@serfab/cadre-core 1.7.0 → 1.9.0

package/dist/cadre-node.js

@@ -11,16 +11,17 @@ import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519Pu
 import { strandTransportKey } from './strand-transport-key.js';
 import { assertScopeKeyCharset, assertStrandScopeKey, controlStorageScope, InvalidStrandIdError, isValidStrandScopeKey } from './storage-scope.js';
 import { generateStrandMemberKey, strandMemberKeyPair } from './strand-member-key.js';
-import { assertNotPreSplitStrand, issueInvite, PreSplitStrandIdentityError } from './strand-membership-writer.js';
+import { assertNotPreSplitStrand, issueInvite, PreSplitStrandIdentityError, readStrandHeaderSAppId } from './strand-membership-writer.js';
 import { MEMBERSHIP_INVITE_TTL_MS } from './strand-formation-manager.js';
 import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore } from './trusted-owner-store.js';
 import { MemoryBootstrapPeerStore } from './bootstrap-peer-store.js';
-import { MemoryStrandPeerBookStore } from './strand-peer-book.js';
+import { MemoryStrandNetworkStateStore } from './strand-network-state.js';
 import { MemoryEnrolledMachineStore } from './enrolled-machine-store.js';
-import { JoinedStrandRows, KeyStoreJoinedStrandStore, MemoryJoinedStrandStore } from './joined-strand-store.js';
+import { JoinedStrandSession, KeyStoreJoinedStrandStore, MemoryJoinedStrandStore } from './joined-strand-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId } from './peer-addr-book.js';
+import { strandFretPeerAddrs } from './strand-fret-addrs.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
 import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, trailingPeerId, withTrailingPeerId, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
@@ -30,8 +31,8 @@ import { StrandInstanceManager, liveStrandStatus } from './strand-instance-manag
 import { PeerJoinBackfill } from './peer-join-backfill.js';
 import { deriveCohortMembers } from './strand-cohort.js';
 import { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
-import { dialPeerAddrs, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS } from './peer-dial.js';
-import { connectionManagerTimeouts, peerJoinPushBudget, relayReservationBudgetMs, relayedDialBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
+import { dialPeerAddrs, SelfRelayOnlyError, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS } from './peer-dial.js';
+import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, peerJoinPushBudget, relayAdmissionReserveDeadlineMs, relayReservationBudgetMs, relayedDialBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager } from './hibernation-manager.js';
 import { ControlDatabase, isStrandIdConflict } from './control-database.js';
@@ -40,8 +41,9 @@ import { StrandSolicitationService } from './strand-solicitation.js';
 import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS, UnauthorizedReservationBudget } from './membership-connection-gater.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs } from './strand-addr-protocol.js';
-import { DelegateAdmissionStore, extractCircuitRelayTargets, dueRelayAnnounces, pruneStoppedStrandAnnounces, peerStrandKey } from './delegate-admission.js';
+import { DelegateAdmissionStore, extractCircuitRelayTargets, dueRelayAnnounces, prunePeerStrandKeys, peerStrandKey } from './delegate-admission.js';
 import { relayCircuitAddrs, resolveListenAddrs, resolveTransportOptions, RelayReservationFailedError } from './relay-addrs.js';
+import { resolveRelayServer } from './relay-server.js';
 import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import { superviseRelayReservation, resolveRelayReservationState } from './relay-reservation.js';
 import { PushFanoutService } from './push-fanout.js';
@@ -57,10 +59,10 @@ const timing = debug('sereus:cadre:timing');
  */
 const TURN_CONSUME_WINDOW_MS = 1000;
 /**
- * How often a running strand re-resolves its siblings' strand-network addresses
- * and re-merges them into its own libp2p address book
- * ({@link CadreNode.refreshStrandPeerAddrs}). Overridable per node via
- * `network.controlCohort.strandAddrRefreshMs`.
+ * How often a running strand re-asks each connected sibling that last ANSWERED
+ * (even with nothing) for its strand-network addresses, and re-merges them into
+ * its own libp2p address book ({@link CadreNode.refreshStrandPeerAddrs}).
+ * Overridable per node via `network.controlCohort.strandAddrRefreshMs`.
  *
  * Ten minutes sits comfortably inside the peerStore's one-hour address expiry
  * (`MAX_ADDRESS_AGE`, see `peer-addr-book.ts`) with headroom for several missed
@@ -68,6 +70,16 @@ const TURN_CONSUME_WINDOW_MS = 1000;
  * strand-addr RPC fan-out stays cheap.
  */
 export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
+/**
+ * How soon {@link CadreNode.refreshStrandPeerAddrs} re-asks a sibling that did NOT
+ * answer — unreachable, `unavailable`, or `refused`. A refusal matters most: a
+ * phone asking before its `CadrePeer` row has replicated to the sibling is refused
+ * and its delegate grant goes unrecorded, and waiting the full
+ * {@link STRAND_PEER_ADDR_REFRESH_MS} for the next try is the delay this bounds.
+ * Four reconcile ticks, so a sibling that keeps failing costs one timed-out RPC a
+ * minute rather than one a tick.
+ */
+export const STRAND_PEER_ADDR_RETRY_MS = 60 * 1000;
 /**
  * A circuit relay as a strand-addr RPC target: dialed by peerId, with its
  * direct addr riding along as the fallback for a relay we hold no connection to.
@@ -75,12 +87,20 @@ export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
 function relayStrandAddrPeer(relay) {
     return { peerId: relay.relayPeerId, addrs: [multiaddr(relay.relayAddr)] };
 }
+/**
+ * Whether a sibling actually answered a strand-addr RPC — with addresses or
+ * without — as opposed to being unreachable, unavailable, or refusing us. Decides
+ * which of the refresh and retry intervals it waits before the next ask.
+ */
+function siblingAnswered(outcome) {
+    return outcome === 'answered' || outcome === 'empty';
+}
 /**
  * `primary` followed by the entries of `extra` it does not already contain, de-duplicated
  * and order-preserving.
