         // Build each bound field exactly as the deferred CHECK sees it post-coercion:
         //   - ExpiresAt: engine-canonical datetime string (or '' when absent), sourced from
@@ -3272,20 +3597,22 @@ export class ControlDatabase {
         // Persist the canonical ExpiresAt string (datetime parse is idempotent on it) so the
         // signed source-of-truth and the stored value are produced once. StampId is a real,
         // unique column (single-use anti-replay), no longer a context value.
-        await this.execWrite(`
-      insert into CadreControl.FormationInvite (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId)
-        with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?, ?, ?)
-    `, [
-            ownerKey, signature,
-            token, sAppId,
-            expiresAtCanonical,
-            options.totalUses ?? null,
-            options.validationUrl ?? null,
-            options.strandId ?? null,
-            stampId,
-        ], 'formation-invite-insert');
-        log('Formation invite inserted: %s', token);
+        return {
+            sql: `
+        insert into CadreControl.FormationInvite (Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?, ?, ?, ?, ?)
+      `,
+            params: [
+                ownerKey, signature,
+                token, sAppId,
+                expiresAtCanonical,
+                options.totalUses ?? null,
+                options.validationUrl ?? null,
+                options.strandId ?? null,
+                stampId,
+            ],
+        };
     }
     /**
      * Redeem a `FormationInvite` by inserting the `Strand` row and a matching
@@ -3372,14 +3699,13 @@ export class ControlDatabase {
      * Use {@link redeemInvitation} instead when the strand must be created by
      * consent atomically with the usage.
      *
-     * The strand's live `StampId` is read first and written onto the usage row:
+     * The strand's live `StampId` is written onto the usage row:
      * `FormationUsage.StrandExists` matches the (id, stamp) PAIR, and
      * `Strand.AuthorizedInsert`'s consent branch reads the same pair back, so a consent
-     * record authorizes exactly the strand ROW it was recorded against. A missing strand
-     * THROWS here rather than being left to the deferred `StrandExists` CHECK — the
-     * ordinary "host strand has not converged yet" case is already reported as `missing`
-     * by {@link ControlFormationUsageRecorder.resolveStrand}, so an absent row at this
-     * point is a genuine race and deserves a named error, not a silent rollback.
+     * record authorizes exactly the strand ROW it was recorded against. A caller that already
+     * read the stamp passes it (`strandStampId`); otherwise it is read here first, and a
+     * missing strand THROWS {@link MissingHostStrandError} rather than being left to the
+     * deferred `StrandExists` CHECK.
      *
      * The row is keyed by the joiner's own nonce (`UsageStampId` is the primary key), so this
      * path — the one production actually races on (a bound invite published by `cadre-web` /
@@ -3393,7 +3719,7 @@ export class ControlDatabase {
         const { token, strandId, disclosure = '', peerKey, peerSignature, usageStampId, nowMs, validationKey, validationSignature, signal, totalUses, } = params;
         // The host strand is pre-existing and owner-signed; its stamp names the strand ROW the
         // consent record authorizes.
-        const strandStampId = await this.queryStrandStampId(strandId);
+        const strandStampId = params.strandStampId ?? await this.queryStrandStampId(strandId);
         if (strandStampId === null) {
             throw new MissingHostStrandError(strandId, token);
         }
@@ -3514,7 +3840,7 @@ export class ControlDatabase {
      * permissive PRE-check that runs ahead of it, and a transiently short read costs each of
      * them only a worse outcome for the ATTEMPT, never a seat the invitation did not pay for:
      * {@link assertSeatRemains} loses its named exhaustion error and falls back to the CHECK's
-     * generic refusal; `ControlFormationUsageRecorder.isTokenUsed` reports not-used and lets
+     * generic refusal; `ControlFormationUsageRecorder.readToken` reports a seat free and lets
      * the redemption proceed to the CHECK, which decides; {@link hasOutstandingFormationInvite}
      * holds the stranger-admission door open slightly longer.
      *
@@ -3547,12 +3873,12 @@ export class ControlDatabase {
     /**
      * Is any `FormationInvite` row still redeemable — unexpired AND with usage
      * below its `TotalUses`? A null `ExpiresAt` never expires and a null
-     * `TotalUses` is unlimited, matching {@link ControlFormationUsageRecorder}'s
-     * per-token semantics (`isTokenValid` / `isTokenUsed`).
