@serfab/cadre-core 1.6.0 → 1.8.0

package/src/cadre-node.ts

@@ -2,6 +2,7 @@ import debug from 'debug';
 import { toString as uint8ArrayToString, fromString as uint8ArrayFromString } from 'uint8arrays';
 import type { Libp2p, PeerId, PrivateKey, Connection } from '@libp2p/interface';
 import { peerIdFromString, peerIdFromPrivateKey } from '@libp2p/peer-id';
+import { generateKeyPair } from '@libp2p/crypto/keys';
 import { createLibp2pNode, type IRawStorage } from '@optimystic/db-p2p';
 import { wrapStorageWithCache, disposeStorageCache } from '@serfab/quereus-plugin-sereus';
 import { multiaddr } from '@multiformats/multiaddr';
@@ -49,13 +50,22 @@ import {
   isValidStrandScopeKey
 } from './storage-scope.js';
 import { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
-import { assertNotPreSplitStrand, issueInvite, PreSplitStrandIdentityError } from './strand-membership-writer.js';
+import { assertNotPreSplitStrand, issueInvite, PreSplitStrandIdentityError, readStrandHeaderSAppId } from './strand-membership-writer.js';
 import { MEMBERSHIP_INVITE_TTL_MS } from './strand-formation-manager.js';
 import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore, type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
 import { MemoryBootstrapPeerStore, type BootstrapPeerStore } from './bootstrap-peer-store.js';
+import { MemoryStrandPeerBookStore, type StrandPeerBookStore, type StrandPeerEntry } from './strand-peer-book.js';
+import type { StrandPeerObservation } from './strand-peer-observer.js';
 import { MemoryEnrolledMachineStore, type EnrolledMachineStore } from './enrolled-machine-store.js';
+import {
+  JoinedStrandSession,
+  KeyStoreJoinedStrandStore,
+  MemoryJoinedStrandStore,
+  type JoinedStrandStore,
+  type PartyJoinedStrandLedger
+} from './joined-strand-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './peer-addr-book.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
@@ -89,21 +99,21 @@ import {
 } from './control-cohort.js';
 import {
   dialPeerAddrs,
+  SelfRelayOnlyError,
   CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS,
   type PeerDialBudget
 } from './peer-dial.js';
-import { connectionManagerTimeouts, peerJoinPushBudget, relayReservationBudgetMs, relayedDialBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
+import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, peerJoinPushBudget, relayAdmissionReserveDeadlineMs, relayReservationBudgetMs, relayedDialBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
 import { ControlDatabase, isStrandIdConflict, type RevokedRowRef } from './control-database.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
-import { SeedBootstrapService, type SeedEventCallbacks } from './seed-bootstrap.js';
+import { SeedBootstrapService, type SeedEventCallbacks, type SeedBootstrapConfig } from './seed-bootstrap.js';
 import type { SeedTrustPolicy } from './seed-trust-policy.js';
 import {
   StrandSolicitationService,
   type StrandSolicitationServiceOptions
 } from './strand-solicitation.js';
-import { MAX_STRAND_ADDRS } from './strand-formation-protocol.js';
 import {
   createMembershipConnectionGater,
   DEFAULT_ENROLLMENT_WINDOW_MS,
@@ -111,16 +121,17 @@ import {
   type InboundConnectionVerdict
 } from './membership-connection-gater.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
-import { StrandAddrService, collectStrandAddrs, type StrandAddrPeer } from './strand-addr-protocol.js';
+import { StrandAddrService, collectStrandAddrs, type StrandAddrPeer, type StrandAddrOutcome, type StrandAddrCollection } from './strand-addr-protocol.js';
 import {
   DelegateAdmissionStore,
   extractCircuitRelayTargets,
   dueRelayAnnounces,
-  pruneStoppedStrandAnnounces,
+  prunePeerStrandKeys,
   peerStrandKey,
   type CircuitRelayTarget
 } from './delegate-admission.js';
 import { relayCircuitAddrs, resolveListenAddrs, resolveTransportOptions, RelayReservationFailedError } from './relay-addrs.js';
+import { resolveRelayServer, type ResolvedRelayServer } from './relay-server.js';
 import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import {
   superviseRelayReservation,
@@ -151,10 +162,10 @@ const timing = debug('sereus:cadre:timing');
 const TURN_CONSUME_WINDOW_MS = 1000;
 
 /**
- * How often a running strand re-resolves its siblings' strand-network addresses
- * and re-merges them into its own libp2p address book
- * ({@link CadreNode.refreshStrandPeerAddrs}). Overridable per node via
- * `network.controlCohort.strandAddrRefreshMs`.
+ * How often a running strand re-asks each connected sibling that last ANSWERED
+ * (even with nothing) for its strand-network addresses, and re-merges them into
+ * its own libp2p address book ({@link CadreNode.refreshStrandPeerAddrs}).
+ * Overridable per node via `network.controlCohort.strandAddrRefreshMs`.
  *
  * Ten minutes sits comfortably inside the peerStore's one-hour address expiry
  * (`MAX_ADDRESS_AGE`, see `peer-addr-book.ts`) with headroom for several missed
@@ -163,6 +174,17 @@ const TURN_CONSUME_WINDOW_MS = 1000;
  */
 export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
 
+/**
+ * How soon {@link CadreNode.refreshStrandPeerAddrs} re-asks a sibling that did NOT
+ * answer — unreachable, `unavailable`, or `refused`. A refusal matters most: a
+ * phone asking before its `CadrePeer` row has replicated to the sibling is refused
+ * and its delegate grant goes unrecorded, and waiting the full
+ * {@link STRAND_PEER_ADDR_REFRESH_MS} for the next try is the delay this bounds.
+ * Four reconcile ticks, so a sibling that keeps failing costs one timed-out RPC a
+ * minute rather than one a tick.
+ */
+export const STRAND_PEER_ADDR_RETRY_MS = 60 * 1000;
+
 type EventHandler<T> = (data: T) => void;
 
 /**
@@ -173,12 +195,21 @@ function relayStrandAddrPeer(relay: CircuitRelayTarget): StrandAddrPeer {
   return { peerId: relay.relayPeerId, addrs: [multiaddr(relay.relayAddr)] };
 }
 
+/**
+ * Whether a sibling actually answered a strand-addr RPC — with addresses or
+ * without — as opposed to being unreachable, unavailable, or refusing us. Decides
+ * which of the refresh and retry intervals it waits before the next ask.
+ */
+function siblingAnswered(outcome: StrandAddrOutcome): boolean {
+  return outcome === 'answered' || outcome === 'empty';
+}
+
 /**
  * `primary` followed by the entries of `extra` it does not already contain, de-duplicated
  * and order-preserving.
  *
  * Used wherever a strand's discovery seed unions two sources of address strings — the
- * freshly-RPC'd sibling answers and the cross-party addresses learned at formation. The
+ * freshly-RPC'd sibling answers and the strand peer book's last-known addresses. The
  * caller passes the FRESHER source as `primary`, so a stale entry can only ever be
  * appended, never promoted ahead of a current one, and each source keeps whatever
  * signaling-first ordering it arrived with.
@@ -274,6 +305,34 @@ function requireMatchingStrandRow(live: StrandRow, desired: StrandRow, situation
   return live;
 }
 
+/**
+ * Await `work` unless `signal` aborts first: `true` once `work` resolves, `false` when the
+ * signal aborted before it did (already at the call, or during the wait). A rejection of
+ * `work` that lands before the abort propagates. `work` is NOT cancelled — a caller that
+ * gets `false` owns its late settlement. The abort listener is detached on both endings, so
+ * a long-lived signal does not collect listeners.
+ */
+async function resolvesBeforeAbort(work: Promise<unknown>, signal: AbortSignal | undefined): Promise<boolean> {
+  if (!signal) {
+    await work;
+    return true;
+  }
+  if (signal.aborted) {
+    return false;
+  }
+  let detach = (): void => { /* replaced once the listener is attached */ };
+  const abortedFirst = new Promise<false>((resolve) => {
+    const onAbort = (): void => resolve(false);
+    signal.addEventListener('abort', onAbort, { once: true });
+    detach = () => signal.removeEventListener('abort', onAbort);
+  });
+  try {
+    return await Promise.race([work.then(() => true), abortedFirst]);
+  } finally {
+    detach();
+  }
+}
+
 /**
  * CadreNode is the main entry point for a cadre member.
  * It manages:
@@ -411,6 +470,30 @@ export class CadreNode implements SAppIdLookup {
    */
   private discoveredStrands: Map<string, StrandRow> = new Map();
 
+  /**
+   * Whether an unclaimed strand the filter admits is launched as a storage replica
+   * ({@link CadreNodeConfig.hostUnclaimedStrands}), resolved once from the config.
+   *
+   * NOTE: a replica host stores every admitted strand of its party with no quota (Arachnode
+   * quotas are unimplemented). Fine at a party's handful of strands; if always-on nodes come
+   * to host strands by the hundred, per-strand quotas or a narrower default filter is the lever.
+   */
+  private readonly hostUnclaimedStrands: boolean;
+
+  /**
+   * The sApp id each storage replica read from its own `Strand.Header` — {@link getSAppId}'s
+   * answer for a strand no local config claims, so an `sAppId` strand filter can reject a
+   * replica of some other app instead of admitting it provisionally forever.
+   *
+   * Cleared by {@link cleanup} only, deliberately NOT by {@link detachStrand}: the watcher's
+   * filter rejection stops a replica through that very method, and forgetting the id there
+   * would have the next poll find it unknown again, re-admit the strand provisionally and
+   * relaunch the replica — once every other poll, forever. A strand id's sApp never changes,
+   * and the map is bounded by the strands this party has published, like
+   * {@link discoveredStrands}.
+   */
+  private replicaSAppIds: Map<string, string> = new Map();
+
   /**
    * Most-recently pushed invite addresses (see {@link setInviteAddresses}).
    * When non-null these take priority over `libp2pNode.getMultiaddrs()` when
@@ -491,10 +574,22 @@ export class CadreNode implements SAppIdLookup {
    * `denyInboundRelayReservation` policy); authorized members and announced
    * delegates are admitted before it and never counted. Cap from
    * `network.unauthorizedRelayReservationCap` (default
-   * `MAX_UNAUTHORIZED_RELAY_RESERVATIONS`).
+   * `MAX_UNAUTHORIZED_RELAY_RESERVATIONS`); entries expire on the relay
+   * server's own resolved `reservationTtl` ({@link relayServer}).
    */
   private readonly unauthorizedRelayReservations: UnauthorizedReservationBudget;
 
+  /**
+   * Does this node's CONTROL libp2p run the circuit-relay server, and with which
+   * init? Resolved once from `network` and `profile` by the same function every
+   * strand node's build uses (`relay-server.ts`). Read by
+   * {@link buildControlNodeOptions} (which configures the server from it),
+   * {@link admitInboundControlConnection} (whose deny/admit-for-relay branch must
+   * agree with whether a reservation is even servable here), and the
+   * unauthorized budget above (whose TTL is the server's).
+   */
+  private readonly relayServer: ResolvedRelayServer;
+
   /**
    * When this node last ANNOUNCED a delegate, keyed `<targetPeerId>\n<strandId>`
    * (the peer announced TO, not the delegate). Throttles
@@ -506,48 +601,50 @@ export class CadreNode implements SAppIdLookup {
   private readonly delegateAnnounceAt = new Map<string, number>();
 
   /**
-   * When each running strand last had its siblings' strand addresses re-resolved
-   * into its own address book, keyed by strandId. Throttles
-   * {@link refreshStrandPeerAddrs} to once per {@link STRAND_PEER_ADDR_REFRESH_MS}
-   * per strand so the 15 s reconcile tick never becomes per-tick RPC chatter.
-   * Entries for strands that are no longer running are pruned on each pass, so a
-   * hibernated-then-resumed strand refreshes immediately rather than inheriting a
-   * stale stamp.
-   */
-  private readonly strandPeerAddrRefreshAt = new Map<string, number>();
-
-  /**
-   * CROSS-PARTY strand-network addresses learned at formation, keyed by strandId — the
-   * responder's live strand addrs, carried back on the formation result
-   * (`FormationResultMessage.strandAddrs`) and recorded by {@link formStrand}.
+   * When each connected sibling is next due a strand-addr RPC for each running
+   * strand, keyed `peerStrandKey(siblingControlPeerId, strandId)` → epoch ms; a
+   * missing key is due. Bounds {@link refreshStrandPeerAddrs}'s fan-out per
+   * (sibling, strand) rather than per strand, so a sibling that connects after a
+   * pass is asked on the next 15 s tick instead of waiting out a stamp another
+   * sibling's answer set. An answer (even an empty one) makes the sibling due again
+   * in {@link STRAND_PEER_ADDR_REFRESH_MS}; no answer, in
+   * {@link STRAND_PEER_ADDR_RETRY_MS}. Keys whose strand stopped running or whose
+   * sibling is no longer connected are pruned every pass, so a resumed strand and a
+   * reconnected sibling are both asked at once.
+   */
+  private readonly strandAddrAskDueAt = new Map<string, number>();
+
+  /**
+   * Node-local strand peer book (see `strand-peer-book.ts`): per strand, the strand
+   * peers this node has met and their last-known strand-network addresses. Three
+   * writers: {@link recordFormationStrandPeers} files the responder's live strand
+   * addrs a formation result carried back (`FormationResultMessage.strandAddrs`),
+   * {@link observeStrandPeer} files every strand peer a running strand node
+   * identifies, and the per-strand book swap (`strand-peer-book-swap.ts`, handed the
+   * store as `StartStrandConfig.strandPeerBook`) files the node's own signed entry
+   * plus every signed entry a strand peer sends it — the only writer whose entries
+   * carry a signature, and the only one that can refresh a peer's addresses without
+   * meeting that peer. Read by {@link resolveCohortSeed} (launch + hibernation resume) and
+   * re-merged by every {@link refreshStrandPeerAddrs} pass, which is what keeps the
+   * entries alive past the peerStore's one-hour address expiry.
    *
    * This is the ONLY cross-party discovery input there is. The strand-addr RPC that
    * resolves a strand's addresses is membership-gated and answers own-party siblings
-   * only, so without this map a joiner's cohort seed for a two-party strand is empty and
-   * the mesh never forms.
-   *
-   * Read by {@link resolveCohortSeed} (launch + hibernation resume) and re-merged by
-   * every {@link refreshStrandPeerAddrs} pass — the re-merge is what keeps the entries
-   * alive past the peerStore's one-hour address expiry, since nothing can re-resolve
-   * them.
-   *
-   * IN-MEMORY and ONE-SHOT, deliberately (see `docs/strands.md`): the addresses die with
-   * the process, and a restarted initiator with no sibling running the strand is back to
-   * an empty seed until the durability work lands
-   * (`backlog/feat-cross-party-strand-addr-durability`). They are also never refreshed,
-   * so a responder whose relay reservation rotates before the initiator dials leaves a
-   * dead entry behind; recovery today is a fresh invitation.
+   * only, so without the book a joiner's cohort seed for a two-party strand is empty
+   * and the mesh never forms — and, with an in-memory book, never RE-forms after a
+   * restart (gotchoices/sereus#18). A STORE rather than a map so an embedder can make
+   * it outlive the process; constructed (or adopted from `config.strandPeers.store`)
+   * by {@link initializeStrandPeerBookStore} during {@link start}, deliberately NOT
+   * cleared by {@link cleanup}, so it survives a stop()→start() cycle of the same node
+   * instance — same lifecycle as {@link bootstrapPeerStore}.
    *
-   * NOTE: entries are kept for the node's lifetime, including across a
-   * {@link stopStrand} — a stopped strand may be claimed again with {@link addStrand}
-   * (the watcher itself will not re-offer it: the stop suppresses the id for the rest of
-   * the session) and must still get its seed. Each strand's list is capped at
-   * `MAX_STRAND_ADDRS`, but the
-   * number of KEYS is bounded only by the strands this node has ever formed as an
-   * initiator (not by time); if a node ever forms strands at scale, evict on
-   * `unpublishStrand` or cap the map.
+   * Entries survive a {@link stopStrand} (a stopped strand may be claimed again with
+   * {@link addStrand}, and is rediscovered on restart) and are forgotten by
+   * {@link unpublishStrand}, {@link forgetJoinedStrand} and self-revocation; the store
+   * ages the rest out after 14 days and caps each strand at 16 peers, so the book is
+   * bounded by time and by the strands this node runs rather than by its history.
    */
-  private readonly crossPartyStrandAddrs = new Map<string, string[]>();
+  private strandPeerBookStore: StrandPeerBookStore | null = null;
 
   /**
    * PENDING strand membership invitations learned at formation, keyed by strandId — the
@@ -556,10 +653,9 @@ export class CadreNode implements SAppIdLookup {
    * to redeem (`consumeInvite` seats the `Strand.Member` row under this party's own key
    * — the `strand-node-binds-member-peer` half of the party-identity chain).
    *
-   * IN-MEMORY, deliberately, like {@link crossPartyStrandAddrs}: a restarted joiner
-   * re-forms from scratch anyway (durability is
-   * `backlog/feat-cross-party-strand-addr-durability`'s problem), and re-forming issues
-   * a fresh invitation. A re-formation against the same strand REPLACES the entry — the
+   * IN-MEMORY, deliberately: an invitation is single-use and short-lived, a restarted
+   * joiner that never redeemed it re-forms from scratch, and re-forming issues a fresh
+   * one. A re-formation against the same strand REPLACES the entry — the
    * fresh invitation supersedes one that may have expired. The party key the invitation
    * admits, by contrast, IS persisted (`StrandPartyKey`, seated by
    * {@link adoptFormationMembershipInvite} before the entry lands here), so a lost
@@ -575,8 +671,9 @@ export class CadreNode implements SAppIdLookup {
    * just waits; once launched, staging notifies the manager, which re-arms a finished loop.
    *
    * NOTE: entries live for the node's lifetime (one small pair per formed closed
-   * strand), the same unbounded-keys tripwire {@link crossPartyStrandAddrs} documents —
-   * if a node ever forms strands at scale, evict alongside that map.
+   * strand); the number of keys is bounded only by the strands this node has ever
+   * formed, not by time — if a node ever forms strands at scale, evict on
+   * `unpublishStrand` / `forgetJoinedStrand` as the strand peer book does.
    */
   private readonly pendingMembershipInvites = new Map<string, StrandMembershipInvite>();
 