  *
- * Used wherever a strand's discovery seed unions two sources of address strings — the
- * freshly-RPC'd sibling answers and the strand peer book's last-known addresses. The
+ * Used where a strand's discovery seed unions two sources of address strings — the
+ * freshly-RPC'd sibling answers and the addresses the strand's formation carried. The
  * caller passes the FRESHER source as `primary`, so a stale entry can only ever be
  * appended, never promoted ahead of a current one, and each source keeps whatever
  * signaling-first ordering it arrived with.
@@ -169,6 +189,34 @@ function requireMatchingStrandRow(live, desired, situation) {
     }
     return live;
 }
+/**
+ * Await `work` unless `signal` aborts first: `true` once `work` resolves, `false` when the
+ * signal aborted before it did (already at the call, or during the wait). A rejection of
+ * `work` that lands before the abort propagates. `work` is NOT cancelled — a caller that
+ * gets `false` owns its late settlement. The abort listener is detached on both endings, so
+ * a long-lived signal does not collect listeners.
+ */
+async function resolvesBeforeAbort(work, signal) {
+    if (!signal) {
+        await work;
+        return true;
+    }
+    if (signal.aborted) {
+        return false;
+    }
+    let detach = () => { };
+    const abortedFirst = new Promise((resolve) => {
+        const onAbort = () => resolve(false);
+        signal.addEventListener('abort', onAbort, { once: true });
+        detach = () => signal.removeEventListener('abort', onAbort);
+    });
+    try {
+        return await Promise.race([work.then(() => true), abortedFirst]);
+    }
+    finally {
+        detach();
+    }
+}
 /**
  * CadreNode is the main entry point for a cadre member.
  * It manages:
@@ -289,6 +337,19 @@ export class CadreNode {
          * {@link getDiscoveredStrands}.
          */
         this.discoveredStrands = new Map();
+        /**
+         * The sApp id each storage replica read from its own `Strand.Header` — {@link getSAppId}'s
+         * answer for a strand no local config claims, so an `sAppId` strand filter can reject a
+         * replica of some other app instead of admitting it provisionally forever.
+         *
+         * Cleared by {@link cleanup} only, deliberately NOT by {@link detachStrand}: the watcher's
+         * filter rejection stops a replica through that very method, and forgetting the id there
+         * would have the next poll find it unknown again, re-admit the strand provisionally and
+         * relaunch the replica — once every other poll, forever. A strand id's sApp never changes,
+         * and the map is bounded by the strands this party has published, like
+         * {@link discoveredStrands}.
+         */
+        this.replicaSAppIds = new Map();
         /**
          * Most-recently pushed invite addresses (see {@link setInviteAddresses}).
          * When non-null these take priority over `libp2pNode.getMultiaddrs()` when
@@ -365,46 +426,67 @@ export class CadreNode {
          */
         this.delegateAnnounceAt = new Map();
         /**
-         * When each running strand last had its siblings' strand addresses re-resolved
-         * into its own address book, keyed by strandId. Throttles
-         * {@link refreshStrandPeerAddrs} to once per {@link STRAND_PEER_ADDR_REFRESH_MS}
-         * per strand so the 15 s reconcile tick never becomes per-tick RPC chatter.
-         * Entries for strands that are no longer running are pruned on each pass, so a
-         * hibernated-then-resumed strand refreshes immediately rather than inheriting a
-         * stale stamp.
+         * When each connected sibling is next due a strand-addr RPC for each running
+         * strand, keyed `peerStrandKey(siblingControlPeerId, strandId)` → epoch ms; a
+         * missing key is due. Bounds {@link refreshStrandPeerAddrs}'s fan-out per
+         * (sibling, strand) rather than per strand, so a sibling that connects after a
+         * pass is asked on the next 15 s tick instead of waiting out a stamp another
+         * sibling's answer set. An answer (even an empty one) makes the sibling due again
+         * in {@link STRAND_PEER_ADDR_REFRESH_MS}; no answer, in
+         * {@link STRAND_PEER_ADDR_RETRY_MS}. Keys whose strand stopped running or whose
+         * sibling is no longer connected are pruned every pass, so a resumed strand and a
+         * reconnected sibling are both asked at once.
          */
-        this.strandPeerAddrRefreshAt = new Map();
+        this.strandAddrAskDueAt = new Map();
         /**
-         * Node-local strand peer book (see `strand-peer-book.ts`): per strand, the strand
-         * peers this node has met and their last-known strand-network addresses. Three
-         * writers: {@link recordFormationStrandPeers} files the responder's live strand
-         * addrs a formation result carried back (`FormationResultMessage.strandAddrs`),
-         * {@link observeStrandPeer} files every strand peer a running strand node
-         * identifies, and the per-strand book swap (`strand-peer-book-swap.ts`, handed the
-         * store as `StartStrandConfig.strandPeerBook`) files the node's own signed entry
-         * plus every signed entry a strand peer sends it — the only writer whose entries
-         * carry a signature, and the only one that can refresh a peer's addresses without
-         * meeting that peer. Read by {@link resolveCohortSeed} (launch + hibernation resume) and
-         * re-merged by every {@link refreshStrandPeerAddrs} pass, which is what keeps the
-         * entries alive past the peerStore's one-hour address expiry.
+         * The strand-network addresses a formation carried back
+         * (`FormationResultMessage.strandAddrs`), by strand id: the responder's live strand
+         * node addresses, kept so the strand's first attach has something to dial. Written by
+         * {@link recordFormationStrandAddrs}, read by {@link resolveCohortSeed} (launch and
+         * hibernation resume) and by every refresh pass for the peers the strand node's FRET
+         * table holds no record for yet ({@link remergeUnrecordedFormationAddrs}).