+     * `TotalUses` is unlimited, matching the per-token semantics of `classifyTokenRead`
+     * (`formation-token.ts`).
      *
      * Answers the control-network connection gate's coarse "does this node expect
      * a stranger?" question, which has no token to ask about. The expiry
-     * comparison is `expiresAtMs <= now` — identical to `isTokenValid`'s — so an
+     * comparison is `expiresAtMs <= now` — identical to `isInviteExpired`'s — so an
      * invite the formation handler would reject can never hold the gate open.
      *
      * The scan is deliberately not pushed into SQL: nothing else here compares a
@@ -3734,8 +4060,10 @@ export class ControlDatabase {
      * the row is the holder's proof and never goes away; liveness is {@link hasLiveCadreInvite}'s
      * question, and `CadreInviteUsage.Authorized`'s at redemption.
      *
-     * `retry: false` is passed by {@link redeemCadreInvite}, which reads INSIDE its locked write
-     * body — the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
+     * A redemption reads the row once, before its write, and carries it into
+     * {@link isCadreInviteLive} and {@link redeemCadreInvite}. `retry: false` is passed by
+     * {@link redeemCadreInvite} when it was handed none and reads INSIDE its locked write body —
+     * the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
      */
     async queryCadreInvite(key, retry = true) {
         this.ensureInitialized();
@@ -3752,19 +4080,15 @@ export class ControlDatabase {
      * {@link queryCadrePeers}' reason.
      */
     async queryCadreInvites(retry = true) {
-        this.ensureInitialized();
-        const rows = await this.readRows(CADRE_INVITE_SELECT_SQL, undefined, 'cadre-invites', retry);
-        return rows.map(cadreInviteRowOf);
+        return (await this.readMembershipRows(this.cadreInviteView, retry)).map(cadreInviteRowOf);
     }
     /**
      * Every `CadreInviteUsage` row this node holds — the redemption records the membership
      * predicate verifies invitation-admitted rows against. Same `retry` contract as
-     * {@link queryCadreInvites}.
+     * {@link queryCadreInvites}; both come from their membership views ({@link readMembershipRows}).
      */
     async queryCadreInviteUsages(retry = true) {
-        this.ensureInitialized();
-        const rows = await this.readRows('select UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, InviteSig, PeerSig from CadreControl.CadreInviteUsage', undefined, 'cadre-invite-usages', retry);
-        return rows.map(cadreInviteUsageRowOf);
+        return (await this.readMembershipRows(this.cadreInviteUsageView, retry)).map(cadreInviteUsageRowOf);
     }
     /**
      * How many times a cadre invitation has been redeemed (its `CadreInviteUsage` rows), served
@@ -3807,6 +4131,9 @@ export class ControlDatabase {
         // counts make that free today; if a long-lived cadre accumulates thousands and inbound
         // upgrades slow down, add an expiry-ordered index or prune withdrawn/expired rows (which
         // first needs every device they admitted re-vouched, so the chain no longer needs them).
+        // NOTE: this scan reaches storage while queryCadreInvites serves the same rows from the
+        // membership view; if the stranger path's reads ever near the gate's 2 s deadline, walk
+        // queryCadreInvites() here instead.
         const metered = [];
         let unlimitedLive = false;
         for (const row of await this.readRows('select Key, ExpiresAt, TotalUses, IssuerKey, StampId from CadreControl.CadreInvite', undefined, 'live-cadre-invites')) {
@@ -3837,16 +4164,21 @@ export class ControlDatabase {
     }
     /**
      * Is this one cadre invitation still redeemable here — the conditions
-     * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is the one this node
-     * holds under `invite.key`; when it holds none, `invite` itself (a bundle's copy, not seated
-     * yet), but only if its issuer signature verifies, because an unsigned copy would otherwise be
-     * judged by whichever owner it names as issuer. A permissive pre-check like
-     * {@link countCadreInviteUsage}: {@link seatCadreInvite} and the redemption's own write are
-     * what enforce every condition.
+     * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is `held`, the one this
+     * node holds under `invite.key` ({@link queryCadreInvite}, read by the caller); when it holds
+     * none, `invite` itself (a bundle's copy, not seated yet), but only if its issuer signature
+     * verifies, because an unsigned copy would otherwise be judged by whichever owner it names as
+     * issuer. A permissive pre-check like {@link countCadreInviteUsage}: {@link seatCadreInvite}
+     * and the redemption's own write are what enforce every condition.