@@ -651,6 +748,25 @@ export class CadreNode implements SAppIdLookup {
    */
   private enrolledMachineStore: EnrolledMachineStore | null = null;
 
+  /**
+   * Node-local record of the strands this node joined from ANOTHER party and has not yet
+   * published party-wide (see `joined-strand-store.ts`). Written by {@link formStrand}
+   * and by an {@link addStrand} of a foreign row; drained once the party-wide
+   * `JoinedStrand` row is visible. Adopted from `config.joinedStrands.store`, else built over
+   * `config.keyStore`, else in-memory, by {@link initializeJoinedStrandStore}. Like
+   * {@link bootstrapPeerStore} it is deliberately NOT cleared by {@link cleanup}.
+   */
+  private joinedStrandStore: JoinedStrandStore | null = null;
+
+  /**
+   * This session's joined strands: {@link joinedStrandStore} and the party-wide
+   * `JoinedStrand` table, unioned with the control rows each watcher poll, published and
+   * removed by the reconcile pass. Per SESSION, unlike the store — rebuilt at every
+   * {@link start}, which is what ends a revoked join's "keep offering until this session
+   * ends" (see `JoinedStrandSession.forgetAfterThisSession`).
+   */
+  private joinedStrands: JoinedStrandSession | null = null;
+
   /**
    * The enrolled-machine count this node's CONTROL libp2p node was (or will be)
    * built with — read out of {@link enrolledMachineStore} during {@link start},
@@ -798,10 +914,13 @@ export class CadreNode implements SAppIdLookup {
 
   constructor(config: CadreNodeConfig) {
     this.config = config;
+    this.hostUnclaimedStrands = config.hostUnclaimedStrands ?? config.profile === 'storage';
     this.strandManager = new StrandInstanceManager();
     this.enrollmentService = new EnrollmentService();
+    this.relayServer = resolveRelayServer(config.network, config.profile);
     this.unauthorizedRelayReservations = new UnauthorizedReservationBudget(
-      config.network?.unauthorizedRelayReservationCap
+      config.network?.unauthorizedRelayReservationCap,
+      this.relayServer.init.reservations.reservationTtl
     );
 
     // Create hibernation manager with callbacks
@@ -809,7 +928,8 @@ export class CadreNode implements SAppIdLookup {
       onIdle: async (strandId) => this.handleStrandIdle(strandId),
       onHibernate: async (strandId) => this.handleStrandHibernate(strandId),
       onWake: async (strandId) => this.handleStrandWake(strandId),
-      onCheckIn: async (strandId) => this.handleStrandCheckIn(strandId)
+      onCheckIn: async (strandId) => this.handleStrandCheckIn(strandId),
+      isQuiescing: (strandId) => this.strandManager.isQuiescing(strandId)
     };
     this.hibernationManager = new HibernationManager(
       config.hibernation ?? { enabled: false },
@@ -820,10 +940,11 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * SAppIdLookup implementation - get sAppId for a strand
+   * SAppIdLookup implementation - get sAppId for a strand: the claiming config's, else
+   * the one a storage replica read from the strand's own `Strand.Header`.
    */
   getSAppId(strandId: string): string | undefined {
-    return this.sAppConfigs.get(strandId)?.id;
+    return this.sAppConfigs.get(strandId)?.id ?? this.replicaSAppIds.get(strandId);
   }
 
   /**
@@ -951,6 +1072,7 @@ export class CadreNode implements SAppIdLookup {
     }
 
     log('Starting CadreNode for party: %s', this.config.controlNetwork.partyId);
+    this.logRelayServerSettings();
 
     try {
       const tTotal = performance.now();
@@ -987,6 +1109,14 @@ export class CadreNode implements SAppIdLookup {
       // loaded before the first reconcile pass could consult them.
       this.initializeBootstrapPeerStore();
 
+      // The remembered cross-party joins, which the strand watcher built below polls
+      // beside the control rows. Before network bring-up, so a mis-scoped injected store
+      // fails closed like the two above.
+      this.initializeJoinedStrandStore();
+
+      // The strand peer book those joins are dialed from. Same placement, same reason.
+      this.initializeStrandPeerBookStore();
+
       // Read the party's enrolled-machine count out of its node-local record and
       // capture it for buildControlNodeOptions below. This MUST precede
       // createControlNode: Optimystic freezes the cluster policy when the node is
@@ -1098,7 +1228,7 @@ export class CadreNode implements SAppIdLookup {
         getStrand: (strandId) => this.strandManager.getInstance(strandId),
         wake: (strandId) => this.wakeStrand(strandId),
       });
-      this.strandWakeService.initialize(this.controlNode);
+      await this.strandWakeService.initialize(this.controlNode);
 
       // Register the control-network strand-address responder: a same-cadre peer
       // resolving a strand's bootstrap seed asks us for our live strand-network
@@ -1114,7 +1244,7 @@ export class CadreNode implements SAppIdLookup {
         onDelegateAnnounce: (announcer, strandId, delegate) =>
           this.grantDelegateAdmission(announcer, strandId, delegate),
       });
-      this.strandAddrService.initialize(this.controlNode);
+      await this.strandAddrService.initialize(this.controlNode);
 
       // Server-side push-wake fan-out: only when push is configured.
       if (this.config.push) {
@@ -1387,6 +1517,54 @@ export class CadreNode implements SAppIdLookup {
     log('control repair yardstick will be declared from %o enrolled machine(s)', this.declaredEnrolledMachines);
   }
 
+  /**
+   * Construct (or adopt) the node-local joined-strand store (see
+   * {@link joinedStrandStore}) and this session's {@link joinedStrands} over it.
+   *
+   * The store instance is kept across stop()→start(); the view is rebuilt. A store
+   * scoped to a different party is a configuration error, fail closed: its joins
+   * would be offered to this party's app as if this party had made them.
+   */
+  private initializeJoinedStrandStore(): void {
+    const partyId = this.config.controlNetwork.partyId;
+    const { keyStore } = this.config;
+    const store = this.joinedStrandStore
+      ?? this.config.joinedStrands?.store
+      ?? (keyStore ? new KeyStoreJoinedStrandStore(keyStore, partyId) : new MemoryJoinedStrandStore(partyId));
+    if (store.partyId !== partyId) {
+      throw new Error(
+        `CadreNodeConfig: joinedStrands.store is scoped to party ${store.partyId}, ` +
+        `but this node serves party ${partyId} — refusing to offer another party's joined strands`
+      );
+    }
+    this.joinedStrandStore = store;
+    this.joinedStrands = new JoinedStrandSession(store, this.createPartyJoinedStrandLedger());
+  }
+
+  /**
+   * Construct (or adopt) the node-local strand peer book (see
+   * {@link strandPeerBookStore}). Synchronous for the reason
+   * {@link initializeBootstrapPeerStore} is: an injected store has already loaded its
+   * persisted entries by the time it is handed in, and the in-memory fallback has
+   * nothing to load. The instance is kept across stop()→start(). A store scoped to a
+   * different party is a configuration error, fail closed: another party's strand
+   * peers must never enter this node's dial loop.
+   */
+  private initializeStrandPeerBookStore(): void {
+    const partyId = this.config.controlNetwork.partyId;
+    if (this.strandPeerBookStore) {
+      return;
+    }
+    const store = this.config.strandPeers?.store ?? new MemoryStrandPeerBookStore(partyId);
+    if (store.partyId !== partyId) {
+      throw new Error(
+        `CadreNodeConfig: strandPeers.store is scoped to party ${store.partyId}, ` +
+        `but this node serves party ${partyId} — refusing to mix strand peer books`
+      );
+    }
+    this.strandPeerBookStore = store;
+  }
+
   /**
    * The node-local enrolled-machine store (null before {@link start}) — what this
    * node last knew about its party's size. Exposed for diagnostics and for a host
@@ -1406,6 +1584,16 @@ export class CadreNode implements SAppIdLookup {
     return this.bootstrapPeerStore;
   }
 
+  /**
+   * The node-local strand peer book (null before {@link start}) — per strand, the
+   * strand peers this node dials first on launch, resume and refresh. Exposed for
+   * diagnostics and for a host that wants to show "whom would this strand re-find
+   * after a restart?".
+   */
+  getStrandPeerBookStore(): StrandPeerBookStore | null {
+    return this.strandPeerBookStore;
+  }
+
   /**
    * The node-local trusted-owner anchor (null before {@link start}). This is
    * the set the authorized-membership predicate and seed-trust anchor consult —
@@ -1483,10 +1671,10 @@ export class CadreNode implements SAppIdLookup {
    * needs no work of its own: `createLibp2pNode` registers the block-transfer
    * handler on every node it builds, control node included, and this node's
    * per-stream gate (`authorizeInboundControlStream`) covers the inbound
-   * direction. A denied peer is retried on its next `connection:open`, and —
-   * because the production join order is connect-then-authorize — on every
-   * committed membership change via {@link refreshAuthorizedControlPeers}'s
-   * `scheduleConnectedPeers()` call.
+   * direction. A denied peer is retried on its next `peer:identify` (a
+   * reconnect re-runs identify), and — because the production join order is
+   * connect-then-authorize — on every committed membership change via
+   * {@link refreshAuthorizedControlPeers}'s `scheduleConnectedPeers()` call.
    *
    * No-ops (logged) when the embedder configured no control storage or the
    * node exposes no key network — the backfill would have nothing to read or
@@ -1576,7 +1764,7 @@ export class CadreNode implements SAppIdLookup {
     const scope = controlStorageScope(this.config.controlNetwork.partyId);
     // The second seam that hands a scope key to an embedder's provider; the first
     // (`StrandInstanceManager.startStrand`) asserts the stricter strand rule. Holds by
-    // construction today — base64url is inside the charset — so this guards a future
+    // construction today — lowercase hex is inside the charset — so this guards a future
     // edit to `controlStorageScope`, not a reachable input.
     assertScopeKeyCharset(scope);
     const resolved = typeof provider === 'function' ? provider(scope) : provider;
@@ -1648,8 +1836,6 @@ export class CadreNode implements SAppIdLookup {
     // being silently dropped at bring-up. See `relay-addrs.ts`.
     const transportOptions = resolveTransportOptions(network, listenAddrs);
 
-    const enableRelay = this.relayServerEnabled();
-
     // The control node's own storage, resolved once per runtime (see
     // {@link resolveControlStorage}) rather than per call.
     const controlStorageProvider = this.resolveControlStorage();
@@ -1660,7 +1846,10 @@ export class CadreNode implements SAppIdLookup {
       networkName: this.controlNetworkName(),
       storage: controlStorageProvider,
       fretProfile: profile === 'storage' ? 'core' : 'edge',
-      relay: enableRelay,
+      relay: this.relayServer.enabled,
+      // Merged party-run defaults: no per-connection data/duration cap, a store sized for
+      // one party's NAT'd machines. Strand nodes get the same init (`relay-server.ts`).
+      ...(this.relayServer.enabled && { relayServerInit: this.relayServer.init }),
       // Fixed, and deliberately above any party's node count: every member reads the
       // whole control database, so a cohort that excludes a member leaves it dependent
       // on read repair — which cannot converge at a two-member cohort. Not a knob;
@@ -1676,12 +1865,14 @@ export class CadreNode implements SAppIdLookup {
       // itself, so the unknown case is provably byte-for-byte the old behaviour.
       // The yardstick moves ALONE: `assumedClusterSize` stays pinned at 2, because a
       // party of phones cannot promise three quarters of its machines are awake.
-      // With neither declared this is still the frozen constant by identity, which is the
-      // production path. A degenerate deadline is Optimystic's to refuse, in
-      // createControlNode below.
+      // The read deadline is the host's own, else two link round trips at the declared
+      // `linkRoundTripMs`, else nothing — the frozen constant already carries the same
+      // derivation at the default declaration (`link-budget.ts`). With neither declared this
+      // is still the frozen constant by identity, which is the production path. A degenerate
+      // deadline is Optimystic's to refuse, in createControlNode below.
       clusterPolicy: controlClusterPolicy({
         enrolledMachines: this.declaredEnrolledMachines,
-        cohortQueryTimeoutMs: network?.cohortQueryTimeoutMs
+        cohortQueryTimeoutMs: declaredCohortReadDeadlineMs(network)
       }),
       arachnode: { enableRingZulu: profile === 'storage' },
       ...(identityKey && { privateKey: identityKey }),
@@ -1692,10 +1883,12 @@ export class CadreNode implements SAppIdLookup {
       // whose event loop is saturated by pure-JS Noise crypto. A configured value
       // replaces the default whole (see DEFAULT_CONNECTION_MONITOR).
       connectionMonitor: network?.connectionMonitor ?? DEFAULT_CONNECTION_MONITOR,
-      // libp2p's own dial and inbound-upgrade limits, from the same declared link as every
-      // cadre dial budget. Left to db-p2p, both stay at 10 s, which cannot open a relayed
-      // connection above a 2.5 s round trip — and the listener's side of that fails silently.
-      connectionManager: connectionManagerTimeouts(network?.linkRoundTripMs),
+      // The declared link every cadre budget is derived from, stated to Optimystic too so it
+      // derives its own deadlines from the same number: its request dials and responses, its
+      // block pushes, and libp2p's `dialTimeout` and `inboundUpgradeTimeout`. Always stated,
+      // default included: undeclared, Optimystic keeps LAN deadlines that cannot open a
+      // relayed connection at the link sereus supports (`link-budget.ts`).
+      linkRoundTripMs: resolveLinkRoundTripMs(network?.linkRoundTripMs),
       // `{ wsPort }` when a listen entry names WebSocket, otherwise `{}` — and always
       // `{}` when `network.transports` is set, since the embedder owns transport policy
       // then. Spread NEXT to `transports` because the two answer the same question.
@@ -1720,7 +1913,9 @@ export class CadreNode implements SAppIdLookup {
           admitRelayReservation: (remotePeerId) => this.admitControlRelayReservation(remotePeerId),
           bringUpInFlight: () => this.controlBringUpInFlight
         },
-        network?.connectionGater
+        network?.connectionGater,
+        ADMISSION_DECISION_TIMEOUT_MS,
+        relayAdmissionReserveDeadlineMs(network?.linkRoundTripMs)
       ),
       // Fail-closed per-stream authorization for the four Optimystic control-DB
       // protocols — the members-only layer the connection gater's stranger
@@ -1734,15 +1929,18 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Does this node's CONTROL libp2p run the circuit-relay server? An explicit
-   * `network.enableRelay` wins; otherwise storage-profile nodes default to on
-   * (better connectivity/uptime). Shared by {@link buildControlNodeOptions}
-   * (which configures the server from it) and
-   * {@link admitInboundControlConnection} (whose deny/admit-for-relay branch
-   * must agree with whether a reservation is even servable here).
+   * One debug line naming what this machine's relay server forwards and holds —
+   * the same fields the dedicated relay container prints at boot
+   * (`ops/docker/libp2p-infra/src/main.ts`). Once per start, not per strand:
+   * strand nodes resolve the same settings from the same config.
    */
-  private relayServerEnabled(): boolean {
-    return this.config.network?.enableRelay ?? (this.config.profile === 'storage');
+  private logRelayServerSettings(): void {
+    if (!this.relayServer.enabled) {
+      return;
+    }
+    const { applyDefaultLimit, maxReservations, reservationTtl } = this.relayServer.init.reservations;
+    log('Relay server on: applyDefaultLimit=%s maxReservations=%d reservationTtl=%dms unauthorizedCap=%d',
+      applyDefaultLimit, maxReservations, reservationTtl, this.unauthorizedRelayReservations.cap);
   }
 