          *
-         * This is the ONLY cross-party discovery input there is. The strand-addr RPC that
+         * This is the only cross-party input a FIRST attach has. The strand-addr RPC that
          * resolves a strand's addresses is membership-gated and answers own-party siblings
-         * only, so without the book a joiner's cohort seed for a two-party strand is empty
-         * and the mesh never forms — and, with an in-memory book, never RE-forms after a
-         * restart (gotchoices/sereus#18). A STORE rather than a map so an embedder can make
-         * it outlive the process; constructed (or adopted from `config.strandPeers.store`)
-         * by {@link initializeStrandPeerBookStore} during {@link start}, deliberately NOT
+         * only, so without it a joiner's seed for a two-party strand is empty and the mesh
+         * never forms. Every later launch has the strand node's saved network state as well
+         * ({@link strandNetworkStateStore}), which is what a restart re-finds the other party
+         * from (gotchoices/sereus#18).
+         *
+         * A re-formation replaces the strand's list. An entry survives a {@link stopStrand}
+         * and a stop()→start() of this node instance ({@link cleanup} leaves the map alone),
+         * and is dropped where the saved network state is: {@link unpublishStrand},
+         * {@link forgetJoinedStrand} and self-revocation.
+         *
+         * NOTE: accepted tradeoff — in memory only, so a process restart between `formStrand`
+         * and the strand's first launch loses the carried addresses, and the strand then
+         * launches with no cross-party seed until it is re-formed. Persisting the list on the
+         * joined-strand record was weighed and declined: it mixes address state into the join
+         * record, and needs an "only until the first run" rule to stop dead addresses being
+         * dialled on every launch. Every embedder launches straight after forming, and once
+         * the strand has run the saved network state covers every later restart. Revisit if an
+         * embedder forms and launches in separate sessions.
+         */
+        this.formationStrandAddrs = new Map();
+        /**
+         * Node-local strand network state (see `strand-network-state.ts`): per strand, the
+         * state db-p2p saves for the strand's libp2p node — its FRET routing table with each
+         * peer's signed address record. Handed to every strand launch as
+         * `StartStrandConfig.networkState`; the strand node saves into it on every connection
+         * and re-imports it when it is next built, which is what gives a restarted strand
+         * node addresses for the peers it was talking to.
+         *
+         * Constructed (or adopted from `config.strandNetworkState.store`) by
+         * {@link initializeStrandNetworkStateStore} during {@link start}, deliberately NOT
          * cleared by {@link cleanup}, so it survives a stop()→start() cycle of the same node
          * instance — same lifecycle as {@link bootstrapPeerStore}.
          *
-         * Entries survive a {@link stopStrand} (a stopped strand may be claimed again with
-         * {@link addStrand}, and is rediscovered on restart) and are forgotten by
-         * {@link unpublishStrand}, {@link forgetJoinedStrand} and self-revocation; the store
-         * ages the rest out after 14 days and caps each strand at 16 peers, so the book is
-         * bounded by time and by the strands this node runs rather than by its history.
+         * A strand's state survives a {@link stopStrand} and a hibernation quiesce, and is
+         * forgotten by {@link unpublishStrand}, {@link forgetJoinedStrand} and
+         * self-revocation. A strand detached because the watcher saw its row gone keeps its
+         * state (`NOTE:` on `PersistentStrandNetworkStateStore`).
          */
-        this.strandPeerBookStore = null;
+        this.strandNetworkStateStore = null;
         /**
          * PENDING strand membership invitations learned at formation, keyed by strandId — the
          * single-use `Strand.Invite` credential a closed-strand formation result carried back
@@ -432,7 +514,7 @@ export class CadreNode {
          * NOTE: entries live for the node's lifetime (one small pair per formed closed
          * strand); the number of keys is bounded only by the strands this node has ever
          * formed, not by time — if a node ever forms strands at scale, evict on
-         * `unpublishStrand` / `forgetJoinedStrand` as the strand peer book does.
+         * `unpublishStrand` / `forgetJoinedStrand` as {@link formationStrandAddrs} is.
          */
         this.pendingMembershipInvites = new Map();
         /**
@@ -504,22 +586,22 @@ export class CadreNode {
          */
         this.enrolledMachineStore = null;
         /**
-         * Node-local record of the strands this node joined from ANOTHER party (see
-         * `joined-strand-store.ts`) — the only thing that names them after a restart, since
-         * this party's control database holds no row for them. Written by {@link formStrand}
-         * and by an {@link addStrand} of a foreign row; forgotten by {@link forgetJoinedStrand}
-         * and on self-revocation. Adopted from `config.joinedStrands.store`, else built over
+         * Node-local record of the strands this node joined from ANOTHER party and has not yet
+         * published party-wide (see `joined-strand-store.ts`). Written by {@link formStrand}
+         * and by an {@link addStrand} of a foreign row; drained once the party-wide
+         * `JoinedStrand` row is visible. Adopted from `config.joinedStrands.store`, else built over
          * `config.keyStore`, else in-memory, by {@link initializeJoinedStrandStore}. Like
          * {@link bootstrapPeerStore} it is deliberately NOT cleared by {@link cleanup}.
          */
         this.joinedStrandStore = null;
         /**
-         * The strand watcher's view of {@link joinedStrandStore}: its records unioned with the
-         * control rows each poll. Per SESSION, unlike the store — rebuilt at every
+         * This session's joined strands: {@link joinedStrandStore} and the party-wide
+         * `JoinedStrand` table, unioned with the control rows each watcher poll, published and
+         * removed by the reconcile pass. Per SESSION, unlike the store — rebuilt at every
          * {@link start}, which is what ends a revoked join's "keep offering until this session
-         * ends" (see `JoinedStrandRows.forgetAfterThisSession`).
+         * ends" (see `JoinedStrandSession.forgetAfterThisSession`).