+     *
+     * The use count read here is read again inside the redemption's write lock
+     * ({@link assertCadreInviteSeatRemains}), on purpose: this one decides whether the device is
+     * pushed the control store before the write, so the holder of a spent invitation is refused
+     * without being sent anything; the in-lock one decides the seat, against a concurrent redemption.
      */
-    async isCadreInviteLive(invite, nowMs = Date.now()) {
+    async isCadreInviteLive(invite, held, nowMs = Date.now()) {
         this.ensureInitialized();
-        const row = await this.queryCadreInvite(invite.key) ?? (verifyCadreInviteRow(this.config.partyId, invite) ? invite : null);
+        const row = held ?? (verifyCadreInviteRow(this.config.partyId, invite) ? invite : null);
         return this.issuedRowLive('CadreInvite', row, nowMs, key => this.countCadreInviteUsage(key));
     }
     /**
@@ -3994,12 +4326,12 @@ export class ControlDatabase {
      */
     async redeemCadreInvite(params) {
         this.ensureInitialized();
-        const { inviteKey, peerId, peerKey, usageStampId, inviteSig, peerSig } = params;
+        const { inviteKey, peerId, peerKey, record, usageStampId, inviteSig, peerSig } = params;
         const nowMs = params.nowMs ?? Date.now();
         const multiaddr = params.multiaddrs?.length ? params.multiaddrs.join(',') : '';
         log('Redeeming cadre invitation %s for %s', inviteKey, peerId);
         return this.mutateCadrePeer('cadre-invite-redeem', async () => {
-            const invite = await this.queryCadreInvite(inviteKey, false);
+            const invite = params.held ?? await this.queryCadreInvite(inviteKey, false);
             if (invite === null) {
                 throw new IssuedRowNotHereYetError('CadreInvite', inviteKey);
             }
@@ -4018,10 +4350,11 @@ export class ControlDatabase {
             const nowCanonical = await canonicalDatetime(this.db, nowMs);
             await this.inTransaction('cadre-invite-redeem', async () => {
                 await this.db.exec(`
-          insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig, VouchUsage)
+          insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, Profile, StampId, VouchOwner, VouchSig, VouchUsage)
             with context OwnerKey = null, Signature = null
-            values (?, ?, ?, ?, null, ?, ?, null, ?)
-        `, [peerId, peerKey, multiaddr, nowMs, peerStampId, invite.issuerKey, usageStampId]);
+            values (?, ?, ?, ?, ?, ?, ?, ?, null, ?)
+        `, [peerId, peerKey, multiaddr, record?.updatedAt ?? nowMs, record?.sig ?? null, record?.profile ?? null,
+                    peerStampId, invite.issuerKey, usageStampId]);
                 await this.db.exec(`
           insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, InviteSig, PeerSig)
             with context Now = ?
@@ -4119,7 +4452,9 @@ export class ControlDatabase {
     /**
      * Read one `OwnerGrant` row by key, or null when absent. Withdrawn rows are returned too,
      * as {@link queryCadreInvite} returns them: the row is the holder's proof and never goes
-     * away. `retry: false` is passed by {@link redeemOwnerGrant}, inside its locked body.
+     * away. Read once per redemption and carried into {@link isOwnerGrantLive} and
+     * {@link redeemOwnerGrant}; `retry: false` is passed by {@link redeemOwnerGrant} when it was
+     * handed none and reads inside its locked body.
      */
     async queryOwnerGrant(key, retry = true) {
         this.ensureInitialized();
@@ -4134,15 +4469,11 @@ export class ControlDatabase {
      * `retry: false` is forwarded from the membership-gate refresh for {@link queryCadrePeers}' reason.