   /**
@@ -1792,7 +1990,7 @@ export class CadreNode implements SAppIdLookup {
    *    accepted it, exactly like the unreplicated-membership-row case below.
    *
    * When every check falls through, the verdict depends on whether this node
-   * runs the circuit-relay server ({@link relayServerEnabled}): without one,
+   * runs the circuit-relay server ({@link relayServer}): without one,
    * `'deny'`; with one, `'admit-for-relay'` — a circuit-relay reservation is
    * established by the reserving peer DIALING the relay, so a connection deny
    * here kills the reservation, and that deny is NOT self-healing: an outbound
@@ -1841,7 +2039,7 @@ export class CadreNode implements SAppIdLookup {
       log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
       return 'admit';
     }
-    if (this.relayServerEnabled()) {
+    if (this.relayServer.enabled) {
       log('admitInboundControlConnection: admitting %s FOR RELAY ONLY — not an authorized member and no enrollment path open; the gater drops the connection unless a reservation is admitted', remotePeerId);
       return 'admit-for-relay';
     }
@@ -2055,7 +2253,9 @@ export class CadreNode implements SAppIdLookup {
       // the count of machines serving the network — the quantity
       // `resolveRepairYardstick` asks for. It is NOT that quantity for a strand, which
       // launches only on machines whose embedder registered its sApp config (see
-      // {@link addStrand}), so this number must never be routed to a strand node:
+      // {@link addStrand}) plus storage-profile machines hosting it as a storage replica
+      // ({@link CadreNodeConfig.hostUnclaimedStrands}) whose filter admits it — phones
+      // serve only what their app claims — so this number must never be routed to a strand node:
       // over-declaring pins Optimystic's repair corroboration floor at two peers and a
       // strand that can field only one can then never repair. `launchStrand` therefore
       // declares nothing; see the NOTE there.
@@ -2106,7 +2306,7 @@ export class CadreNode implements SAppIdLookup {
       // ever holds many such connections, or refreshes get frequent, skip
       // re-arming peers whose last pass was denied under the SAME membership
       // snapshot instead of re-arming unconditionally.
-      this.controlBackfill?.scheduleConnectedPeers();
+      void this.controlBackfill?.scheduleConnectedPeers();
     } catch (error) {
       log('refreshAuthorizedControlPeers(%s) failed — keeping previous snapshot: %o', reason, error);
     }
@@ -2142,6 +2342,11 @@ export class CadreNode implements SAppIdLookup {
     return this.bootstrapPeerIds;
   }
 
+  /**
+   * What the strand watcher polls: this party's control rows plus a row per cross-party
+   * join (see {@link joinedStrands}), so a joined strand is offered and relaunched on
+   * the same path as the party's own.
+   */
   private createStrandQueryable(): StrandQueryable {
     return {
       queryStrands: async (): Promise<StrandRow[]> => {
@@ -2150,11 +2355,78 @@ export class CadreNode implements SAppIdLookup {
           return [];
         }
         log('Querying strands from control database');
-        return await this.controlDatabase.queryStrands();
+        const control = await this.controlDatabase.queryStrands();
+        return this.joinedStrands ? await this.joinedStrands.withControlRows(control) : control;
       }
     };
   }
 
+  /**
+   * The party-wide `JoinedStrand` table as {@link joinedStrands} reads and writes it.
+   * Reads {@link controlDatabase} at call time, so start-up order does not matter.
+   */
+  private createPartyJoinedStrandLedger(): PartyJoinedStrandLedger {
+    const database = (): ControlDatabase => {
+      if (!this.controlDatabase) {
+        throw new Error('CadreNode must be started before using the party-wide joined-strand table');
+      }
+      return this.controlDatabase;
+    };
+    return {
+      // NOTE: one more control read per watcher poll (5 s), and for a party that never
+      // joined anything it reads a never-written block, which consults the cohort. If poll
+      // cost shows up in a device profile, cache the list and re-read it on the reconcile
+      // cadence.
+      list: () => database().queryJoinedStrands(),
+      names: async (strandId) => (await database().queryStrand(strandId)) !== null
+        || (await database().queryJoinedStrand(strandId)) !== null,
+      canSign: async () => (await this.enrolledOwnerSigningKey()) !== null,
+      publish: async (record) => {
+        const signingKey = await this.enrolledOwnerSigningKey();
+        if (!signingKey) {
+          throw new Error(`Cannot publish joined strand ${record.Id}: this machine is not an enrolled owner`);
+        }
+        try {
+          await database().insertJoinedStrand(record, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+        } catch (error) {
+          // Another machine of the party published this join first; its row wins.
+          if (!isStrandIdConflict(error, 'JoinedStrand')) {
+            throw error;
+          }
+        }
+      },
+      remove: async (strandId) => {
+        const signingKey = await this.enrolledOwnerSigningKey();
+        if (signingKey) {
+          return database().deleteJoinedStrand(strandId, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+        }
+        if (await database().queryJoinedStrand(strandId)) {
+          throw new Error(
+            `Cannot leave strand ${strandId} for the whole party: the join is recorded party-wide, and ` +
+            `removing it takes an owner machine, which this one is not. stopStrand('${strandId}') stops ` +
+            'it on this machine only.'
+          );
+        }
+        return false;
+      }
+    };
+  }
+
+  /**
+   * This machine's owner signing key when it can make owner-gated control writes: its seed
+   * bootstrap holds an owner key (`SeedBootstrapService.canAuthorize`) and the party's
+   * `OwnerKey` table enrolls it. A phone that ran self-genesis after another machine
+   * founded the party passes the first test and not the second (`runOwnerGenesis` in the
+   * reference apps), and a write it signed would only be refused.
+   */
+  private async enrolledOwnerSigningKey(): Promise<{ privateKeyB64: string; publicKeyB64: string } | null> {
+    const signingKey = this.seedBootstrapService?.canAuthorize() ? this.getSelfSigningKey() : null;
+    if (!signingKey || !this.controlDatabase) {
+      return null;
+    }
+    return (await this.controlDatabase.getOwnerKeys()).has(signingKey.publicKeyB64) ? signingKey : null;
+  }
+
   /**
    * Schedule the node's initial self-record publish + ongoing refresh shortly
    * after start (non-blocking). {@link registerSelf} is idempotent and safely
@@ -2818,14 +3090,18 @@ export class CadreNode implements SAppIdLookup {
     // Ride this pass's cadence to refresh the per-stream gate's materialized
     // authorized set — membership changes that ARRIVED BY REPLICATION (rather
     // than a local write) are picked up here, bounding the snapshot's staleness
-    // to the reconcile interval.
+    // to the time between pass starts: the reconcile interval, or the previous
+    // pass's length when that is longer (passes are single-flight, and one
+    // unreachable sibling's dial alone can take `controlDialBudget().totalMs`).
     // NOTE: this refresh and the sibling enumeration below each run their own
     // CadrePeer query (two reads per pass), plus a third from
-    // `refreshStrandPeerAddrs` on the passes where a strand is due AND this node
-    // holds a control connection (one read for the whole pass, not one per
-    // strand). Each also reads Revocation first. Before the Revocation ledger
-    // marker exists (filed below, once connected) that block is missing, so every
-    // one of those reads consults the cohort about it; once the marker exists every
+    // `refreshStrandPeerAddrs` on every pass where a strand is running AND this
+    // node holds a control connection (one read for the whole pass, not one per
+    // strand; it runs even when no sibling is due, because pruning departed
+    // siblings needs the current target set). Each also reads Revocation first.
+    // Before the Revocation ledger marker exists (filed below, once connected)
+    // that block is missing, so every one of those reads consults the cohort
+    // about it; once the marker exists every
     // block they touch is held and none of them does (both states pinned in
     // control-founding-consult-budget.spec.ts). If those reads ever get costly,
     // share one row-set across all three.
@@ -2841,8 +3117,8 @@ export class CadreNode implements SAppIdLookup {
     if (!this._running || !this.controlNode || !this.controlDatabase) {
       return { dialed: [] };
     }
-    // Then re-warm each running strand's own address book from its siblings, on
-    // its own (much longer) throttle. Same reasoning as warmSiblingAddrBook
+    // Then re-warm each running strand's own address book from its peer book and
+    // from whichever siblings are due an ask. Same reasoning as warmSiblingAddrBook
     // below, one layer down: replication runs on the STRAND network, and every
     // layer under cadre-core dials strand peers by bare peer id.
     await this.refreshStrandPeerAddrs();
@@ -2912,6 +3188,19 @@ export class CadreNode implements SAppIdLookup {
       if (!this._running || !this.controlNode || !this.controlDatabase) {
         return { dialed: [] };
       }
+
+      // Publish this machine's unpublished cross-party joins party-wide and remove the rows a
+      // self-revocation queued (JoinedStrandSession.syncWithParty). Connected-only for the
+      // reap's reason above; owner-only by the session's own signer check. Nothing is urgent:
+      // a join reaches the party within one pass of this machine being connected.
+      try {
+        await this.joinedStrands?.syncWithParty();
+      } catch (error) {
+        log('reconcileControlCohort: joined-strand sync failed (retrying next pass): %o', error);
+      }
+      if (!this._running || !this.controlNode || !this.controlDatabase) {
+        return { dialed: [] };
+      }
     }
 
     // 1. Enumerate known siblings. This membership read is itself a pull-on-read
@@ -3137,6 +3426,34 @@ export class CadreNode implements SAppIdLookup {
     };
   }
 
+  /**
+   * The link-derived limits shared by every {@link SeedBootstrapService} this node builds: its
+   * owner and invite dials ({@link controlDialBudget}) and its seed delivery deadline, derived
+   * from `network.linkRoundTripMs`. One helper so the four construction sites cannot drift.
+   */
+  private seedServiceBudgets(): Pick<SeedBootstrapConfig, 'dialBudget' | 'linkRoundTripMs'> {
+    return {
+      dialBudget: this.controlDialBudget(),
+      linkRoundTripMs: this.config.network?.linkRoundTripMs,
+    };
+  }
+
+  /**
+   * {@link collectStrandAddrs} at this node's declared `network.linkRoundTripMs`, so each ask's
+   * deadline derives from it. One helper so the four call sites cannot drift.
+   */
+  private async collectSiblingStrandAddrs(
+    controlNode: Libp2p,
+    peers: StrandAddrPeer[],
+    strandId: string,
+    delegatePeerId?: string
+  ): Promise<StrandAddrCollection> {
+    return await collectStrandAddrs(controlNode, peers, strandId, {
+      delegatePeerId,
+      linkRoundTripMs: this.config.network?.linkRoundTripMs,
+    });
+  }
+
   /**
    * Dial one sibling from its already-resolved addresses, best-effort. Returns
    * whether the dial resolved (false when no address resolves or the dial fails).
@@ -3145,7 +3462,9 @@ export class CadreNode implements SAppIdLookup {
    * the {@link controlDialBudget} expiring) is logged and swallowed so one
    * unreachable sibling never aborts the pass — exactly like
    * {@link SeedBootstrapService.applySeed}'s owner-dial loop. A failed dial is
-   * simply retried on the next pass.
+   * simply retried on the next pass. A sibling whose every address relays
+   * through this node ({@link SelfRelayOnlyError}) is not dialed at all and gets
+   * a one-line log instead: only the sibling can reconnect.
    */
   private async dialControlSibling(sibling: CohortPeerRow, resolved: Multiaddr[]): Promise<boolean> {
     const controlNode = this.controlNode;
@@ -3167,7 +3486,11 @@ export class CadreNode implements SAppIdLookup {
       );
       return true;
     } catch (error) {
-      log('reconcileControlCohort: dial of sibling %s failed (continuing): %o', sibling.peerId, error);
+      if (error instanceof SelfRelayOnlyError) {
+        log('reconcileControlCohort: sibling %s is reachable only by relaying through this node; waiting for it to reconnect', sibling.peerId);
+      } else {
+        log('reconcileControlCohort: dial of sibling %s failed (continuing): %o', sibling.peerId, error);
+      }
       return false;
     }
   }
@@ -3426,7 +3749,11 @@ export class CadreNode implements SAppIdLookup {
       );
       return true;
     } catch (error) {
-      log('reconcileControlCohort(cold-start): dial of bootstrap peer %s failed (continuing): %o', peerId, error);
+      if (error instanceof SelfRelayOnlyError) {
+        log('reconcileControlCohort(cold-start): bootstrap peer %s is reachable only by relaying through this node; waiting for it to reconnect', peerId);
+      } else {
+        log('reconcileControlCohort(cold-start): dial of bootstrap peer %s failed (continuing): %o', peerId, error);
+      }
       return false;
     }
   }
@@ -3444,7 +3771,7 @@ export class CadreNode implements SAppIdLookup {
   // local-only). The remedy: detect "wrote while alone" (0 connections is a sound
   // lower bound), queue the affected row, and RE-ISSUE the write once the cohort
   // grows (0→≥1 connection), as an idempotent monotonic update that now broadcasts.
-  // See docs/architecture.md (Control Network → write-while-alone durability).
+  // See docs/architecture.md (Control Network Convergence → "Writes made while alone").
   // ============================================================================
 
   /**
@@ -4143,27 +4470,21 @@ export class CadreNode implements SAppIdLookup {
     // Check if we have sApp config for this strand
     const sAppConfig = this.sAppConfigs.get(strand.Id);
     if (!sAppConfig) {
-      log('No sAppConfig registered for strand %s - emitting strand:discovered', strand.Id);
-      // Strand created by another member and not yet configured locally. Surface
-      // it as a discovery event so the hosting app can decide whether to join
-      // (register a config + addStrand); the strand-agnostic seam keeps this
-      // class free of any app's join policy. A self-configured strand (config
-      // already present) keeps auto-starting below, unchanged.
-      //
-      // Recorded BEFORE the emit so a handler that synchronously drains
-      // `getDiscoveredStrands()` sees this strand too. The watcher does not offer the
-      // same strand twice — its `knownStrands` retains the id, and the one thing that
-      // un-retains it (a failed `addStrand`, via `StrandWatcher.forgetStrand`) leaves the
-      // sApp config registered, so the retry takes the auto-launch branch below rather
-      // than this one. So this map — not the event — is what a late subscriber reads.
-      // See the `strand:discovered` doc in types.ts.
-      this.discoveredStrands.set(strand.Id, strand);
-      this.emit('strand:discovered', { strandId: strand.Id, strand });
-      return;
+      this.announceDiscoveredStrand(strand);
+      // Announce-only unless this node hosts storage replicas. Also skipped when a
+      // listener claimed the strand synchronously (an `addStrand` call registers its
+      // config before its first await): that claim is launching it with the app's schema,
+      // and a replica launch here would only race it.
+      if (!this.hostUnclaimedStrands || this.sAppConfigs.has(strand.Id)) {
+        return;
+      }
     }
 
     try {
-      await this.launchStrand(strand, sAppConfig);
+      const instance = await this.launchStrand(strand, sAppConfig);
+      if (!sAppConfig) {
+        void this.recordReplicaSAppId(instance.strandId);
+      }
     } catch (error) {
       log('Error starting strand %s: %o', strand.Id, error);
       this.emit('strand:error', {
@@ -4180,6 +4501,60 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /**
+   * Offer a strand no local config claims to the hosting app as `strand:discovered`, so
+   * it can decide whether to join (register a config + addStrand); the strand-agnostic
+   * seam keeps this class free of any app's join policy.
+   *
+   * Once per strand: a storage-replica launch that fails is retried by the watcher
+   * (`StrandWatcher.forgetStrand` + backoff), and each retry comes back through
+   * {@link handleStrandAdded} with no config — the app must still see one announcement.
+   * The other thing that un-retains a strand in the watcher (a failed `addStrand`) leaves
+   * the sApp config registered, so that retry takes the claimed branch instead.
+   *
+   * Recorded BEFORE the emit so a handler that synchronously drains
+   * `getDiscoveredStrands()` sees this strand too. So this map — not the event — is what
+   * a late subscriber reads. See the `strand:discovered` doc in types.ts.
+   *
+   * NOTE: a replica launch that keeps failing leaves the watcher not tracking the strand,
+   * so if its control row is removed during the backoff no `handleStrandRemoved` arrives
+   * and this entry outlives the row. Needs a persistently failing launch AND a removal
+   * inside the backoff; if it is ever seen, have the watcher report removal of rows it
+   * forgot, since `detachStrand` is already a no-op for an untracked instance.
+   */
+  private announceDiscoveredStrand(strand: StrandRow): void {
+    if (this.discoveredStrands.has(strand.Id)) {
+      return;
+    }
+    log('No sAppConfig registered for strand %s - emitting strand:discovered', strand.Id);
+    this.discoveredStrands.set(strand.Id, strand);
+    this.emit('strand:discovered', { strandId: strand.Id, strand });
+  }
+
+  /**
+   * Record the sApp id a storage replica's `Strand.Header` names, for {@link getSAppId}.
+   * Runs whenever a replica's database may have just been published (launch, the
+   * first-sync gate opening, a wake); a no-op for a claimed strand, an unpublished
+   * database, or an id already recorded. Never throws: a failed read logs and leaves the
+   * id unknown, so an `sAppId` filter keeps the strand provisionally admitted — a
+   * syncing replica, which is harmless.
+   */
+  private async recordReplicaSAppId(strandId: string): Promise<void> {
+    const database = this.strandManager.getInstance(strandId)?.database;
+    if (!database || this.sAppConfigs.has(strandId) || this.replicaSAppIds.has(strandId)) {
+      return;
+    }
+    try {
+      const sAppId = await readStrandHeaderSAppId(database.getDatabase());
+      if (sAppId !== undefined) {
+        this.replicaSAppIds.set(strandId, sAppId);
+        log('Storage replica %s serves sApp %s', strandId, sAppId);
+      }
+    } catch (error) {
+      log('Could not read the sApp id of storage replica %s (left unknown): %o', strandId, error);
+    }
+  }
+
   private async handleStrandRemoved(strandId: string): Promise<void> {
     log('Handling strand removed: %s', strandId);
 
@@ -4265,7 +4640,7 @@ export class CadreNode implements SAppIdLookup {
 
     // Unregister strand solicitation service
     if (this.strandSolicitationService && this.controlNode) {
-      this.strandSolicitationService.unregisterResponder(this.controlNode);
+      await this.strandSolicitationService.unregisterResponder(this.controlNode);
       this.strandSolicitationService = null;
     }
 
@@ -4282,6 +4657,7 @@ export class CadreNode implements SAppIdLookup {
     this.sAppConfigs.clear();
     this.strandLaunchRefusals.clear();
     this.discoveredStrands.clear();
+    this.replicaSAppIds.clear();
 