          */
-        this.joinedStrandRows = null;
+        this.joinedStrands = null;
         /** Initial self-registration timer (see {@link scheduleSelfRegistration}). */
         this.selfRegistrationTimer = null;
         /** TTL heartbeat that re-publishes the self record before it goes stale. */
@@ -644,24 +726,28 @@ export class CadreNode {
         /** `connection:close` listener clearing a peer's TURN flag (teardown in {@link stopRecordRefresh}). */
         this.turnConnectionCloseHandler = null;
         this.config = config;
+        this.hostUnclaimedStrands = config.hostUnclaimedStrands ?? config.profile === 'storage';
         this.strandManager = new StrandInstanceManager();
         this.enrollmentService = new EnrollmentService();
-        this.unauthorizedRelayReservations = new UnauthorizedReservationBudget(config.network?.unauthorizedRelayReservationCap);
+        this.relayServer = resolveRelayServer(config.network, config.profile);
+        this.unauthorizedRelayReservations = new UnauthorizedReservationBudget(config.network?.unauthorizedRelayReservationCap, this.relayServer.init.reservations.reservationTtl);
         // Create hibernation manager with callbacks
         const hibernationCallbacks = {
             onIdle: async (strandId) => this.handleStrandIdle(strandId),
             onHibernate: async (strandId) => this.handleStrandHibernate(strandId),
             onWake: async (strandId) => this.handleStrandWake(strandId),
-            onCheckIn: async (strandId) => this.handleStrandCheckIn(strandId)
+            onCheckIn: async (strandId) => this.handleStrandCheckIn(strandId),
+            isQuiescing: (strandId) => this.strandManager.isQuiescing(strandId)
         };
         this.hibernationManager = new HibernationManager(config.hibernation ?? { enabled: false }, hibernationCallbacks);
         log('CadreNode created for party: %s', config.controlNetwork.partyId);
     }
     /**
-     * SAppIdLookup implementation - get sAppId for a strand
+     * SAppIdLookup implementation - get sAppId for a strand: the claiming config's, else
+     * the one a storage replica read from the strand's own `Strand.Header`.
      */
     getSAppId(strandId) {
-        return this.sAppConfigs.get(strandId)?.id;
+        return this.sAppConfigs.get(strandId)?.id ?? this.replicaSAppIds.get(strandId);
     }
     /**
      * Get the peer ID of this node (available after start)
@@ -777,6 +863,7 @@ export class CadreNode {
             return;
         }
         log('Starting CadreNode for party: %s', this.config.controlNetwork.partyId);
+        this.logRelayServerSettings();
         try {
             const tTotal = performance.now();
             // Config pre-flight, inside the guarded region: resolving the listen addrs it reads
@@ -810,8 +897,9 @@ export class CadreNode {
             // beside the control rows. Before network bring-up, so a mis-scoped injected store
             // fails closed like the two above.
             this.initializeJoinedStrandStore();
-            // The strand peer book those joins are dialed from. Same placement, same reason.
-            this.initializeStrandPeerBookStore();
+            // Each strand node's saved network state, which those joins are dialed from after
+            // a restart. Same placement, same reason.
+            this.initializeStrandNetworkStateStore();
             // Read the party's enrolled-machine count out of its node-local record and
             // capture it for buildControlNodeOptions below. This MUST precede
             // createControlNode: Optimystic freezes the cluster policy when the node is
@@ -907,7 +995,7 @@ export class CadreNode {
                 getStrand: (strandId) => this.strandManager.getInstance(strandId),
                 wake: (strandId) => this.wakeStrand(strandId),
             });
-            this.strandWakeService.initialize(this.controlNode);
+            await this.strandWakeService.initialize(this.controlNode);
             // Register the control-network strand-address responder: a same-cadre peer
             // resolving a strand's bootstrap seed asks us for our live strand-network
             // multiaddrs (its CadrePeer row only knows our *control* address). Gated on
@@ -921,7 +1009,7 @@ export class CadreNode {
                 getStrandMultiaddrs: (strandId) => this.getStrandMultiaddrs(strandId),
                 onDelegateAnnounce: (announcer, strandId, delegate) => this.grantDelegateAdmission(announcer, strandId, delegate),
             });
-            this.strandAddrService.initialize(this.controlNode);
+            await this.strandAddrService.initialize(this.controlNode);
             // Server-side push-wake fan-out: only when push is configured.
             if (this.config.push) {
                 this.pushFanoutService = this.buildPushFanout(this.config.push);
@@ -1161,7 +1249,7 @@ export class CadreNode {
     }
     /**
      * Construct (or adopt) the node-local joined-strand store (see
-     * {@link joinedStrandStore}) and this session's watcher view over it.
+     * {@link joinedStrandStore}) and this session's {@link joinedStrands} over it.
      *
      * The store instance is kept across stop()→start(); the view is rebuilt. A store
      * scoped to a different party is a configuration error, fail closed: its joins
@@ -1178,28 +1266,28 @@ export class CadreNode {
                 `but this node serves party ${partyId} — refusing to offer another party's joined strands`);
         }
         this.joinedStrandStore = store;
-        this.joinedStrandRows = new JoinedStrandRows(store);
+        this.joinedStrands = new JoinedStrandSession(store, this.createPartyJoinedStrandLedger());
     }
     /**
-     * Construct (or adopt) the node-local strand peer book (see
-     * {@link strandPeerBookStore}). Synchronous for the reason
+     * Construct (or adopt) the node-local strand network state (see
+     * {@link strandNetworkStateStore}). Synchronous for the reason
      * {@link initializeBootstrapPeerStore} is: an injected store has already loaded its
      * persisted entries by the time it is handed in, and the in-memory fallback has
      * nothing to load. The instance is kept across stop()→start(). A store scoped to a
-     * different party is a configuration error, fail closed: another party's strand
-     * peers must never enter this node's dial loop.
+     * different party is a configuration error, fail closed: another party's routing
+     * tables must never be imported into this node's strands.