      */
     async queryOwnerGrants(retry = true) {
-        this.ensureInitialized();
-        const rows = await this.readRows(OWNER_GRANT_SELECT_SQL, undefined, 'owner-grants', retry);
-        return rows.map(ownerGrantRowOf);
+        return (await this.readMembershipRows(this.ownerGrantView, retry)).map(ownerGrantRowOf);
     }
-    /** Every `OwnerGrantUsage` row this node holds — the redemption records a grant-seated `OwnerKey` row is verified against. Same `retry` contract as {@link queryOwnerGrants}. */
+    /** Every `OwnerGrantUsage` row this node holds — the redemption records a grant-seated `OwnerKey` row is verified against. Same `retry` contract as {@link queryOwnerGrants}; both come from their membership views ({@link readMembershipRows}). */
     async queryOwnerGrantUsages(retry = true) {
-        this.ensureInitialized();
-        const rows = await this.readRows('select UsageStampId, GrantKey, SeatedKey, SeatedStampId, GrantSig, OwnerSig from CadreControl.OwnerGrantUsage', undefined, 'owner-grant-usages', retry);
-        return rows.map(ownerGrantUsageRowOf);
+        return (await this.readMembershipRows(this.ownerGrantUsageView, retry)).map(ownerGrantUsageRowOf);
     }
     /**
      * How many times an owner grant has been redeemed (its `OwnerGrantUsage` rows), served
@@ -4154,14 +4485,16 @@ export class ControlDatabase {
     }
     /**
      * Is this one owner grant still redeemable here — not withdrawn, unexpired, uses left, issuer
-     * still an owner — judged as {@link isCadreInviteLive} judges an invitation: by the row this
-     * node holds under `grant.key`, else by `grant` itself (a bundle's copy, not seated yet)
-     * when its issuer signature verifies. A permissive pre-check; {@link seatOwnerGrant} and the
-     * redemption's own write enforce every condition.
+     * still an owner — judged as {@link isCadreInviteLive} judges an invitation: by `held`, the row
+     * this node holds under `grant.key` ({@link queryOwnerGrant}, read by the caller), else by
+     * `grant` itself (a bundle's copy, not seated yet) when its issuer signature verifies. A
+     * permissive pre-check; {@link seatOwnerGrant} and the redemption's own write enforce every
+     * condition. Its use count is read again inside the write lock, for
+     * {@link isCadreInviteLive}'s reason.
      */
-    async isOwnerGrantLive(grant, nowMs = Date.now()) {
+    async isOwnerGrantLive(grant, held, nowMs = Date.now()) {
         this.ensureInitialized();
-        const row = await this.queryOwnerGrant(grant.key) ?? (verifyOwnerGrantRow(this.config.partyId, grant) ? grant : null);
+        const row = held ?? (verifyOwnerGrantRow(this.config.partyId, grant) ? grant : null);
         return this.issuedRowLive('OwnerGrant', row, nowMs, key => this.countOwnerGrantUsage(key));
     }
     /**
@@ -4224,7 +4557,7 @@ export class ControlDatabase {
         const nowMs = params.nowMs ?? Date.now();
         log('Redeeming owner grant %s for %s', grantKey, seatedKey);
         return this.mutateCadrePeer('owner-grant-redeem', async () => {
-            const grant = await this.queryOwnerGrant(grantKey, false);
+            const grant = params.held ?? await this.queryOwnerGrant(grantKey, false);
             if (grant === null) {
                 throw new IssuedRowNotHereYetError('OwnerGrant', grantKey);
             }
@@ -4261,7 +4594,10 @@ export class ControlDatabase {
     /**
      * Close the database and cleanup resources.
      *
-     * Drains the local-write chain first: {@link withWriteLock} can park a write behind
+     * Disposes every {@link watchTables} subscription before anything else, so a commit that
+     * lands while the write chain drains schedules no run, and again before dropping the handle.
+     *
+     * Then drains the local-write chain: {@link withWriteLock} can park a write behind
      * others across an await, and a queued closure evaluates `this.db!` only when it
      * finally runs — so nulling the handle out from under it would throw a TypeError on a
      * null handle instead of committing. The tail never rejects (it swallows both
@@ -4272,11 +4608,17 @@ export class ControlDatabase {
      * deadline) if a write can ever hang.
      */
     async close() {
+        this.tableWatches.disposeAll();
         await this.writeQueue;
         if (this.collectionFactory) {
             await this.collectionFactory.shutdown();
             this.collectionFactory = null;
         }
+        this.txnBridge = null;
+        // Again: a subscription taken during the awaits above would keep its timers past close.
+        this.tableWatches.disposeAll();
+        // Here, not first: a read started during the awaits above must not install either.
+        this.invalidateMembershipViews();
         if (this.db) {
             void this.db.close();
             this.db = null;