     // Drop delegate-admission state: the grants are scoped to the session that
     // recorded them, so a stop()/start() cycle on this object must not keep
@@ -4351,6 +4727,7 @@ export class CadreNode implements SAppIdLookup {
     if (instance) {
       this.hibernationManager.recordActivity(instance);
     }
+    void this.recordReplicaSAppId(strandId);
     this.emit('strand:writable', { strandId });
   }
 
@@ -4366,29 +4743,19 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Hibernate a strand: release its strand-network resources via the strand
-   * manager (stop the libp2p node, close the StrandDatabase) and mark it
+   * manager (stop the libp2p node, close the StrandDatabase), which marks it
    * `hibernating`. A quiesced strand holds no open strand-network connections,
-   * transports, or DB handles. No-ops if the strand is missing; if already
-   * quiesced (defensive), just marks status and emits.
+   * transports, or DB handles. No-ops if the strand is missing; one already quiesced
+   * is only marked, and still emits.
    */
   private async handleStrandHibernate(strandId: string): Promise<void> {
-    const instance = this.strandManager.getInstance(strandId);
-    if (!instance) {
+    if (!this.strandManager.getInstance(strandId)) {
       log('handleStrandHibernate: strand %s not found', strandId);
       return;
     }
 
-    if (!instance.libp2pNode && !instance.database) {
-      // Already quiesced — only the status flag needs updating.
-      instance.status = 'hibernating';
-      log('Strand %s already quiesced; marked hibernating', strandId);
-      this.emit('strand:hibernating', { strandId });
-      return;
-    }
-
     log('Hibernating strand %s — releasing strand-network resources', strandId);
     await this.strandManager.quiesceStrand(strandId);
-    instance.status = 'hibernating';
     this.emit('strand:hibernating', { strandId });
     log('Strand %s hibernating (resources released)', strandId);
   }
@@ -4399,7 +4766,13 @@ export class CadreNode implements SAppIdLookup {
    * its runtime via the strand manager. If it is still live (e.g. waking an idle
    * strand, which retains its resources), just flip the status. Overlapping wake
    * triggers are coalesced upstream by `HibernationManager`, so this runs once
-   * per wake; `resumeStrand` is itself idempotent as a backstop.
+   * per wake; a wake racing a check-in joins the check-in's rebuild in `resumeStrand`.
+   *
+   * A failed rebuild re-hibernates the strand (see {@link rehibernateIfResumeFailed});
+   * every failure rethrows, so the waker still sees the error.
+   *
+   * Records no activity itself: whoever asked for the wake did ({@link wakeStrand},
+   * `HibernationManager.recordActivity`), and {@link serviceWake}'s own probe must not.
    */
   private async handleStrandWake(strandId: string): Promise<void> {
     const instance = this.strandManager.getInstance(strandId);
@@ -4409,10 +4782,14 @@ export class CadreNode implements SAppIdLookup {
     }
 
     // Still live (idle wake, or defensive double-wake): no rebuild needed. A joiner
-    // still behind its first-sync gate wakes back to `'syncing'`, not `'active'`.
-    if (instance.libp2pNode || instance.database) {
+    // still behind its first-sync gate wakes back to `'syncing'`, not `'active'`. A
+    // `'starting'` strand is mid-build (a check-in's resume, or its launch) with the node
+    // attached before the database: not live yet, so it falls through and joins that build.
+    // A strand being quiesced still holds its handles but is on its way down: it falls
+    // through too, and its resume runs after the quiesce.
+    if (instance.status !== 'starting' && (instance.libp2pNode || instance.database)
+      && !this.strandManager.isQuiescing(strandId)) {
       instance.status = liveStrandStatus(instance);
-      instance.lastActivity = new Date();
       log('Strand %s woke (already live)', strandId);
       this.emit('strand:waking', { strandId });
       return;
@@ -4421,18 +4798,60 @@ export class CadreNode implements SAppIdLookup {
     // Quiesced: re-resolve the volatile cohort input (the seed may have grown)
     // and rebuild the runtime.
     log('Waking strand %s — rebuilding strand-network resources', strandId);
-    await this.resumeStrandRuntime(strandId);
-    instance.lastActivity = new Date();
+    try {
+      await this.resumeStrandRuntime(strandId);
+    } catch (error) {
+      await this.rehibernateIfResumeFailed(instance, 'Wake', error);
+      throw error;
+    }
     this.emit('strand:waking', { strandId });
     log('Strand %s awake (resources rebuilt)', strandId);
   }
 
+  /**
+   * Undo a failed {@link resumeStrandRuntime}, but only when the rebuild itself failed — this
+   * caller's, or the one it joined in `resumeStrand` — which leaves the instance `'error'`. A
+   * failure before the rebuild (the cohort seed read) built nothing, and may find the strand
+   * mid-build or just brought up by a concurrent wake or check-in; that runtime belongs to
+   * whoever is building or holding it, so quiescing it here would stop a node still in use.
+   */
+  private async rehibernateIfResumeFailed(instance: StrandInstance, context: string, error: unknown): Promise<void> {
+    if (instance.status !== 'error') {
+      log('%s of strand %s failed before its rebuild (status=%s); leaving the strand as it is: %o',
+        context, instance.strandId, instance.status, error);
+      return;
+    }
+    log('%s of strand %s failed; re-hibernating so a later wake or check-in retries: %o', context, instance.strandId, error);
+    await this.rehibernateAfterFailedResume(instance, context);
+  }
+
+  /**
+   * Put a strand whose rebuild or wake window failed back to `'hibernating'`, through a
+   * best-effort quiesce that releases any runtime left up. `resumeStrand` leaves a failed
+   * strand `'error'`, which nothing retries: `HibernationManager` wakes only
+   * `idle`/`hibernating` strands, and reads any other status after a check-in as "woke",
+   * ending its chain. Safe to run twice for one failure (a wake that joined a failed
+   * check-in's rebuild): quiescing a quiesced strand only marks it.
+   *
+   * The quiesce writes the status itself, ordered before any resume requested meanwhile;
+   * this writes it only when the quiesce failed, since a failed release leaves the status
+   * alone.
+   */
+  private async rehibernateAfterFailedResume(instance: StrandInstance, context: string): Promise<void> {
+    try {
+      await this.strandManager.quiesceStrand(instance.strandId);
+    } catch (cleanupErr) {
+      log('%s cleanup quiesce for strand %s failed: %o', context, instance.strandId, cleanupErr);
+      instance.status = 'hibernating';
+    }
+  }
+
   /**
    * Rebuild a quiesced strand's runtime, re-resolving the volatile cohort input
    * first: the discovery seed may have grown since the strand last ran. Shared by
    * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so both
-   * apply the same fresh resolution. `resumeStrand` is idempotent
-   * (returns the live instance unchanged) as a backstop against double-resume.
+   * apply the same fresh resolution. `resumeStrand` returns a live instance unchanged
+   * and joins a rebuild already in flight, so the two paths never build twice.
    */
   private async resumeStrandRuntime(strandId: string): Promise<void> {
     // Re-derive the transport peerId (deterministic and cheap — a quiesced
@@ -4451,6 +4870,7 @@ export class CadreNode implements SAppIdLookup {
     if (instance.libp2pNode) {
       await this.mergeStrandPeerAddrs(instance.libp2pNode, bootstrapNodes, strandId);
     }
+    void this.recordReplicaSAppId(strandId);
   }
 
   /**
@@ -4485,32 +4905,38 @@ export class CadreNode implements SAppIdLookup {
       return;
     }
 
+    // Before the resume, so a wake that joins this rebuild, or activity recorded while it
+    // runs, counts: the window then leaves the strand up for it.
+    const activityMark = instance.lastActivity;
+
+    // 1. Resume exactly as a wake does: re-resolve the (possibly grown) cohort
+    //    seed, then rebuild the runtime.
+    log('Check-in: resuming strand %s to probe the cohort for pending activity', strandId);
     try {
-      // 1. Resume exactly as a wake does: re-resolve the (possibly grown) cohort
-      //    seed, then rebuild the runtime.
-      log('Check-in: resuming strand %s to probe the cohort for pending activity', strandId);
       await this.resumeStrandRuntime(strandId);
+    } catch (err) {
+      // Every failure resolves: `HibernationManager.runCheckIn` decides wake-vs-escalate
+      // from `instance.status` alone. A failed rebuild — on a flaky network, the very
+      // scenario hibernation targets — leaves `resumeStrand`'s `error`, which reads as
+      // "woke" and would STOP the chain with no runtime and no future check-in, so it goes
+      // back to `hibernating` and the manager escalates the backoff and retries. A failure
+      // before the rebuild (the seed read) built nothing: the strand is still `hibernating`
+      // (the manager escalates), or a wake that began meanwhile is building or holding it,
+      // and the manager hands the chain to that wake, whose outcome restores or ends it.
+      await this.rehibernateIfResumeFailed(instance, 'Check-in', err);
+      return;
+    }
 
-      // 2-3. Bounded window for the strand network to connect + the app to act,
-      //      then re-hibernate-if-idle. Shared with the on-demand serviceWake.
-      const windowMs = this.config.hibernation?.checkInWindowMs ?? DEFAULT_CHECKIN_WINDOW_MS;
-      await this.runWakeWindow(instance, windowMs);
+    // 2-3. Bounded window for the strand network to connect + the app to act,
+    //      then re-hibernate-if-idle. Shared with the on-demand serviceWake.
+    const windowMs = this.config.hibernation?.checkInWindowMs ?? DEFAULT_CHECKIN_WINDOW_MS;
+    try {
+      await this.runWakeWindow(instance, activityMark, windowMs);
     } catch (err) {
-      // A check-in that throws part-way — resume failing on a flaky network (the
-      // very scenario hibernation targets), the window rejecting, or quiesce
-      // throwing — must leave the strand HIBERNATING, not in the `error` status
-      // that `resumeStrand` sets on failure. `HibernationManager.runCheckIn`
-      // decides wake-vs-escalate purely from `instance.status` after this
-      // resolves: an `error` status reads as "woke", which STOPS the check-in
-      // chain and strands the strand with no runtime and no future check-in.
-      // Forcing it back to `hibernating` (after a best-effort quiesce to release
-      // any partially-rebuilt runtime) makes the manager escalate the backoff and
-      // retry on the next tick.
-      log('Check-in failed for strand %s; re-hibernating to retry on backoff: %o', strandId, err);
-      await this.strandManager.quiesceStrand(strandId).catch((cleanupErr) => {
-        log('Check-in cleanup quiesce for strand %s failed: %o', strandId, cleanupErr);
-      });
-      instance.status = 'hibernating';
+      // The window's quiesce threw with the rebuilt runtime up: release it best-effort and
+      // leave the strand `hibernating`, for the same reason as a failed rebuild above.
+      log('Check-in window failed for strand %s; re-hibernating to retry on backoff: %o', strandId, err);
+      await this.rehibernateAfterFailedResume(instance, 'Check-in');
     }
   }
 
@@ -4518,33 +4944,42 @@ export class CadreNode implements SAppIdLookup {
    * Window-then-decide for a just-resumed strand, shared by the check-in timer
    * path ({@link handleStrandCheckIn}) and the on-demand {@link serviceWake}:
    *
-   *   1. Capture the post-resume activity marker. `recordActivity` assigns a
-   *      FRESH `Date`, so a changed reference after the window means real
-   *      activity landed during it — not millisecond-resolution noise.
-   *   2. Hold the strand live for `windowMs` so its strand network reaches the
+   *   1. Hold the strand live for `windowMs` so its strand network reaches the
    *      cohort and the app can drive pull-on-read activity.
-   *   3. If activity landed, leave the strand `active` (return `true`); otherwise
-   *      quiesce and mark it `hibernating` again (return `false`).
+   *   2. If activity landed since `activityMark`, leave the strand `active` (return
+   *      `true`); otherwise quiesce it, which marks it `hibernating` again (return `false`).
+   *      A wake or activity that lands during that quiesce rebuilds the strand after it.
    *
-   * @returns whether activity was observed during the window (strand left active).
+   * @param activityMark - `instance.lastActivity` as the caller read it BEFORE bringing the
+   *   strand up. The bring-up records none, and every writer assigns a FRESH `Date`, so a
+   *   changed reference means a wake or activity landed during the resume or the window —
+   *   not millisecond-resolution noise.
+   * @returns whether activity was observed (strand left active).
    */
-  private async runWakeWindow(instance: StrandInstance, windowMs: number): Promise<boolean> {
+  private async runWakeWindow(instance: StrandInstance, activityMark: Date, windowMs: number): Promise<boolean> {
     const strandId = instance.strandId;
-    const activityMark = instance.lastActivity;
 
+    // NOTE: activity during the window arms the idle countdown, so a window longer than the
+    // hint's idle + hibernate timeouts (only reachable with a custom `windowMs`; the shortest
+    // default pair, archive's, is 40 s vs a 15 s window) can let the timer path quiesce the
+    // strand mid-window, which this then marks live. If such windows become real, suspend the
+    // idle countdown while a window holds the strand.
     await this.holdWakeWindow(instance, windowMs);
 
     const sawActivity = instance.lastActivity !== activityMark;
     if (sawActivity) {
-      instance.status = liveStrandStatus(instance);
-      this.emit('strand:waking', { strandId });
-      log('Wake window: strand %s saw activity during the window; staying active', strandId);
+      // A force-hibernate during the window has released the runtime and marked the strand
+      // `hibernating`, which stands; a wake queued behind it writes its own status.
+      if (instance.libp2pNode || instance.database) {
+        instance.status = liveStrandStatus(instance);
+        this.emit('strand:waking', { strandId });
+      }
+      log('Wake window: strand %s saw activity during the window; not re-hibernating', strandId);
       return true;
     }
 
     log('Wake window: no activity for strand %s; re-hibernating', strandId);
     await this.strandManager.quiesceStrand(strandId);
-    instance.status = 'hibernating';
     return false;
   }
 
@@ -4594,6 +5029,11 @@ export class CadreNode implements SAppIdLookup {
    * published (e.g. re-attaching its own orphan after a restart) founds it, and attaching
    * anyone else's row joins, without the caller needing to know which it is.
    *
+   * A joined row (no `founder: true`) this party's control database does not name — a
+   * strand joined from another party — is remembered in the node's joined-strand store, so it
+   * is re-offered as `strand:discovered` after a restart, and published party-wide by an
+   * owner machine's reconcile pass (see {@link forgetJoinedStrand}).
+   *
    * A rejected call leaves nothing running but DOES leave the sApp config
    * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
    * automatic relaunch need it. A failed launch here hands the strand back to that
@@ -4628,6 +5068,13 @@ export class CadreNode implements SAppIdLookup {
       );
     }
 
+    // A row this node offered itself came from the control table or is already a
+    // remembered join, and a row this node founds is not a join, so only a joined row
+    // from elsewhere can be a new join to remember. A founded row recorded here would
+    // come back after a restart with `FounderOwnerKey: null` and relaunch as a joiner.
+    // Captured before the backlog delete below.
+    const rememberable = founder !== true && !this.discoveredStrands.has(strandRow.Id);
+
     // Store sApp config for this strand. The strand is claimed now, so it leaves the
     // unclaimed backlog — a later `getDiscoveredStrands()` drain must not re-offer it.
     this.sAppConfigs.set(strandRow.Id, sAppConfig);
@@ -4638,6 +5085,12 @@ export class CadreNode implements SAppIdLookup {
     log('Registered sAppConfig for strand %s (sApp: %s, founder: %s)',
       strandRow.Id, sAppConfig.id, founder ?? 'derived');
 