      */
-    initializeStrandPeerBookStore() {
+    initializeStrandNetworkStateStore() {
         const partyId = this.config.controlNetwork.partyId;
-        if (this.strandPeerBookStore) {
+        if (this.strandNetworkStateStore) {
             return;
         }
-        const store = this.config.strandPeers?.store ?? new MemoryStrandPeerBookStore(partyId);
+        const store = this.config.strandNetworkState?.store ?? new MemoryStrandNetworkStateStore(partyId);
         if (store.partyId !== partyId) {
-            throw new Error(`CadreNodeConfig: strandPeers.store is scoped to party ${store.partyId}, ` +
-                `but this node serves party ${partyId} — refusing to mix strand peer books`);
+            throw new Error(`CadreNodeConfig: strandNetworkState.store is scoped to party ${store.partyId}, ` +
+                `but this node serves party ${partyId} — refusing to mix strand network state`);
         }
-        this.strandPeerBookStore = store;
+        this.strandNetworkStateStore = store;
     }
     /**
      * The node-local enrolled-machine store (null before {@link start}) — what this
@@ -1219,13 +1307,13 @@ export class CadreNode {
         return this.bootstrapPeerStore;
     }
     /**
-     * The node-local strand peer book (null before {@link start}) — per strand, the
-     * strand peers this node dials first on launch, resume and refresh. Exposed for
-     * diagnostics and for a host that wants to show "whom would this strand re-find
-     * after a restart?".
+     * The node-local strand network state (null before {@link start}) — per strand, the
+     * state its strand node last saved and will re-import when next built. Exposed for
+     * diagnostics and for a host that wants to show "what routing table would this
+     * strand restart with?".
      */
-    getStrandPeerBookStore() {
-        return this.strandPeerBookStore;
+    getStrandNetworkStateStore() {
+        return this.strandNetworkStateStore;
     }
     /**
      * The node-local trusted-owner anchor (null before {@link start}). This is
@@ -1391,7 +1479,7 @@ export class CadreNode {
         const scope = controlStorageScope(this.config.controlNetwork.partyId);
         // The second seam that hands a scope key to an embedder's provider; the first
         // (`StrandInstanceManager.startStrand`) asserts the stricter strand rule. Holds by
-        // construction today — base64url is inside the charset — so this guards a future
+        // construction today — lowercase hex is inside the charset — so this guards a future
         // edit to `controlStorageScope`, not a reachable input.
         assertScopeKeyCharset(scope);
         const resolved = typeof provider === 'function' ? provider(scope) : provider;
@@ -1458,7 +1546,6 @@ export class CadreNode {
         // nothing); anything outside {tcp, ws/wss, p2p-circuit} throws here rather than
         // being silently dropped at bring-up. See `relay-addrs.ts`.
         const transportOptions = resolveTransportOptions(network, listenAddrs);
-        const enableRelay = this.relayServerEnabled();
         // The control node's own storage, resolved once per runtime (see
         // {@link resolveControlStorage}) rather than per call.
         const controlStorageProvider = this.resolveControlStorage();
@@ -1468,7 +1555,10 @@ export class CadreNode {
             networkName: this.controlNetworkName(),
             storage: controlStorageProvider,
             fretProfile: profile === 'storage' ? 'core' : 'edge',
-            relay: enableRelay,
+            relay: this.relayServer.enabled,
+            // Merged party-run defaults: no per-connection data/duration cap, a store sized for
+            // one party's NAT'd machines. Strand nodes get the same init (`relay-server.ts`).
+            ...(this.relayServer.enabled && { relayServerInit: this.relayServer.init }),
             // Fixed, and deliberately above any party's node count: every member reads the
             // whole control database, so a cohort that excludes a member leaves it dependent
             // on read repair — which cannot converge at a two-member cohort. Not a knob;
@@ -1484,12 +1574,14 @@ export class CadreNode {
             // itself, so the unknown case is provably byte-for-byte the old behaviour.
             // The yardstick moves ALONE: `assumedClusterSize` stays pinned at 2, because a
             // party of phones cannot promise three quarters of its machines are awake.
-            // With neither declared this is still the frozen constant by identity, which is the
-            // production path. A degenerate deadline is Optimystic's to refuse, in
-            // createControlNode below.
+            // The read deadline is the host's own, else two link round trips at the declared
+            // `linkRoundTripMs`, else nothing — the frozen constant already carries the same
+            // derivation at the default declaration (`link-budget.ts`). With neither declared this
+            // is still the frozen constant by identity, which is the production path. A degenerate
+            // deadline is Optimystic's to refuse, in createControlNode below.
             clusterPolicy: controlClusterPolicy({
                 enrolledMachines: this.declaredEnrolledMachines,
-                cohortQueryTimeoutMs: network?.cohortQueryTimeoutMs
+                cohortQueryTimeoutMs: declaredCohortReadDeadlineMs(network)
             }),
             arachnode: { enableRingZulu: profile === 'storage' },
             ...(identityKey && { privateKey: identityKey }),
@@ -1500,10 +1592,12 @@ export class CadreNode {
             // whose event loop is saturated by pure-JS Noise crypto. A configured value
             // replaces the default whole (see DEFAULT_CONNECTION_MONITOR).
             connectionMonitor: network?.connectionMonitor ?? DEFAULT_CONNECTION_MONITOR,
-            // libp2p's own dial and inbound-upgrade limits, from the same declared link as every
-            // cadre dial budget. Left to db-p2p, both stay at 10 s, which cannot open a relayed
-            // connection above a 2.5 s round trip — and the listener's side of that fails silently.
-            connectionManager: connectionManagerTimeouts(network?.linkRoundTripMs),
+            // The declared link every cadre budget is derived from, stated to Optimystic too so it
+            // derives its own deadlines from the same number: its request dials and responses, its
+            // block pushes, and libp2p's `dialTimeout` and `inboundUpgradeTimeout`. Always stated,
+            // default included: undeclared, Optimystic keeps LAN deadlines that cannot open a
+            // relayed connection at the link sereus supports (`link-budget.ts`).
+            linkRoundTripMs: resolveLinkRoundTripMs(network?.linkRoundTripMs),
             // `{ wsPort }` when a listen entry names WebSocket, otherwise `{}` — and always
             // `{}` when `network.transports` is set, since the embedder owns transport policy
             // then. Spread NEXT to `transports` because the two answer the same question.
@@ -1526,7 +1620,7 @@ export class CadreNode {
                 admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId),
                 admitRelayReservation: (remotePeerId) => this.admitControlRelayReservation(remotePeerId),
                 bringUpInFlight: () => this.controlBringUpInFlight
-            }, network?.connectionGater),
+            }, network?.connectionGater, ADMISSION_DECISION_TIMEOUT_MS, relayAdmissionReserveDeadlineMs(network?.linkRoundTripMs)),
             // Fail-closed per-stream authorization for the four Optimystic control-DB
             // protocols — the members-only layer the connection gater's stranger
             // carve-outs cannot express (see authorizeInboundControlStream). Control
@@ -1536,15 +1630,17 @@ export class CadreNode {
         return nodeOptions;
     }
     /**
-     * Does this node's CONTROL libp2p run the circuit-relay server? An explicit
-     * `network.enableRelay` wins; otherwise storage-profile nodes default to on
-     * (better connectivity/uptime). Shared by {@link buildControlNodeOptions}
-     * (which configures the server from it) and
-     * {@link admitInboundControlConnection} (whose deny/admit-for-relay branch
-     * must agree with whether a reservation is even servable here).
+     * One debug line naming what this machine's relay server forwards and holds —
+     * the same fields the dedicated relay container prints at boot
+     * (`ops/docker/libp2p-infra/src/main.ts`). Once per start, not per strand:
+     * strand nodes resolve the same settings from the same config.
      */
-    relayServerEnabled() {
-        return this.config.network?.enableRelay ?? (this.config.profile === 'storage');
+    logRelayServerSettings() {
+        if (!this.relayServer.enabled) {
+            return;
+        }
+        const { applyDefaultLimit, maxReservations, reservationTtl } = this.relayServer.init.reservations;
+        log('Relay server on: applyDefaultLimit=%s maxReservations=%d reservationTtl=%dms unauthorizedCap=%d', applyDefaultLimit, maxReservations, reservationTtl, this.unauthorizedRelayReservations.cap);
     }
     /**
      * Decide whether an inbound CONTROL-network connection from `remotePeerId`
@@ -1593,7 +1689,7 @@ export class CadreNode {
      *    accepted it, exactly like the unreplicated-membership-row case below.
      *
      * When every check falls through, the verdict depends on whether this node
-     * runs the circuit-relay server ({@link relayServerEnabled}): without one,
+     * runs the circuit-relay server ({@link relayServer}): without one,
      * `'deny'`; with one, `'admit-for-relay'` — a circuit-relay reservation is
      * established by the reserving peer DIALING the relay, so a connection deny
      * here kills the reservation, and that deny is NOT self-healing: an outbound
@@ -1643,7 +1739,7 @@ export class CadreNode {
             log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
             return 'admit';
         }
-        if (this.relayServerEnabled()) {
+        if (this.relayServer.enabled) {
             log('admitInboundControlConnection: admitting %s FOR RELAY ONLY — not an authorized member and no enrollment path open; the gater drops the connection unless a reservation is admitted', remotePeerId);
             return 'admit-for-relay';
         }
@@ -1847,7 +1943,9 @@ export class CadreNode {
             // the count of machines serving the network — the quantity
             // `resolveRepairYardstick` asks for. It is NOT that quantity for a strand, which
             // launches only on machines whose embedder registered its sApp config (see
-            // {@link addStrand}), so this number must never be routed to a strand node:
+            // {@link addStrand}) plus storage-profile machines hosting it as a storage replica
+            // ({@link CadreNodeConfig.hostUnclaimedStrands}) whose filter admits it — phones
+            // serve only what their app claims — so this number must never be routed to a strand node:
             // over-declaring pins Optimystic's repair corroboration floor at two peers and a
             // strand that can field only one can then never repair. `launchStrand` therefore
             // declares nothing; see the NOTE there.
@@ -1935,9 +2033,9 @@ export class CadreNode {
         return this.bootstrapPeerIds;
     }
     /**
-     * What the strand watcher polls: this party's control rows plus a row per remembered
-     * cross-party join (see {@link joinedStrandRows}), so a joined strand is re-offered
-     * and relaunched on the same path as the party's own.
+     * What the strand watcher polls: this party's control rows plus a row per cross-party
+     * join (see {@link joinedStrands}), so a joined strand is offered and relaunched on
+     * the same path as the party's own.
      */
     createStrandQueryable() {
         return {
@@ -1948,10 +2046,73 @@ export class CadreNode {
                 }
                 log('Querying strands from control database');
                 const control = await this.controlDatabase.queryStrands();
-                return this.joinedStrandRows ? await this.joinedStrandRows.withControlRows(control) : control;
+                return this.joinedStrands ? await this.joinedStrands.withControlRows(control) : control;
             }
         };
     }
+    /**
+     * The party-wide `JoinedStrand` table as {@link joinedStrands} reads and writes it.
+     * Reads {@link controlDatabase} at call time, so start-up order does not matter.
+     */
+    createPartyJoinedStrandLedger() {
+        const database = () => {
+            if (!this.controlDatabase) {
+                throw new Error('CadreNode must be started before using the party-wide joined-strand table');
+            }
+            return this.controlDatabase;
+        };
+        return {
+            // NOTE: one more control read per watcher poll (5 s), and for a party that never
+            // joined anything it reads a never-written block, which consults the cohort. If poll
+            // cost shows up in a device profile, cache the list and re-read it on the reconcile
+            // cadence.