+    // Before the launch, so a foreign strand whose launch fails, or whose app is killed
+    // mid-launch, is still offered again: by the watcher's retry and by the next start.
+    if (rememberable) {
+      await this.rememberForeignStrand(strandRow);
+    }
+
     // An unset `founder` is DERIVED from the row inside launchStrand (this node founds
     // iff the row's FounderOwnerKey is its own owner key); an explicit flag wins — the
     // formation/responder flows pass one deliberately, since their consent-seated rows
@@ -4657,7 +5110,8 @@ export class CadreNode implements SAppIdLookup {
       // only delays the watcher's own first attempt by one poll interval, which is what
       // should happen right after an attempt that just failed.
       //
-      // NOTE: the retry relaunches from the CONTROL row plus the registered config, not
+      // NOTE: the retry relaunches from the CONTROL row (or, for a strand joined from
+      // another party, the remembered join) plus the registered config, not
       // from the row and arguments passed here — so a caller that enriched either (a
       // synthetic `MemberPrivateKey`, an explicit `founder` or `partyMemberPrivateKey`)
       // is retried with less than it asked for. Inert today: founder-ness re-derives from
@@ -4821,7 +5275,7 @@ export class CadreNode implements SAppIdLookup {
     } catch (error) {
       // Only the uniqueness collision is a candidate for the idempotent reading; every
       // other rejection (unauthorized signer, retired stamp) must keep surfacing.
-      if (!isStrandIdConflict(error)) {
+      if (!isStrandIdConflict(error, 'Strand')) {
         throw error;
       }
       const landed = await this.controlDatabase!.queryStrand(trimmed);
@@ -4978,7 +5432,7 @@ export class CadreNode implements SAppIdLookup {
    * — and with it the consent re-seat foreclosure — does propagate; but the physical row
    * deletion cannot be replayed, and `queryStrands` reads raw (no retired-stamp filter),
    * so siblings that already hold the row keep running the strand until the collection
-   * itself converges (logged loudly; see the delete-while-alone durability note in
+   * itself converges (logged loudly; see "Deletes made while alone" in
    * docs/architecture.md).
    *
    * A no-op (no throw, no tombstone) when the row is already absent — but a
@@ -5016,6 +5470,9 @@ export class CadreNode implements SAppIdLookup {
     // A refused pre-split launch left no tracked instance, so the stop below never
     // reaches detachStrand for it — clear the refusal here so a re-founded id starts clean.
     this.strandLaunchRefusals.delete(trimmed);
+    // A party-wide removal: the strand's peers must not stay dial targets for a strand
+    // that no longer exists (a re-published id is a fresh strand with fresh peers).
+    this.forgetStrandPeers(trimmed, 'unpublishStrand');
     // Clear THIS machine's own MemberPeer binding while the strand runtime — and the
     // retained party key — is still live: the delete above already destroyed the
     // party's StrandPartyKey row, so once this process forgets the key nothing can
@@ -5129,10 +5586,10 @@ export class CadreNode implements SAppIdLookup {
    * NOTE: "founding machine" here is the ROW's provenance, not the launch's resolved
    * `founder` flag — so an explicit `founder: false` over a row this machine published
    * still mints, an owner-signed write a caller that said "I am not founding" did not ask
-   * for. Harmless (the party needs that identity for the strand either way, and the mint
-   * is insert-if-absent) and unreachable today: the one explicit `founder: false` caller
-   * passes a row with a null `FounderOwnerKey`. If a caller ever pairs `founder: false`
-   * with its own published row, gate the mint on the resolved flag too.
+   * for. Reached by a storage replica of a row this machine published (always a joiner,
+   * see {@link launchStrand}) and kept on purpose: the party needs that identity for the
+   * strand either way, the mint is insert-if-absent, and a closed-strand replica runs its
+   * membership reconciler — which seats its own `MemberPeer` binding — only with a party key.
    */
   private async resolveStrandPartyKey(strand: StrandRow, explicitKey?: string): Promise<string | undefined> {
     if (explicitKey !== undefined) {
@@ -5327,14 +5784,23 @@ export class CadreNode implements SAppIdLookup {
    * A founder launch refused as pre-split (`PreSplitStrandIdentityError`) is recorded in
    * {@link strandLaunchRefusals} for the formation arm, then rethrown; a founder launch
    * that succeeds clears the record (it ran the bootstrap's pre-split check and passed).
+   *
+   * An absent `sAppConfig` launches a storage replica ({@link CadreNodeConfig.hostUnclaimedStrands}),
+   * which is ALWAYS a joiner whatever the row says: the founder bootstrap writes the sApp
+   * into `Strand.Header`, and a replica has none. So a self-founded row whose watcher poll
+   * wins the race against its app's `addStrand` after a restart comes up as a replica — and
+   * so does a `foundStrand` whose publish a watcher poll saw before its attach. A claim
+   * that finds a tracked replica upgrades it in place, over the same node and store
+   * ({@link StrandInstanceManager.attachSApp}), BEFORE any founding: the founder bootstrap
+   * needs the sApp the attach supplies.
    */
   private async launchStrand(
     strand: StrandRow,
-    sAppConfig: SAppConfig,
+    sAppConfig: SAppConfig | undefined,
     founder?: boolean,
     explicitPartyKey?: string
   ): Promise<StrandInstance> {
-    const resolvedFounder = founder ?? this.isSelfFoundedRow(strand);
+    const resolvedFounder = sAppConfig ? (founder ?? this.isSelfFoundedRow(strand)) : false;
     try {
       const instance = await this.startOrFoundStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey);
       if (resolvedFounder) {
@@ -5355,46 +5821,13 @@ export class CadreNode implements SAppIdLookup {
    */
   private async startOrFoundStrand(
     strand: StrandRow,
-    sAppConfig: SAppConfig,
+    sAppConfig: SAppConfig | undefined,
     resolvedFounder: boolean,
     explicitPartyKey: string | undefined
   ): Promise<StrandInstance> {
     const timed = <T>(step: string, op: () => Promise<T>) => timedStep('startOrFoundStrand', strand.Id, step, op);
-    const existing = this.strandManager.getInstance(strand.Id);
-    if (existing) {
-      if (resolvedFounder) {
-        // The resolver runs only when the retained config lacks a party key for a
-        // closed strand (see foundExistingStrand), so the common watcher re-entry
-        // ('already-founder') still costs no control read.
-        const outcome = await timed('foundExistingStrand', () => this.strandManager.foundExistingStrand(strand.Id,
-          () => this.resolveStrandPartyKey(strand, explicitPartyKey)));
-        if (outcome === 'needs-resume') {
-          try {
-            // Quiesced instance: the retained config now founds, but founding promises
-            // the bootstrap has RUN by the time the caller resolves — wake through the
-            // hibernation manager (coalesced with any in-flight wake, timer-aware) so
-            // the rebuild executes it now rather than at some eventual wake.
-            await timed('wakeStrand', () => this.wakeStrand(strand.Id));
-            // The wake's rebuild founds — UNLESS a wake was already in flight when the
-            // config flipped, in which case it had already read the pre-flip config and
-            // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
-            // (insert-if-absent) bootstrap so founding never resolves headerless.
-            await timed('ensureFounderBootstrap', () => this.strandManager.ensureFounderBootstrap(strand.Id));
-          } catch (error) {
-            // The founding did not happen (e.g. the rebuild refused a pre-split strand and
-            // rolled back, leaving the instance tracked with no runtime): withdraw the flip
-            // so the next attempt re-runs the founding instead of resolving
-            // 'already-founder' over an instance that never founded.
-            this.strandManager.withdrawFounderRequest(strand.Id);
-            throw error;
-          }
-        }
-        log('launchStrand: strand %s already tracked — founder request honored (%s)',
-          strand.Id, outcome);
-      } else {
-        log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
-      }
-      return existing;
+    if (this.strandManager.getInstance(strand.Id)) {
+      return this.claimTrackedStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey);
     }
 
     // A closed strand's launch carries the party's OWN membership identity key: the
@@ -5414,18 +5847,25 @@ export class CadreNode implements SAppIdLookup {
     // retained launch config carries this derived key, so hibernate → wake
     // (resumeStrand) reuses the same peerId.
     //
+    // Without an identity key (a node configured with neither `keyStore` nor
+    // `privateKey` — tests, and an embedder that opted out of a stable identity) the
+    // strand node still runs under a key CADRE-CORE HOLDS: a fresh random Ed25519 key,
+    // exactly what libp2p would generate internally if handed none, except that the
+    // book swap can sign this node's own entry with it (`strand-peer-book-swap.ts`) and
+    // the retained launch config keeps the same strand peer id across a hibernation
+    // resume. Stability across RESTARTS still needs an identity key.
+    //
     // NOTE: derivation requires an Ed25519 identity key, so a node configured
     // with some other key type now fails strand launch outright (surfaced as
     // `strand:error` / a rejected addStrand) where it previously started the
     // strand on that key. Ed25519 is already required for every control-DB
     // signing path, so nothing reachable today hits this; if a non-Ed25519
-    // identity is ever supported, fall back to `undefined` here — libp2p then
-    // generates a random per-strand key, which still avoids the collision but
-    // gives up peerId stability across restarts.
+    // identity is ever supported, take the random-key branch below for it — it
+    // still avoids the collision, and gives up only peerId stability across restarts.
     const identityKey = this.identityKey;
     const transportKey = identityKey
       ? await timed('strandTransportKey', () => strandTransportKey(identityKey, strand.Id))
-      : undefined;
+      : await generateKeyPair('Ed25519');
 
     // Derived BEFORE seed resolution so the seed pass doubles as the delegate
     // announcement and every grant is recorded before `startStrand` runs
@@ -5434,6 +5874,15 @@ export class CadreNode implements SAppIdLookup {
     const delegatePeerId = transportKey ? peerIdFromPrivateKey(transportKey).toString() : undefined;
     const bootstrapNodes = await timed('resolveCohortSeed', () => this.resolveCohortSeed(strand.Id, delegatePeerId));
 
+    // Checked again after the awaits above: another launch of this strand may have started
+    // meanwhile (a replica's watcher launch racing an app's claim, in either order), and
+    // `startStrand` would hand its instance back unchanged — a claim holding a replica with
+    // no `App` tables, a founder request dropped. Nothing awaits between this check and
+    // `startStrand`'s own, so no third launch can slip in.
+    if (this.strandManager.getInstance(strand.Id)) {
+      return this.claimTrackedStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey);
+    }
+
     const instance = await timed('strandManager.startStrand', () => this.strandManager.startStrand({
       strandRow: strand,
       sAppConfig,
@@ -5455,7 +5904,20 @@ export class CadreNode implements SAppIdLookup {
       backfill: this.config.strandBackfill,
       revocationEnforcement: this.config.strandRevocationEnforcement,
       membershipReconciliation: this.config.strandMembershipReconciliation,
-      onSelfRevoked: (revokedStrandId) => this.emit('strand:revoked', { strandId: revokedStrandId }),
+      onSelfRevoked: (revokedStrandId) => {
+        this.forgetRevokedJoin(revokedStrandId);
+        this.emit('strand:revoked', { strandId: revokedStrandId });
+      },
+      // The strand peer book's observation writer: every strand peer the node
+      // identifies is remembered with its dialable addresses, so a restart re-finds
+      // it. Retained with the launch config, so a hibernation wake re-arms it.
+      onStrandPeerIdentified: (observedStrandId, observation) =>
+        this.observeStrandPeer(observedStrandId, observation),
+      // The book's third writer, the signed swap between strand peers: the strand node
+      // reads and writes the store directly (`strand-peer-book-swap.ts`). Retained with
+      // the launch config too. `?? undefined`: the field is `null` before start(), and a
+      // strand cannot launch before start(), so this is belt and braces.
+      strandPeerBook: this.strandPeerBookStore ?? undefined,
       onRejoinBlocked: (blockedStrandId) => this.emit('strand:rejoin-blocked', { strandId: blockedStrandId }),
       // The joiner's first-sync write gate (strand-first-sync-gate.ts): a launch that
       // comes up `'syncing'` announces the moment its database is published.
@@ -5494,6 +5956,72 @@ export class CadreNode implements SAppIdLookup {
     return instance;
   }
 
+  /**
+   * {@link startOrFoundStrand} for a strand the manager already tracks: a claim of a
+   * storage replica gives it the app's schema in place, then a founder request founds it,
+   * waking a quiesced instance so the bootstrap has run before this resolves. Emits
+   * nothing — `strand:started` fired when the instance launched.
+   *
+   * A launch of the strand still in flight (the watcher's launch racing an app's
+   * `addStrand`, in either order) is waited out first: until its build settles the tracked
+   * instance is `'starting'` with no database, and returning it would resolve `addStrand`
+   * with a strand the app cannot use — and skip that call's first-sync wait, which only a
+   * `'syncing'` instance gets. If that launch fails, this rejects too: its record is gone.
+   */
+  private async claimTrackedStrand(
+    strand: StrandRow,
+    sAppConfig: SAppConfig | undefined,
+    resolvedFounder: boolean,
+    explicitPartyKey: string | undefined
+  ): Promise<StrandInstance> {
+    const timed = <T>(step: string, op: () => Promise<T>) => timedStep('startOrFoundStrand', strand.Id, step, op);
+    const existing = await this.strandManager.whenRuntimeBuilt(strand.Id);
+    if (!existing) {
+      throw new Error(`Strand ${strand.Id}: the launch this one waited on failed (reported by the call that started it)`);
+    }
+    // Before the founder branch: the founder bootstrap writes the sApp into Strand.Header,
+    // so it must run against the attached config.
+    if (sAppConfig && !existing.sAppInfo) {
+      const attached = await timed('attachSApp', () => this.strandManager.attachSApp(strand.Id, sAppConfig,
+        { requireSignedSchemas: this.config.requireSignedSchemas }));
+      log('launchStrand: strand %s was running as a storage replica — sApp %s claimed it (%s)',
+        strand.Id, sAppConfig.id, attached);
+    }
+    if (!resolvedFounder) {
+      log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+      return existing;
+    }
+    // The resolver runs only when the retained config lacks a party key for a
+    // closed strand (see foundExistingStrand), so the common watcher re-entry
+    // ('already-founder') still costs no control read.
+    const outcome = await timed('foundExistingStrand', () => this.strandManager.foundExistingStrand(strand.Id,
+      () => this.resolveStrandPartyKey(strand, explicitPartyKey)));
+    if (outcome === 'needs-resume') {
+      try {
+        // Quiesced instance: the retained config now founds, but founding promises
+        // the bootstrap has RUN by the time the caller resolves — wake through the
+        // hibernation manager (coalesced with any in-flight wake, timer-aware) so
+        // the rebuild executes it now rather than at some eventual wake.
+        await timed('wakeStrand', () => this.wakeStrand(strand.Id));
+        // The wake's rebuild founds — UNLESS a wake was already in flight when the
+        // config flipped, in which case it had already read the pre-flip config and
+        // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
+        // (insert-if-absent) bootstrap so founding never resolves headerless.
+        await timed('ensureFounderBootstrap', () => this.strandManager.ensureFounderBootstrap(strand.Id));
+      } catch (error) {
+        // The founding did not happen (e.g. the rebuild refused a pre-split strand and
+        // rolled back, leaving the instance tracked with no runtime): withdraw the flip
+        // so the next attempt re-runs the founding instead of resolving
+        // 'already-founder' over an instance that never founded.
+        this.strandManager.withdrawFounderRequest(strand.Id);
+        throw error;
+      }
+    }
+    log('launchStrand: strand %s already tracked — founder request honored (%s)',
+      strand.Id, outcome);
+    return existing;
+  }
+
   /**
    * Resolve a strand's discovery seed — the dialable strand-network multiaddr
    * strings for cohort siblings. Membership comes from the control network's
@@ -5516,17 +6044,38 @@ export class CadreNode implements SAppIdLookup {
    * relay reservation — the gate denial there is fatal, not degraded. A
    * party-member relay answers the RPC (its control node admits us as a
    * member); a dedicated ops/ relay does not speak the protocol and the
-   * per-peer failure folds to `[]` — harmless, it has no membership gate and
+   * per-peer failure comes back `unreachable` — harmless, it has no membership gate and
    * needs no grant. The relay's direct addr rides along as the dial fallback
    * for a relay we are not yet connected to.
    */
   private async resolveCohortSeed(strandId: string, delegatePeerId?: string): Promise<string[]> {
     const siblings = await this.resolveSiblingSeed(strandId, delegatePeerId);
-    // Sibling answers FIRST: they were resolved just now, while a contact-map entry is as
-    // old as the formation that produced it. `unionAddrs` appends only what the siblings
+    // Sibling answers FIRST: they were resolved just now, while a book entry is as old
+    // as the last connection to that peer. `unionAddrs` appends only what the siblings
     // did not already name, so a fresher answer is never displaced and each source keeps
-    // its own signaling-first ordering.
-    return unionAddrs(siblings, this.crossPartyStrandAddrs.get(strandId) ?? []);
+    // its own signaling-first ordering. `delegatePeerId` IS this strand node's own id.
+    return unionAddrs(siblings, this.strandPeerBookAddrs(strandId, delegatePeerId));
+  }
+
+  /**
+   * The strand peer book's contribution to a strand's seed: every live entry's
+   * addresses, freshest peer first, minus this node's own entry when `selfPeerId` is
+   * known (the book swap files one under the strand transport id; a node must never
+   * dial itself). Empty before {@link start} builds the store.
+   */
+  private strandPeerBookAddrs(strandId: string, selfPeerId?: string): string[] {
+    const store = this.strandPeerBookStore;
+    if (!store) {
+      return [];
+    }
+    const addrs: string[] = [];
+    for (const entry of store.entries(strandId)) {
+      if (entry.peerId === selfPeerId) {
+        continue;
+      }
+      addrs.push(...entry.addrs);
+    }
+    return addrs;
   }
 