+            list: () => database().queryJoinedStrands(),
+            names: async (strandId) => (await database().queryStrand(strandId)) !== null
+                || (await database().queryJoinedStrand(strandId)) !== null,
+            canSign: async () => (await this.enrolledOwnerSigningKey()) !== null,
+            publish: async (record) => {
+                const signingKey = await this.enrolledOwnerSigningKey();
+                if (!signingKey) {
+                    throw new Error(`Cannot publish joined strand ${record.Id}: this machine is not an enrolled owner`);
+                }
+                try {
+                    await database().insertJoinedStrand(record, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+                }
+                catch (error) {
+                    // Another machine of the party published this join first; its row wins.
+                    if (!isStrandIdConflict(error, 'JoinedStrand')) {
+                        throw error;
+                    }
+                }
+            },
+            remove: async (strandId) => {
+                const signingKey = await this.enrolledOwnerSigningKey();
+                if (signingKey) {
+                    return database().deleteJoinedStrand(strandId, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+                }
+                if (await database().queryJoinedStrand(strandId)) {
+                    throw new Error(`Cannot leave strand ${strandId} for the whole party: the join is recorded party-wide, and ` +
+                        `removing it takes an owner machine, which this one is not. stopStrand('${strandId}') stops ` +
+                        'it on this machine only.');
+                }
+                return false;
+            }
+        };
+    }
+    /**
+     * This machine's owner signing key when it can make owner-gated control writes: its seed
+     * bootstrap holds an owner key (`SeedBootstrapService.canAuthorize`) and the party's
+     * `OwnerKey` table enrolls it. A phone that ran self-genesis after another machine
+     * founded the party passes the first test and not the second (`runOwnerGenesis` in the
+     * reference apps), and a write it signed would only be refused.
+     */
+    async enrolledOwnerSigningKey() {
+        const signingKey = this.seedBootstrapService?.canAuthorize() ? this.getSelfSigningKey() : null;
+        if (!signingKey || !this.controlDatabase) {
+            return null;
+        }
+        return (await this.controlDatabase.getOwnerKeys()).has(signingKey.publicKeyB64) ? signingKey : null;
+    }
     /**
      * Schedule the node's initial self-record publish + ongoing refresh shortly
      * after start (non-blocking). {@link registerSelf} is idempotent and safely
@@ -2569,14 +2730,18 @@ export class CadreNode {
         // Ride this pass's cadence to refresh the per-stream gate's materialized
         // authorized set — membership changes that ARRIVED BY REPLICATION (rather
         // than a local write) are picked up here, bounding the snapshot's staleness
-        // to the reconcile interval.
+        // to the time between pass starts: the reconcile interval, or the previous
+        // pass's length when that is longer (passes are single-flight, and one
+        // unreachable sibling's dial alone can take `controlDialBudget().totalMs`).
         // NOTE: this refresh and the sibling enumeration below each run their own
         // CadrePeer query (two reads per pass), plus a third from
-        // `refreshStrandPeerAddrs` on the passes where a strand is due AND this node
-        // holds a control connection (one read for the whole pass, not one per
-        // strand). Each also reads Revocation first. Before the Revocation ledger
-        // marker exists (filed below, once connected) that block is missing, so every
-        // one of those reads consults the cohort about it; once the marker exists every
+        // `refreshStrandPeerAddrs` on every pass where a strand is running AND this
+        // node holds a control connection (one read for the whole pass, not one per
+        // strand; it runs even when no sibling is due, because pruning departed
+        // siblings needs the current target set). Each also reads Revocation first.
+        // Before the Revocation ledger marker exists (filed below, once connected)
+        // that block is missing, so every one of those reads consults the cohort
+        // about it; once the marker exists every
         // block they touch is held and none of them does (both states pinned in
         // control-founding-consult-budget.spec.ts). If those reads ever get costly,
         // share one row-set across all three.
@@ -2592,10 +2757,10 @@ export class CadreNode {
         if (!this._running || !this.controlNode || !this.controlDatabase) {
             return { dialed: [] };
         }
-        // Then re-warm each running strand's own address book from its siblings, on
-        // its own (much longer) throttle. Same reasoning as warmSiblingAddrBook
-        // below, one layer down: replication runs on the STRAND network, and every
-        // layer under cadre-core dials strand peers by bare peer id.
+        // Then re-warm each running strand's own address book from its FRET address
+        // records and from whichever siblings are due an ask. Same reasoning as
+        // warmSiblingAddrBook below, one layer down: replication runs on the STRAND
+        // network, and every layer under cadre-core dials strand peers by bare peer id.
         await this.refreshStrandPeerAddrs();
         if (!this._running || !this.controlNode || !this.controlDatabase) {
             return { dialed: [] };
@@ -2662,6 +2827,19 @@ export class CadreNode {
             if (!this._running || !this.controlNode || !this.controlDatabase) {
                 return { dialed: [] };
             }
+            // Publish this machine's unpublished cross-party joins party-wide and remove the rows a
+            // self-revocation queued (JoinedStrandSession.syncWithParty). Connected-only for the
+            // reap's reason above; owner-only by the session's own signer check. Nothing is urgent:
+            // a join reaches the party within one pass of this machine being connected.
+            try {
+                await this.joinedStrands?.syncWithParty();
+            }
+            catch (error) {
+                log('reconcileControlCohort: joined-strand sync failed (retrying next pass): %o', error);
+            }
+            if (!this._running || !this.controlNode || !this.controlDatabase) {
+                return { dialed: [] };
+            }
         }
         // 1. Enumerate known siblings. This membership read is itself a pull-on-read
         //    that helps the CadrePeer table converge — a reader-only node converges
@@ -2875,6 +3053,27 @@ export class CadreNode {
             totalMs: cohort?.dialTimeoutMs ?? CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS * perAddressMs,
         };
     }
+    /**
+     * The link-derived limits shared by every {@link SeedBootstrapService} this node builds: its
+     * owner and invite dials ({@link controlDialBudget}) and its seed delivery deadline, derived
+     * from `network.linkRoundTripMs`. One helper so the four construction sites cannot drift.