   /**
@@ -5547,10 +6096,13 @@ export class CadreNode implements SAppIdLookup {
       }
     }
     const bootstrapNodes = targets.length
-      ? await collectStrandAddrs(this.controlNode, targets, strandId, { delegatePeerId })
+      ? (await this.collectSiblingStrandAddrs(this.controlNode, targets, strandId, delegatePeerId)).addrs
       : [];
     // Throttle state for the RELAY targets only — refreshDelegateGrants never
-    // looks up a sibling key, so recording one would only be dead weight.
+    // looks up a sibling key, so recording one would only be dead weight. The
+    // siblings' refresh due times are deliberately left alone too: stamping here
+    // would race the refresh pass's pruning while the strand node is still coming
+    // up, and all it would save is one extra RPC per sibling on the first tick.
     this.recordDelegateAnnounces(relays.map((r) => r.relayPeerId), strandId);
     return bootstrapNodes;
   }
@@ -5635,9 +6187,10 @@ export class CadreNode implements SAppIdLookup {
    * Record the announce timestamps {@link refreshDelegateGrants} throttles on,
    * for every relay a delegate-carrying announce pass dialed.
    *
-   * Recorded OPTIMISTICALLY at announce time: `collectStrandAddrs` folds
-   * per-peer failure to `[]` and reports no per-peer success, and threading
-   * success out would change its API for little gain. A failed INITIAL announce
+   * Recorded OPTIMISTICALLY at announce time, whatever `collectStrandAddrs`
+   * reports per peer: a dedicated `ops/` relay never speaks the strand-addr
+   * protocol, so recording only on success would re-announce to it on every
+   * reconcile tick, one wasted protocol negotiation each. A failed INITIAL announce
    * costs the strand supervisor its first attempt only (the relay denies the
    * reservation; every re-drive re-announces first through
    * {@link announceDelegateToRelay}); a failed REFRESH retries within
@@ -5674,7 +6227,7 @@ export class CadreNode implements SAppIdLookup {
         running.set(strandId, instance.libp2pNode.peerId.toString());
       }
     }
-    pruneStoppedStrandAnnounces(this.delegateAnnounceAt, new Set(running.keys()));
+    prunePeerStrandKeys(this.delegateAnnounceAt, new Set(running.keys()));
     if (running.size === 0) {
       return;
     }
@@ -5704,16 +6257,16 @@ export class CadreNode implements SAppIdLookup {
    * again right away.
    *
    * Against a dedicated ops relay (no strand-addr RPC) the request fails per-peer
-   * and `collectStrandAddrs` folds it to `[]`: one wasted protocol negotiation per
+   * and `collectStrandAddrs` reports it `unreachable`: one wasted protocol negotiation per
    * re-drive attempt, bounded by the supervisor's backoff. Never throws on that
    * path; a relay addr that names no peer id is logged and skipped (the hook's
    * caller runs the drive regardless).
    *
    * NOTE: against a relay that is DOWN this hook costs up to two strand-addr
-   * timeouts (10 s each: dial by peer id, then by addr) before the reservation drive even
-   * starts, so one failed re-drive holds the supervisor `driving` for those 20 s plus the
-   * drive's own deadline — 34 s at the default declared link round trip, and longer on a host
-   * that declared a slower one (`link-budget.ts`).
+   * timeouts (dial by peer id, then by addr; 23 s each at the default declared link round trip)
+   * before the reservation drive even starts, so one failed re-drive holds the supervisor
+   * `driving` for those 46 s plus the drive's own deadline — 64 s at the default, and longer on
+   * a host that declared a slower one (`link-budget.ts`).
    * Bounded and harmless while the relay is unreachable anyway; if recovery
    * latency after a relay comes back ever matters, skip the announce when the
    * control node holds no connection to the relay (the drive's own dial fails
@@ -5729,11 +6282,11 @@ export class CadreNode implements SAppIdLookup {
       log('announceDelegateToRelay: relay addr %s names no peer id; strand %s not announced', relayAddr, strandId);
       return;
     }
-    await collectStrandAddrs(
+    await this.collectSiblingStrandAddrs(
       controlNode,
       [{ peerId: relayPeerId, addrs: [multiaddr(relayAddr)] }],
       strandId,
-      { delegatePeerId }
+      delegatePeerId
     );
     this.recordDelegateAnnounces([relayPeerId], strandId);
   }
@@ -5753,14 +6306,15 @@ export class CadreNode implements SAppIdLookup {
     if (due.length === 0) {
       return;
     }
-    await collectStrandAddrs(controlNode, due.map(relayStrandAddrPeer), strandId, { delegatePeerId });
+    await this.collectSiblingStrandAddrs(controlNode, due.map(relayStrandAddrPeer), strandId, delegatePeerId);
     this.recordDelegateAnnounces(due.map((relay) => relay.relayPeerId), strandId, now);
   }
 
   /**
-   * Re-resolve each running strand's SIBLING addresses over the control mesh and
-   * merge them into that strand's own libp2p address book, throttled to once per
-   * {@link STRAND_PEER_ADDR_REFRESH_MS} per strand.
+   * Keep each running strand's own libp2p address book warm: re-merge its strand
+   * peer book on every pass, and re-ask each connected SIBLING for its strand
+   * addresses over the control mesh when that (sibling, strand) is due
+   * ({@link strandAddrAskDueAt}).
    *
    * Without this, a strand's address book is written exactly once — the
    * launch/resume seed — and everything below cadre-core that dials a strand peer
@@ -5770,6 +6324,12 @@ export class CadreNode implements SAppIdLookup {
    * re-resolved, and even the original seed addresses fall off at the peerStore's
    * one-hour expiry (see `peer-addr-book.ts`).
    *
+   * Due times are per (sibling, strand) and set from each sibling's own outcome, so
+   * a sibling that connects late — a phone joining after the party's always-on
+   * machines — is asked on the next tick, and one that could not answer or refused
+   * (its view of the membership may not include us yet) is retried within
+   * {@link STRAND_PEER_ADDR_RETRY_MS} rather than {@link STRAND_PEER_ADDR_REFRESH_MS}.
+   *
    * Distinct from {@link refreshDelegateGrants}, deliberately: that pass covers
    * RELAYS on a `DELEGATE_GRANT_TTL_MS / 2` throttle to keep circuit-relay
    * admission grants alive, this one covers SIBLINGS on an address-expiry
@@ -5793,57 +6353,67 @@ export class CadreNode implements SAppIdLookup {
         running.add(strandId);
       }
     }
-    // Drop stamps for strands no longer running: the map must not grow for the
-    // node's lifetime, and a resumed strand should refresh immediately rather
-    // than inherit the stamp its previous incarnation left.
-    for (const strandId of this.strandPeerAddrRefreshAt.keys()) {
-      if (!running.has(strandId)) {
-        this.strandPeerAddrRefreshAt.delete(strandId);
-      }
-    }
-    const refreshMs = this.config.network?.controlCohort?.strandAddrRefreshMs ?? STRAND_PEER_ADDR_REFRESH_MS;
-    const due = [...running].filter(
-      (strandId) => now - (this.strandPeerAddrRefreshAt.get(strandId) ?? 0) >= refreshMs
-    );
-    if (due.length === 0) {
+    if (running.size === 0) {
+      this.strandAddrAskDueAt.clear();
       return;
     }
-    // `connectedSiblingTargets`' membership read is unbounded, and with zero
-    // connections its answer is empty whatever the table holds, so decide it from the
-    // connection list instead of paying for the read once a tick. Note this only skips
-    // the RPC: a strand carrying cross-party contact addresses still refreshes below,
-    // because those never came from a sibling in the first place.
-    //
-    // NOTE: one strand-addr RPC per (due strand × connected sibling) per refresh
-    // interval — each a tiny request/response on an already-open control
-    // connection. If a node ever runs MANY strands at once, batch the RPC to
-    // carry several strand ids per request rather than one fan-out per strand.
-    const targets = this.controlNode.getConnections().length === 0
-      ? []
-      : await this.connectedSiblingTargets().catch((error): StrandAddrPeer[] => {
-        log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
-        return [];
-      });
+    const targets = await this.strandAddrRefreshTargets();
     // A shutdown landed mid-enumeration.
     if (!this._running || !this.controlNode) {
       return;
     }
-    await Promise.all(due.map((strandId) => this.refreshOneStrandPeerAddrs(strandId, targets, now)));
+    // Drop due times for strands no longer running and siblings no longer connected:
+    // the map must not grow for the node's lifetime, a resumed strand must not
+    // inherit its previous incarnation's due times, and a sibling that reconnects (a
+    // phone restart, a new relay reservation) must be asked on its next connected
+    // tick. An enumeration failure prunes everything, which costs one extra round of
+    // asks, never a missed one.
+    prunePeerStrandKeys(this.strandAddrAskDueAt, running, new Set(targets.map((t) => t.peerId)));
+    await Promise.all([...running].map((strandId) => this.refreshOneStrandPeerAddrs(strandId, targets, now)));
+  }
+
+  /**
+   * The siblings {@link refreshStrandPeerAddrs} may ask this pass: the connected
+   * cohort, or none when enumeration fails (logged, never thrown).
+   *
+   * `connectedSiblingTargets`' membership read is unbounded, and with zero
+   * connections its answer is empty whatever the table holds, so decide it from the
+   * connection list instead of paying for the read once a tick.
+   *
+   * NOTE: otherwise the read runs on EVERY tick with a running strand, not only when
+   * some (sibling, strand) is due: pruning a departed sibling needs the current
+   * target set, and whether anyone is due cannot be told without it (a connected
+   * non-member never gets a due time to compare). One more `CadrePeer` read per 15 s
+   * tick, on top of the two `runReconcileControlCohort` already makes; if those reads
+   * get costly, share one row-set across the pass (see the NOTE there) rather than
+   * skipping ticks here.
+   *
+   * NOTE: one strand-addr RPC per (running strand × due sibling) — each a tiny
+   * request/response on an already-open control connection. If a node ever runs
+   * MANY strands at once, batch the RPC to carry several strand ids per request
+   * rather than one fan-out per strand.
+   */
+  private async strandAddrRefreshTargets(): Promise<StrandAddrPeer[]> {
+    if (this.controlNode?.getConnections().length === 0) {
+      return [];
+    }
+    return this.connectedSiblingTargets().catch((error): StrandAddrPeer[] => {
+      log('refreshStrandPeerAddrs: sibling enumeration failed (asking nobody this pass): %o', error);
+      return [];
+    });
   }
 
   /**
-   * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, union their
-   * answers with this strand's cross-party contact addresses, and merge the lot into the
-   * strand's address book. Errors are logged and swallowed so one strand's failure never
-   * costs the others their refresh.
+   * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings that are
+   * due, union their answers with this strand's peer-book addresses, and merge the
+   * lot into the strand's address book. Errors are logged and swallowed so one
+   * strand's failure never costs the others their refresh.
    *
-   * `targets` may be EMPTY — a solo node, or one whose only control peers are strangers.
-   * The cross-party addresses still have to be re-merged in that case: they were learned
-   * at formation and can never be re-resolved, so this periodic re-merge is the ONLY
-   * thing standing between them and the peerStore's one-hour expiry. A strand with
-   * neither a sibling to ask nor a contact entry does nothing and leaves its throttle
-   * unstamped, so the next reconcile tick retries rather than sitting out the whole
-   * refresh interval having done nothing.
+   * The peer book merges on EVERY pass, whether or not any sibling is due or
+   * connected: nothing re-resolves another party's addresses, so this re-merge is the
+   * ONLY thing standing between them and the peerStore's one-hour expiry — and it is
+   * also how a re-formation's freshly carried addresses reach a running strand on the
+   * next tick. A strand with nobody due and no book entry does nothing.
    */
   private async refreshOneStrandPeerAddrs(
     strandId: string,
@@ -5855,33 +6425,66 @@ export class CadreNode implements SAppIdLookup {
     if (!controlNode || !strandNode) {
       return;
     }
-    const contactAddrs = this.crossPartyStrandAddrs.get(strandId) ?? [];
-    if (targets.length === 0 && contactAddrs.length === 0) {
-      return;
-    }
     try {
+      // Inside the try: a strand node torn down mid-pass may throw on any read, and one
+      // strand's failure must never cost the others their refresh.
+      const strandPeerId = strandNode.peerId.toString();
+      const contactAddrs = this.strandPeerBookAddrs(strandId, strandPeerId);
+      const due = targets.filter(
+        (target) => now >= (this.strandAddrAskDueAt.get(peerStrandKey(target.peerId, strandId)) ?? 0)
+      );
       // The running strand node's own peerId is the delegate to announce — see
       // the relationship note on refreshStrandPeerAddrs.
-      const siblingAddrs = targets.length === 0
+      const siblingAddrs = due.length === 0
         ? []
-        : await collectStrandAddrs(controlNode, [...targets], strandId, {
-          delegatePeerId: strandNode.peerId.toString()
-        });
-      // Stamped on the pass having happened, not on its answer: the fan-out is
-      // what the throttle exists to bound, and an all-empty round is a normal
-      // steady state for a strand no connected sibling currently runs.
-      this.strandPeerAddrRefreshAt.set(strandId, now);
+        : await this.askSiblingsForStrandAddrs(controlNode, due, strandId, strandPeerId, now);
       // Re-read the instance after the await — a strand stopped mid-pass (or one
       // already restarted onto a new node) must never have its store written to.
       if (!this._running || this.strandManager.getInstance(strandId)?.libp2pNode !== strandNode) {
         return;
       }
-      await this.mergeStrandPeerAddrs(strandNode, unionAddrs(siblingAddrs, contactAddrs), strandId);
+      const addrs = unionAddrs(siblingAddrs, contactAddrs);
+      if (addrs.length === 0) {
+        return;
+      }
+      // NOTE: with no sibling due this still merges the whole book — up to 16 peers ×
+      // 16 addrs, so 16 `peerStore.merge` calls per running strand per 15 s tick. An
+      // unchanged address set writes nothing in libp2p's persistent peer store, so it
+      // is cheap today; if many strands run at once, merge only book entries changed
+      // since the last tick plus those nearing the one-hour expiry.
+      await this.mergeStrandPeerAddrs(strandNode, addrs, strandId);
     } catch (error) {
       log('refreshStrandPeerAddrs: strand %s refresh failed (continuing): %o', strandId, error);
     }
   }
 
+  /**
+   * RPC `due` siblings for `strandId` and set each one's next due time from its own
+   * outcome: an answer, even an empty one, waits the full refresh interval; anything
+   * else retries in {@link STRAND_PEER_ADDR_RETRY_MS} (or the refresh interval, if
+   * configured shorter). Stamped before the caller
+   * re-checks that the strand is still running, so a strand torn down mid-pass still
+   * records who was asked.
+   */
+  private async askSiblingsForStrandAddrs(
+    controlNode: Libp2p,
+    due: readonly StrandAddrPeer[],
+    strandId: string,
+    delegatePeerId: string,
+    now: number
+  ): Promise<string[]> {
+    const { addrs, outcomes } = await this.collectSiblingStrandAddrs(controlNode, [...due], strandId, delegatePeerId);
+    const refreshMs = this.config.network?.controlCohort?.strandAddrRefreshMs ?? STRAND_PEER_ADDR_REFRESH_MS;
+    // A configured refresh shorter than the retry must not leave a failing sibling
+    // waiting longer than a healthy one.
+    const retryMs = Math.min(refreshMs, STRAND_PEER_ADDR_RETRY_MS);
+    for (const [peerId, outcome] of outcomes) {
+      const waitMs = siblingAnswered(outcome) ? refreshMs : retryMs;
+      this.strandAddrAskDueAt.set(peerStrandKey(peerId, strandId), now + waitMs);
+    }
+    return addrs;
+  }
+
   /**
    * Merge strand-network addresses into ONE strand node's libp2p address book,
    * attributed per peer. Best-effort throughout: an address-book write must never
@@ -5901,14 +6504,14 @@ export class CadreNode implements SAppIdLookup {
    * peerStore's one-hour expiry. No new gating here — cross-party strand trust is
    * `backlog/strand-network-nat-relay-reachability`.
    *
-   * NOTE: one input does NOT age out — the cross-party addresses a formation
-   * carried back ({@link crossPartyStrandAddrs}). Nothing can re-resolve them, so
-   * {@link refreshStrandPeerAddrs} re-merges the same stored list every pass, which
-   * also means a junk entry from a responder survives for the node's lifetime rather
-   * than an hour. Bounded to {@link MAX_STRAND_ADDRS} per strand, from a party this
-   * node deliberately formed a strand with, and still authority-free — so the
-   * exposure is a handful of failed dials, not a trust hole. Evict on
-   * `unpublishStrand` if that ever stops being an acceptable price.
+   * NOTE: one input ages out on a slower clock — the strand peer book's entries
+   * ({@link strandPeerBookStore}). Nothing can re-resolve another party's addresses,
+   * so {@link refreshStrandPeerAddrs} re-merges the book every pass, which means a
+   * junk entry from a responder or a peer's identify survives until the book drops it
+   * (14 days unrefreshed, or the peer's next connection replacing the entry) rather
+   * than an hour. Bounded to 16 peers × 16 addrs per strand, forgotten on
+   * `unpublishStrand` / `forgetJoinedStrand`, and still authority-free — so the
+   * exposure is a handful of failed dials, not a trust hole.
    */
   private async mergeStrandPeerAddrs(strandNode: Libp2p, addrs: string[], strandId: string): Promise<void> {
     const counts: Record<MergeAddrsResult, number> = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
@@ -5977,6 +6580,138 @@ export class CadreNode implements SAppIdLookup {
     return orderSignalingFirst(addrs);
   }
 
+  /**
+   * Leave a strand joined from another party, for the whole party: remove its party-wide
+   * `JoinedStrand` row (owner-signed, with a `Revocation` tombstone), then this machine's
+   * unpublished record, its strand peer book entries and any session-kept entry, then
+   * {@link stopStrand} it here. Every other machine's watcher then sees the row gone and
+   * detaches the strand, a storage replica included; a machine offline at the time reaps the
+   * row once the tombstone reaches it. The joiner's counterpart of {@link unpublishStrand},
+   * which only works on a row the party's own `Strand` table holds. For one of those, or for
+   * a join still local-only, there is no party-wide row and this is a local forget plus
+   * {@link stopStrand}.
+   *
+   * The other members of the strand are not told, and this party's membership row in the
+   * strand stays, so a later re-formation reuses the same identity.
+   *
+   * @throws when a party-wide row exists and this machine cannot sign its removal (not an
+   *   enrolled owner) — {@link stopStrand} stops the strand on this machine only — or when
+   *   the party-wide table cannot be read.
+   */
+  async forgetJoinedStrand(strandId: string): Promise<void> {
+    if (!this._running) {
+      throw new Error('CadreNode not running');
+    }
+    await this.joinedStrands!.leave(strandId);
+    this.forgetStrandPeers(strandId, 'forgetJoinedStrand');
+    await this.stopStrand(strandId);
+  }
+
+  /**
+   * Record `row` as a join from another party when this party's control database names it
+   * neither as its own strand nor as a party-wide join — the one case nothing else would
+   * re-offer after a restart (`JoinedStrandSession.rememberForeign`).
+   *
+   * Best-effort, for {@link addStrand}: a failure costs the strand its re-offer after the
+   * next restart, not this attach, so it is reported and the attach goes on.
+   * {@link formStrand}, whose join nothing else would name, fails loudly instead.
+   *
+   * NOTE: "no control row" also describes a row the party has just unpublished. A claim
+   * of such a row the app kept from an earlier offer, made after the watcher already
+   * withdrew it, is remembered as a join and survives the removal on this machine until
+   * {@link forgetJoinedStrand}. Contrived today (a claim of a row the node itself is still
+   * offering skips this method); if it shows up, check the strand's `Revocation`
+   * tombstone here before recording.
+   */
+  private async rememberForeignStrand(row: StrandRow): Promise<void> {
+    if (!this.joinedStrands || !this.controlDatabase) {
+      return;
+    }
+    try {
+      await this.joinedStrands.rememberForeign(row);
+    } catch (error) {
+      console.warn(`addStrand(${row.Id}): could not remember this strand as joined from another party, ` +
+        'so it will not be re-offered after a restart:', error);
+    }
+  }
+
+  /**
+   * Self-revocation arm of the joined-strand records: a party removed from a strand must
+   * not re-attach it on every launch of every machine. The strand keeps running this
+   * session here — the `strand:revoked` contract is that nothing is torn down for the app —
+   * and its party-wide row is queued for removal by the next connected owner reconcile pass
+   * (`JoinedStrandSession.forgetAfterThisSession`). A no-op for this party's own strands,
+   * which have neither record; the strand peer book is forgotten either way, since a
+   * removed party must not keep dialing the strand's peers.
+   *
+   * NOTE: accepted tradeoff — a sibling machine that has not raised `strand:revoked` itself
+   * detaches the strand (`strand:stopped`) when the party-wide removal reaches it, instead
+   * of keeping it for the session, which weakens "nothing is stopped on the removed
+   * machine's behalf" for siblings. Weighed against a party-wide row that brings a revoked
+   * strand back on every start of every machine. Revisit if apps need the "you were
+   * removed" screen on every device: the sibling could re-check its own revocation state
+   * (`refreshRevocationEnforcement`) before detaching a vanished joined row.
+   *
+   * NOTE: a manager can re-admit a removed party directly (`addMemberByManager`), and the
+   * membership loop then finishes the join on its own — but the records are gone by then,
+   * so the next start does not re-attach the strand. Re-forming records it again. If direct
+   * re-admission becomes a routine flow, re-record the join when the revoked-peer gate
+   * clears for this node.
+   */
+  private forgetRevokedJoin(strandId: string): void {
+    void this.joinedStrands?.forgetAfterThisSession(strandId).catch((error: unknown) => {
+      log('forgetting revoked joined strand %s failed; it will be re-offered on the next start: %o',
+        strandId, error);
+    });
+    // The strand's peers go with the join: a removed party must not keep dialing them.
+    this.forgetStrandPeers(strandId, 'self-revocation');
+  }
+
+  /**
+   * Forget a strand's entries in the peer book (see {@link strandPeerBookStore}):
+   * fire-and-log, like every book write — the removal is visible synchronously by the
+   * store's contract, and a failed persist costs restart survival only.
+   */
+  private forgetStrandPeers(strandId: string, caller: string): void {
+    void this.strandPeerBookStore?.forget(strandId).catch((error: unknown) => {
+      log('%s: forgetting strand %s peers failed (continuing): %o', caller, strandId, error);
+    });
+  }
+
+  /**
+   * The strand peer book's observation writer (`StartStrandConfig.onStrandPeerIdentified`):
+   * a strand node identified a strand peer at `observation.addrs`, so remember it as an
+   * unsigned entry seen just now. The observer never reports self, and the store binds
+   * every address to the peer id before filing it.
+   */
+  private observeStrandPeer(strandId: string, observation: StrandPeerObservation): void {
+    this.rememberStrandPeer(strandId, {
+      peerId: observation.peerId,
+      addrs: observation.addrs,
+      issuedAt: 0,
+      lastSeenAt: Date.now()
+    }, 'observeStrandPeer');
+  }
+
+  /**
+   * Merge one entry into the peer book. Fire-and-log: the entry is visible
+   * synchronously by the store's contract, and the promise tracks durability only. A
+   * persist failure costs restart survival, never this session's seed — the same trade
+   * {@link retainDialTarget} makes.
+   */
+  private rememberStrandPeer(strandId: string, entry: StrandPeerEntry, caller: string): void {
+    const store = this.strandPeerBookStore;
+    if (!store) {
+      // Unreachable in production: start() builds the store before any strand can
+      // launch or form. Logged rather than thrown, for the same reason as retainDialTarget.
+      log('%s: no strand peer book yet — not remembering %s for strand %s', caller, entry.peerId, strandId);
+      return;
+    }
+    void store.merge(strandId, entry).catch((error: unknown) => {
+      log('%s: persisting strand %s peer %s failed (continuing): %o', caller, strandId, entry.peerId, error);
+    });
+  }
+
   /**
    * Stop a strand on THIS node only: untrack it from hibernation, drop its sApp config,
    * stop the local instance, and emit `strand:stopped`. The shared `Strand` row is left
@@ -5985,7 +6720,9 @@ export class CadreNode implements SAppIdLookup {
    * id in the watcher (`StrandWatcher.suppressStrand`) and drops it from
    * {@link getDiscoveredStrands}, so neither a later poll nor a drain can undo a
    * deliberate stop. Only an explicit {@link addStrand} does, which is the caller
-   * reversing its own decision. Party-wide removal is {@link unpublishStrand}.
+   * reversing its own decision. Party-wide removal is {@link unpublishStrand}. A strand
+   * joined from another party comes back the same way, from its remembered join;
+   * {@link forgetJoinedStrand} is how to leave one for good.
    */
   async stopStrand(strandId: string): Promise<void> {
     if (!this._running) {
@@ -6068,10 +6805,19 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Force wake a hibernating strand
+   * Force wake a hibernating strand. A requested wake is activity, recorded before the
+   * wake starts: a check-in holding the strand — or rebuilding it, a rebuild this wake then
+   * joins — leaves it up instead of re-quiescing it at the end of its window. Once awake the
+   * strand's idle countdown runs, so it hibernates again if nothing uses it.
    */
   async wakeStrand(strandId: string): Promise<void> {
-    await this.hibernationManager.wakeStrand(strandId);
+    const instance = this.strandManager.getInstance(strandId);
+    if (!instance) {
+      log('wakeStrand: strand %s not found; nothing to wake', strandId);
+      return;
+    }
+    instance.lastActivity = new Date();
+    await this.hibernationManager.wakeStrand(instance);
   }
 
   // ============================================================================
@@ -6089,7 +6835,7 @@ export class CadreNode implements SAppIdLookup {
    * Routes through {@link HibernationManager.forceHibernate}, which cancels the
    * strand's pending idle/hibernate (and check-in) timers — so a stale timer
    * can't re-fire on or resurrect the strand — then runs the same `onHibernate`
-   * path as the timer (`quiesceStrand` + `status='hibernating'` +
+   * path as the timer (`quiesceStrand`, which marks it `hibernating`, then
    * `strand:hibernating`). Unlike the timer path it does NOT re-arm check-ins:
    * the strand stays down until the caller drives a wake (e.g. {@link serviceWake}).
    */
@@ -6151,9 +6897,14 @@ export class CadreNode implements SAppIdLookup {
    * strand share one in-flight operation ({@link serviceWakePromises}), and the
    * underlying resume coalesces with a racing push-wake via
    * {@link HibernationManager}'s wake coalescing — one runtime build, one window,
-   * one re-hibernate decision. Returns `{ serviced: false }` (never throws) when
-   * the node is not running or the strand is unknown, and surfaces a resume
-   * failure as `{ serviced: true, hadActivity: false }` after re-hibernating.
+   * one re-hibernate decision. A wake or activity from elsewhere that lands during
+   * the resume or the window leaves the strand up; this call's own wake does not.
+   * Afterwards a strand left up has its idle countdown running, and a re-hibernated one
+   * gets back the check-in chain this call interrupted — it never gains one it lacked,
+   * so a strand the mobile runner force-hibernated stays down until the next push.
+   * Returns `{ serviced: false }` (never throws) when
+   * the node is not running or the strand is unknown, and surfaces a wake or
+   * window failure as `{ serviced: true, hadActivity: false }`.
    *
    * @param strandId - the strand a push said has pending activity.
    * @param opts.windowMs - override the live-window duration (defaults to the
@@ -6189,30 +6940,57 @@ export class CadreNode implements SAppIdLookup {
       return { strandId, serviced: false, hadActivity: false };
     }
 
-    // Already live (active or idle — both retain their runtime): servicing is a
-    // no-op success. Do NOT run a window that would re-hibernate a strand the app
-    // may be actively using, and do NOT rebuild a second runtime.
-    if (instance.libp2pNode || instance.database) {
+    // Already live (active or idle — both retain their runtime) or coming up (a launch,
+    // or a check-in with its own window): servicing is a no-op success. Do NOT run a
+    // window that would re-hibernate a strand the app may be actively using, and do NOT
+    // rebuild a second runtime. `'starting'` counts before any handle is attached. A strand
+    // being quiesced does not count: the wake below rebuilds it after the quiesce.
+    if (!this.strandManager.isQuiescing(strandId)
+      && (instance.status === 'starting' || instance.libp2pNode || instance.database)) {
       log('serviceWake: strand %s already live; no-op success', strandId);
       return { strandId, serviced: true, hadActivity: true };
     }
 
+    // Before the resume, as the check-in takes it (see handleStrandCheckIn).
+    // NOTE: a `wakeStrand` already resuming when this runs stamped its activity before this
+    // mark, so the probe joins it without counting it and the window can re-hibernate a strand
+    // that wake asked to keep up; if foreground wakes and serviceWake overlap in practice, mark
+    // before the joined wake's stamp instead.
+    const activityMark = instance.lastActivity;
+    const windowMs = opts?.windowMs ?? this.config.hibernation?.checkInWindowMs ?? DEFAULT_CHECKIN_WINDOW_MS;
     try {
-      // Coalesced resume: routes through wakeStrand → HibernationManager.beginWake
-      // so a racing push-wake shares this single runtime build.
-      await this.wakeStrand(strandId);
-      const windowMs = opts?.windowMs ?? this.config.hibernation?.checkInWindowMs ?? DEFAULT_CHECKIN_WINDOW_MS;
-      const hadActivity = await this.runWakeWindow(instance, windowMs);
+      return await this.wakeAndHoldForService(instance, activityMark, windowMs);
+    } finally {
+      // After the window (or a failure) decided the state: the idle countdown if the strand
+      // stayed up, else the check-in chain this probe interrupted, if any.
+      this.hibernationManager.endProbe(instance);
+    }
+  }
+
+  /**
+   * The wake and window of {@link runServiceWake}. A failure in either — the network
+   * unreachable inside a Doze grant, say — must not throw out of a background task, so it
+   * reports no activity. Each stage cleans up only what it owns.
+   */
+  private async wakeAndHoldForService(instance: StrandInstance, activityMark: Date, windowMs: number): Promise<ServiceWakeResult> {
+    const { strandId } = instance;
+    try {
+      // Coalesced resume: HibernationManager.beginWake, so a racing push-wake shares this
+      // single runtime build. Not through `wakeStrand`, which records the wake as activity:
+      // this probe's own wake must not count as a reason to stay up.
+      await this.hibernationManager.probeWake(instance);
+    } catch (error) {
+      // handleStrandWake has already re-hibernated a failed rebuild, and left alone a strand
+      // it failed before building, which may be a check-in's.
+      log('serviceWake: wake of strand %s failed: %o', strandId, error);
+      return { strandId, serviced: true, hadActivity: false };
+    }
+    try {
+      const hadActivity = await this.runWakeWindow(instance, activityMark, windowMs);
       return { strandId, serviced: true, hadActivity };
     } catch (error) {
-      // Resume failing mid-window (network unreachable inside a Doze grant, etc.)
-      // must not throw out of a background task: re-hibernate and report no
-      // activity, mirroring handleStrandCheckIn's re-hibernate-on-error.
       log('serviceWake: strand %s failed during wake window; re-hibernating: %o', strandId, error);
-      await this.strandManager.quiesceStrand(strandId).catch((cleanupErr) => {
-        log('serviceWake cleanup quiesce for strand %s failed: %o', strandId, cleanupErr);
-      });
-      instance.status = 'hibernating';
+      await this.rehibernateAfterFailedResume(instance, 'serviceWake');
       return { strandId, serviced: true, hadActivity: false };
     }
   }
@@ -6247,8 +7025,8 @@ export class CadreNode implements SAppIdLookup {
    *
    * BUDGET: the supervisor's first attempt is what `start()` waits on — deliberately the drive's
    * ordinary deadline rather than a boot-specific one. That deadline is now COUNTED, four link
-   * round trips at the declared `network.linkRoundTripMs` (14 s at its default, where it was a
-   * fixed 10 s): a healthy dial-plus-reserve is sub-second even over a WAN, so this is slack for
+   * round trips at the declared `network.linkRoundTripMs` plus the relay's two admission
+   * decisions (18 s at its default, where it was a fixed 10 s): a healthy dial-plus-reserve is sub-second even over a WAN, so this is slack for
    * a slow link, while going much longer would make a dead relay indistinguishable from a hung
    * start and much shorter would fail nodes on links that were merely slow. A host that declares
    * a slower link lengthens it without touching this path — `link-budget.ts`. The retries carry
@@ -6404,7 +7182,7 @@ export class CadreNode implements SAppIdLookup {
    *
    * @param ownerPrivateKey - The owner's private key (base64url encoded)
    */
-  initializeSeedBootstrap(ownerPrivateKey: string): void {
+  async initializeSeedBootstrap(ownerPrivateKey: string): Promise<void> {
     if (!this.controlNode || !this.controlDatabase) {
       throw new Error('CadreNode must be started before initializing seed bootstrap');
     }
@@ -6430,20 +7208,16 @@ export class CadreNode implements SAppIdLookup {
         .catch((error) => log('Trusted-owner genesis anchor persist failed: %o', error));
     }
 
-    this.seedBootstrapService = new SeedBootstrapService({
+    await this.installSeedBootstrapService(new SeedBootstrapService({
       partyId: this.config.controlNetwork.partyId,
       ownerPrivateKey,
       inviteAddressResolver: () => this.resolveInviteAddresses(),
-      dialBudget: this.controlDialBudget(),
+      ...this.seedServiceBudgets(),
       trustPolicy: this.config.seedTrustPolicy,
       // Seed trust anchors on the node-local store (seeded just above with this
       // node's own genesis key), never on the replicated OwnerKey table.
       ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
-    });
-
-    this.seedBootstrapService.setEventCallbacks(this.seedEventCallbacks());
-
-    this.seedBootstrapService.initialize(this.controlNode, this.controlDatabase);
+    }), this.controlNode, this.controlDatabase);
     log('Seed bootstrap service initialized');
   }
 
@@ -6648,7 +7422,8 @@ export class CadreNode implements SAppIdLookup {
    * is reachable through its circuit-relay address), dials `WAKE_PROTOCOL`, sends
    * the {@link WakeRequest}, and returns the peer's {@link WakeAck}. The receiver
    * gates the request on cadre membership and only resumes a strand it already
-   * participates in.
+   * participates in; it acks once it has decided, before the strand is up. The
+   * dial deadlines derive from this node's `network.linkRoundTripMs`.
    *
    * @param targetPeerId - The hibernating cadre peer to wake.
    * @param strandId - The strand the caller knows has pending activity.
@@ -6664,7 +7439,7 @@ export class CadreNode implements SAppIdLookup {
       throw new Error(`No dialable control-network address for peer ${targetPeerId}`);
     }
     const request: WakeRequest = { strandId, reason };
-    return await dialWake(this.controlNode, addrs, request);
+    return await dialWake(this.controlNode, addrs, request, { linkRoundTripMs: this.config.network?.linkRoundTripMs });
   }
 
   /**
@@ -6672,7 +7447,7 @@ export class CadreNode implements SAppIdLookup {
    * This is for drone nodes that need to receive seeds without being an owner.
    * Does not require an owner key.
    */
-  enableSeedListener(): void {
+  async enableSeedListener(): Promise<void> {
     if (!this.controlNode || !this.controlDatabase) {
       throw new Error('CadreNode must be started before enabling seed listener');
     }
@@ -6683,21 +7458,17 @@ export class CadreNode implements SAppIdLookup {
       return;
     }
 
-    this.seedBootstrapService = new SeedBootstrapService({
+    await this.installSeedBootstrapService(new SeedBootstrapService({
       partyId: this.config.controlNetwork.partyId,
       // No owner key - this node only receives seeds
       inviteAddressResolver: () => this.resolveInviteAddresses(),
-      dialBudget: this.controlDialBudget(),
+      ...this.seedServiceBudgets(),
       trustPolicy: this.config.seedTrustPolicy,
       // A listener-only node accepts a wire-delivered seed solely against this
       // anchor (there is no per-call override on the inbound handler): with no
       // genesis/invite/operator pin it authorizes nobody, which is the point.
       ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
-    });
-
-    this.seedBootstrapService.setEventCallbacks(this.seedEventCallbacks());
-
-    this.seedBootstrapService.initialize(this.controlNode, this.controlDatabase);
+    }), this.controlNode, this.controlDatabase);
     log('Seed listener enabled');
   }
 
@@ -6708,6 +7479,33 @@ export class CadreNode implements SAppIdLookup {
     return this.seedBootstrapService;
   }
 
+  /**
+   * Make `service` this node's seed service and register its inbound seed handler.
+   * The field is set before the registration is awaited, so a concurrent
+   * {@link enableSeedListener} finds it and does not register a second handler; a
+   * failed registration puts the previous service back and rethrows.
+   *
+   * NOTE: libp2p's registrar stores the handler before its peer-store merge, so a
+   * failed merge leaves SEED_PROTOCOL registered with no service owning it and a retry
+   * here rejects as a duplicate; if peer-store writes can fail in practice, unhandle on
+   * a non-duplicate failure (never on a duplicate — that handler belongs to someone else).
+   */
+  private async installSeedBootstrapService(
+    service: SeedBootstrapService,
+    controlNode: Libp2p,
+    controlDatabase: ControlDatabase
+  ): Promise<void> {
+    service.setEventCallbacks(this.seedEventCallbacks());
+    const previous = this.seedBootstrapService;
+    this.seedBootstrapService = service;
+    try {
+      await service.initialize(controlNode, controlDatabase);
+    } catch (error) {
+      if (this.seedBootstrapService === service) this.seedBootstrapService = previous;
+      throw error;
+    }
+  }
+
   /**
    * The event callbacks every {@link SeedBootstrapService} this node owns is
    * wired with — shared by the owner-capable service ({@link initializeSeedBootstrap})
@@ -6930,7 +7728,7 @@ export class CadreNode implements SAppIdLookup {
       const tempService = new SeedBootstrapService({
         partyId: seed.partyId,
         trustPolicy: this.config.seedTrustPolicy,
-        dialBudget: this.controlDialBudget(),
+        ...this.seedServiceBudgets(),
         // The anchor is node-scoped, not service-scoped: a throwaway service
         // must consult (and persist an accepted signer into) the SAME store the
         // persistent one would, or a cold-start enrollment via this path would
@@ -6938,7 +7736,7 @@ export class CadreNode implements SAppIdLookup {
         ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
       });
       if (this.controlNode && this.controlDatabase) {
-        tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
+        await tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
       }
       const tempResult = await tempService.applySeed(seed, options);
       this.noteAppliedSeed(tempResult, seed);
@@ -7125,10 +7923,10 @@ export class CadreNode implements SAppIdLookup {
       const tempService = new SeedBootstrapService({
         partyId: invite.partyId,
         trustPolicy: this.config.seedTrustPolicy,
-        dialBudget: this.controlDialBudget(),
+        ...this.seedServiceBudgets(),
       });
       if (this.controlNode && this.controlDatabase) {
-        tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
+        await tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
       }
       await tempService.dialInvite(invite);
       return;
@@ -7146,15 +7944,21 @@ export class CadreNode implements SAppIdLookup {
    *
    * @param options - Configuration for the solicitation service
    */
-  initializeStrandSolicitation(options?: StrandSolicitationServiceOptions): void {
+  async initializeStrandSolicitation(options?: StrandSolicitationServiceOptions): Promise<void> {
     if (!this.controlNode) {
       throw new Error('CadreNode must be started before initializing strand solicitation');
     }
 
-    this.strandSolicitationService = new StrandSolicitationService({
+    const service = new StrandSolicitationService({
       ...options,
       partyId: this.config.controlNetwork.partyId,
       cadrePeerAddrs: this.getMultiaddrs(),
+      // Every formation deadline derives from this node's declared link, like every other
+      // dial budget here; a caller's own declaration on the formation config still wins.
+      formationConfig: {
+        linkRoundTripMs: this.config.network?.linkRoundTripMs,
+        ...options?.formationConfig
+      },
       // Overrides any caller-supplied hook, exactly like partyId/cadrePeerAddrs: only
       // this node can say which strand-network addresses it is actually listening on,
       // and a wrong answer here seeds a joiner's mesh with addresses that reach nobody.
@@ -7162,11 +7966,23 @@ export class CadreNode implements SAppIdLookup {
       // Overridden on the same grounds: only this node holds the running strand
       // instance's database and this party's `StrandPartyKey` identity, and a wrong
       // issuer here would admit joiners under someone else's authority.
-      issueMembershipInvite: (strandId: string) => this.issueStrandMembershipInvite(strandId)
+      issueMembershipInvite: (strandId: string, signal?: AbortSignal) =>
+        this.issueStrandMembershipInvite(strandId, signal)
     });
 
-    // Register as responder on the control node
-    this.strandSolicitationService.registerResponder(this.controlNode);
+    // Set before the registration is awaited, so a concurrent createOpenInvitation /
+    // formStrand uses this service instead of building a second one whose handler
+    // would collide; a failed registration puts the previous service back.
+    // NOTE: same stray-handler caveat as installSeedBootstrapService — a failed
+    // peer-store merge leaves the formation handler registered, so a retry is a duplicate.
+    const previous = this.strandSolicitationService;
+    this.strandSolicitationService = service;
+    try {
+      await service.registerResponder(this.controlNode);
+    } catch (error) {
+      if (this.strandSolicitationService === service) this.strandSolicitationService = previous;
+      throw error;
+    }
     log('Strand solicitation service initialized');
   }
 
@@ -7190,7 +8006,7 @@ export class CadreNode implements SAppIdLookup {
   ): Promise<OpenInvitation> {
     if (!this.strandSolicitationService) {
       // Create a temporary service for creating invitations
-      this.initializeStrandSolicitation();
+      await this.initializeStrandSolicitation();
     }
 
     const bootstrap = this.getMultiaddrs();
@@ -7221,7 +8037,7 @@ export class CadreNode implements SAppIdLookup {
     }
 
     if (!this.strandSolicitationService) {
-      this.initializeStrandSolicitation();
+      await this.initializeStrandSolicitation();
     }
 
     const result = await this.strandSolicitationService!.formStrand(
@@ -7229,7 +8045,7 @@ export class CadreNode implements SAppIdLookup {
       disclosure,
       this.controlNode
     );
-    this.recordCrossPartyStrandAddrs(result.strandId, result.strandAddrs);
+    this.recordFormationStrandPeers(result.strandId, result.strandAddrs);
     // A closed host strand's approval carries the joiner's own membership invitation —
     // persist this party's identity key and stage the invitation for bring-up to redeem.
     // Runs AFTER the addr recording so a persistence failure (which throws — see the
@@ -7237,9 +8053,40 @@ export class CadreNode implements SAppIdLookup {
     if (result.membershipInvite) {
       await this.adoptFormationMembershipInvite(result.strandId, result.membershipInvite);
     }
+    await this.rememberFormedStrand(result);
     return result;
   }
 
+  /**
+   * Remember the strand a formation just joined (see {@link joinedStrandStore}), so it
+   * is re-offered after a restart even when the app is killed before its `addStrand`, and
+   * published party-wide by the next connected owner reconcile pass. A re-join also
+   * cancels a party-wide removal a self-revocation queued for the strand.
+   * Last in {@link formStrand}, after the membership adoption, so a failure here leaves
+   * the party key and staged invitation in place for the re-formation it asks for.
+   *
+   * Throws on failure, like {@link adoptFormationMembershipInvite}: the formation's
+   * token is spent, and a join no store names would vanish at the next restart.
+   */
+  private async rememberFormedStrand(result: FormStrandResult): Promise<void> {
+    try {
+      await this.joinedStrands!.remember({
+        Id: result.strandId,
+        Type: result.memberPrivateKey ? 'c' : 'o',
+        MemberPrivateKey: result.memberPrivateKey ?? null,
+        joinedAt: Date.now()
+      });
+    } catch (error) {
+      throw new Error(
+        `Formation for strand ${result.strandId} was approved (its one-time token is spent), but ` +
+        'remembering the join in this node\'s joined-strand store failed, so the strand would not ' +
+        'come back after a restart. Fix the store (usually the configured keyStore), then redeem a ' +
+        'fresh invitation.',
+        { cause: error }
+      );
+    }
+  }
+
   /**
    * Adopt an approved closed-strand formation's membership half on the JOINER:
    *
@@ -7322,9 +8169,15 @@ export class CadreNode implements SAppIdLookup {
    *   founder's publish/launch paths mint it, so this is a not-yet-converged sibling.)
    *   The manager maps the throw to a clean retryable rejection BEFORE the formation
    *   token is spent.
-   * - Closed host strand with no running local instance/database → throw, same mapping:
-   *   a joiner admitted without an invitation would look joined and never become a
-   *   member, and a responder not running the strand cannot serve its sync anyway.
+   * - Closed host strand whose runtime is HIBERNATING or being quiesced → woken first
+   *   ({@link wakeHostStrandForFormation}, bounded by `signal`), then issued as below. In
+   *   every state the redemption counts as activity, so the host stays up for the
+   *   joiner's first sync.
+   * - Closed host strand with no running local instance/database (never launched, still
+   *   starting, or a hibernating one whose wake failed or outran `signal`) →
+   *   throw, same mapping: a joiner admitted without an invitation would look joined and
+   *   never become a member, and a responder not running the strand cannot serve its sync
+   *   anyway.
    * - Closed host strand whose LIVE rows carry the pre-split fingerprint
    *   (`assertNotPreSplitStrand`) → throw `PreSplitStrandIdentityError`, same mapping as
    *   the recorded refusal. Covers the responders that never ran a refused founder launch:
@@ -7334,7 +8187,12 @@ export class CadreNode implements SAppIdLookup {
    * permanent diagnosis. Identity is checked BEFORE the runtime: it is the cheaper read
    * and the more actionable diagnosis when both are missing (a missing runtime is
    * transient, a missing identity is not), and it keeps the branch reachable without
-   * standing a strand runtime up.
+   * standing a strand runtime up. For the same reason every control-database check runs
+   * before a wake: a strand that cannot issue anyway is not woken.
+   *
+   * `signal` is the formation's provisioning budget. Once it has aborted nothing is
+   * issued — the joiner has already been told to retry, and an invitation written now
+   * would only sit in the strand until it expires.
    *
    * The invitation expires `MEMBERSHIP_INVITE_TTL_MS` from now — see that constant for
    * the slow-joiner / lost-result tradeoff.
@@ -7349,7 +8207,10 @@ export class CadreNode implements SAppIdLookup {
    * `MEMBERSHIP_INVITE_UNAVAILABLE_REASON` forever; that flow needs manager delegation,
    * not a retry.
    */
-  private async issueStrandMembershipInvite(strandId: string): Promise<StrandMembershipInvite | null> {
+  private async issueStrandMembershipInvite(
+    strandId: string,
+    signal?: AbortSignal
+  ): Promise<StrandMembershipInvite | null> {
     if (!this.controlDatabase) {
       throw new Error(`Cannot issue a membership invitation for strand ${strandId}: control database unavailable`);
     }
@@ -7373,16 +8234,23 @@ export class CadreNode implements SAppIdLookup {
         'no StrandPartyKey row for it (identity not yet converged from the machine that published it)'
       );
     }
+    await this.wakeHostStrandForFormation(strandId, signal);
     const db = this.strandManager.getInstance(strandId)?.database?.getDatabase();
     if (!db) {
       throw new Error(
         `Cannot issue a membership invitation for closed strand ${strandId}: its runtime is ` +
-        'not live on this responder (not launched, hibernating, or quiescing)'
+        'not live on this responder (not launched, or still starting)'
       );
     }
     if (row.MemberPrivateKey) {
       await assertNotPreSplitStrand(db, strandId, strandMemberKeyPair(row.MemberPrivateKey).publicKeyB64);
     }
+    if (signal?.aborted) {
+      throw new Error(
+        `Cannot issue a membership invitation for closed strand ${strandId}: the formation ` +
+        'provisioning budget expired before issuance'
+      );
+    }
     return await issueInvite(db, {
       managerKeyPair: strandMemberKeyPair(partyKey),
       expiration: Date.now() + MEMBERSHIP_INVITE_TTL_MS
@@ -7390,36 +8258,86 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Remember the responder's strand-network addresses for a strand this node just
-   * formed, so the strand's discovery seed has something to work with when the app
-   * launches it (see {@link crossPartyStrandAddrs}).
+   * Count a bound closed-strand redemption as activity on the host strand, and wake the
+   * strand when it is HIBERNATING or being quiesced (its database is closing) so the
+   * membership invitation can be issued. Only reached after the formation manager has
+   * authorized the redemption (token, disclosure, outside approval, seat pre-check), so only
+   * a caller already entitled to the strand's member key can cause a wake. No other state is
+   * woken — never launched or still starting is not something this node recovers from on
+   * demand; the caller's live-database check refuses those.
+   *
+   * The activity is recorded in every state, through the hibernation manager rather than
+   * {@link recordStrandActivity}, whose push fan-out would wake this party's phones for
+   * nothing. It keeps the host up for the joiner's first sync: a live strand's idle timer
+   * restarts, a check-in window that happens to have the strand live sees activity and
+   * leaves it up instead of re-quiescing it, and a hibernating strand has its idle →
+   * hibernate timers re-armed once the wake leaves it `active`. The explicit
+   * {@link wakeStrand} coalesces onto the wake `recordActivity` began, and still wakes when
+   * `recordActivity` is a no-op (hibernation disabled but the strand force-hibernated, or
+   * the manager stopped).
    *
-   * Scoped strictly to `strandId`: these addresses reach ONE strand node of ONE other
-   * party and must never seed another strand's mesh or the control peerStore. An empty
-   * list is recorded as no entry at all rather than an empty one, so a later formation
-   * against the same strand that DOES disclose addresses is not shadowed.
+   * Bounded by `signal` (the formation's provisioning budget): when it aborts first this
+   * throws — a retryable rejection, token unspent — and leaves the wake running, so the
+   * joiner's retry finds the strand live.
    */
-  private recordCrossPartyStrandAddrs(strandId: string, strandAddrs: readonly string[]): void {
+  private async wakeHostStrandForFormation(strandId: string, signal?: AbortSignal): Promise<void> {
+    const instance = this.strandManager.getInstance(strandId);
+    if (!instance) {
+      return;
+    }
+    this.hibernationManager.recordActivity(instance);
+    if (!this.strandManager.isQuiescing(strandId) && (instance.status !== 'hibernating' || instance.database)) {
+      return;
+    }
+    log('wakeHostStrandForFormation: waking host strand %s (%s) for an authorized formation', strandId, instance.status);
+    const wake = this.wakeStrand(strandId);
+    if (await resolvesBeforeAbort(wake, signal)) {
+      return;
+    }
+    void wake.catch((error: unknown) =>
+      log('wakeHostStrandForFormation: background wake of host strand %s failed: %o', strandId, error));
+    throw new Error(
+      `Cannot issue a membership invitation for closed strand ${strandId}: its hibernating ` +
+      'runtime did not wake within the formation provisioning budget (still waking)'
+    );
+  }
+
+  /**
+   * Remember the responder's strand-network addresses for a strand this node just
+   * formed in the strand peer book (see {@link strandPeerBookStore}), so the strand's
+   * discovery seed has something to work with when the app launches it — and again
+   * after every restart.
+   *
+   * The carried list is peer-agnostic (`sanitizeStrandAddrs` bounds and parses it,
+   * nothing more), so it is attributed per peer here (`groupAddrsByPeerId`, the same
+   * rule the address-book merge applies) and each peer becomes one unsigned entry seen
+   * just now: the responder disclosed the addresses live a moment ago. An entry naming
+   * no destination peer is dropped there. Scoped strictly to `strandId`: these
+   * addresses reach ONE strand node of ONE other party and must never seed another
+   * strand's mesh or the control peerStore. An empty list records nothing, so a later
+   * formation against the same strand that DOES disclose addresses is not shadowed.
+   */
+  private recordFormationStrandPeers(strandId: string, strandAddrs: readonly string[]): void {
     if (strandAddrs.length === 0) {
       log('formStrand: responder disclosed no strand addrs for %s — cross-party seed stays empty', strandId);
       return;
     }
-    // Capped at the same `MAX_STRAND_ADDRS` one arriving list is, because this
-    // ACCUMULATES: re-forming against the same strand (the documented recovery for a
-    // responder whose relay reservation rotated) unions a fresh list onto the old one,
-    // and nothing here can tell a dead entry from a live one. Without the cap, the seed
-    // — and the peerStore rows every refresh pass re-merges from it — would grow by up
-    // to 16 entries per redemption for the node's lifetime. Oldest entries fall off the
-    // end, which is the right end to lose: `unionAddrs` keeps the freshest list first.
-    const merged = unionAddrs(strandAddrs, this.crossPartyStrandAddrs.get(strandId) ?? [])
-      .slice(0, MAX_STRAND_ADDRS);
-    this.crossPartyStrandAddrs.set(strandId, merged);
-    // A strand already running when this lands (a re-formation) would otherwise wait out
-    // the rest of its ~10-minute refresh throttle before the new addresses reached its
-    // address book. Clearing the stamp makes the next 15 s reconcile tick merge them,
-    // which matters precisely because re-forming is the recovery path for a dead entry.
-    this.strandPeerAddrRefreshAt.delete(strandId);
-    log('formStrand: recorded %d cross-party strand addr(s) for %s', merged.length, strandId);
+    const now = Date.now();
+    let peers = 0;
+    for (const [peerId, addrs] of groupAddrsByPeerId([...strandAddrs])) {
+      this.rememberStrandPeer(strandId, {
+        peerId,
+        addrs: addrs.map((ma) => ma.toString()),
+        issuedAt: 0,
+        lastSeenAt: now
+      }, 'formStrand');
+      peers++;
+    }
+    // A strand already running when this lands (a re-formation) needs nothing more: the
+    // refresh pass merges the book into its address book on every reconcile tick, so the
+    // new addresses land within 15 s — which matters because re-forming is the recovery
+    // path for a dead entry.
+    log('formStrand: recorded %d cross-party strand addr(s) for %s under %d peer(s)', strandAddrs.length, strandId, peers);
   }
 
   /**