+     */
+    seedServiceBudgets() {
+        return {
+            dialBudget: this.controlDialBudget(),
+            linkRoundTripMs: this.config.network?.linkRoundTripMs,
+        };
+    }
+    /**
+     * {@link collectStrandAddrs} at this node's declared `network.linkRoundTripMs`, so each ask's
+     * deadline derives from it. One helper so the four call sites cannot drift.
+     */
+    async collectSiblingStrandAddrs(controlNode, peers, strandId, delegatePeerId) {
+        return await collectStrandAddrs(controlNode, peers, strandId, {
+            delegatePeerId,
+            linkRoundTripMs: this.config.network?.linkRoundTripMs,
+        });
+    }
     /**
      * Dial one sibling from its already-resolved addresses, best-effort. Returns
      * whether the dial resolved (false when no address resolves or the dial fails).
@@ -2883,7 +3082,9 @@ export class CadreNode {
      * the {@link controlDialBudget} expiring) is logged and swallowed so one
      * unreachable sibling never aborts the pass — exactly like
      * {@link SeedBootstrapService.applySeed}'s owner-dial loop. A failed dial is
-     * simply retried on the next pass.
+     * simply retried on the next pass. A sibling whose every address relays
+     * through this node ({@link SelfRelayOnlyError}) is not dialed at all and gets
+     * a one-line log instead: only the sibling can reconnect.
      */
     async dialControlSibling(sibling, resolved) {
         const controlNode = this.controlNode;
@@ -2901,7 +3102,12 @@ export class CadreNode {
             return true;
         }
         catch (error) {
-            log('reconcileControlCohort: dial of sibling %s failed (continuing): %o', sibling.peerId, error);
+            if (error instanceof SelfRelayOnlyError) {
+                log('reconcileControlCohort: sibling %s is reachable only by relaying through this node; waiting for it to reconnect', sibling.peerId);
+            }
+            else {
+                log('reconcileControlCohort: dial of sibling %s failed (continuing): %o', sibling.peerId, error);
+            }
             return false;
         }
     }
@@ -3145,7 +3351,12 @@ export class CadreNode {
             return true;
         }
         catch (error) {
-            log('reconcileControlCohort(cold-start): dial of bootstrap peer %s failed (continuing): %o', peerId, error);
+            if (error instanceof SelfRelayOnlyError) {
+                log('reconcileControlCohort(cold-start): bootstrap peer %s is reachable only by relaying through this node; waiting for it to reconnect', peerId);
+            }
+            else {
+                log('reconcileControlCohort(cold-start): dial of bootstrap peer %s failed (continuing): %o', peerId, error);
+            }
             return false;
         }
     }
@@ -3162,7 +3373,7 @@ export class CadreNode {
     // local-only). The remedy: detect "wrote while alone" (0 connections is a sound
     // lower bound), queue the affected row, and RE-ISSUE the write once the cohort
     // grows (0→≥1 connection), as an idempotent monotonic update that now broadcasts.
-    // See docs/architecture.md (Control Network → write-while-alone durability).
+    // See docs/architecture.md (Control Network Convergence → "Writes made while alone").
     // ============================================================================
     /**
      * Whether a control write happening now would commit local-only. A sound lower
@@ -3819,26 +4030,20 @@ export class CadreNode {
         // Check if we have sApp config for this strand
         const sAppConfig = this.sAppConfigs.get(strand.Id);
         if (!sAppConfig) {
-            log('No sAppConfig registered for strand %s - emitting strand:discovered', strand.Id);
-            // Strand created by another member and not yet configured locally. Surface
-            // it as a discovery event so the hosting app can decide whether to join
-            // (register a config + addStrand); the strand-agnostic seam keeps this
-            // class free of any app's join policy. A self-configured strand (config
-            // already present) keeps auto-starting below, unchanged.
-            //
-            // Recorded BEFORE the emit so a handler that synchronously drains
-            // `getDiscoveredStrands()` sees this strand too. The watcher does not offer the
-            // same strand twice — its `knownStrands` retains the id, and the one thing that
-            // un-retains it (a failed `addStrand`, via `StrandWatcher.forgetStrand`) leaves the
-            // sApp config registered, so the retry takes the auto-launch branch below rather
-            // than this one. So this map — not the event — is what a late subscriber reads.
-            // See the `strand:discovered` doc in types.ts.
-            this.discoveredStrands.set(strand.Id, strand);
-            this.emit('strand:discovered', { strandId: strand.Id, strand });
-            return;
+            this.announceDiscoveredStrand(strand);
+            // Announce-only unless this node hosts storage replicas. Also skipped when a
+            // listener claimed the strand synchronously (an `addStrand` call registers its
+            // config before its first await): that claim is launching it with the app's schema,
+            // and a replica launch here would only race it.
+            if (!this.hostUnclaimedStrands || this.sAppConfigs.has(strand.Id)) {
+                return;
+            }
         }
         try {
-            await this.launchStrand(strand, sAppConfig);
+            const instance = await this.launchStrand(strand, sAppConfig);
+            if (!sAppConfig) {
+                void this.recordReplicaSAppId(instance.strandId);
+            }
         }
         catch (error) {
             log('Error starting strand %s: %o', strand.Id, error);
@@ -3855,6 +4060,59 @@ export class CadreNode {
             throw error;
         }
     }
+    /**
+     * Offer a strand no local config claims to the hosting app as `strand:discovered`, so
+     * it can decide whether to join (register a config + addStrand); the strand-agnostic
+     * seam keeps this class free of any app's join policy.
+     *
+     * Once per strand: a storage-replica launch that fails is retried by the watcher
+     * (`StrandWatcher.forgetStrand` + backoff), and each retry comes back through
+     * {@link handleStrandAdded} with no config — the app must still see one announcement.
+     * The other thing that un-retains a strand in the watcher (a failed `addStrand`) leaves
+     * the sApp config registered, so that retry takes the claimed branch instead.
+     *
+     * Recorded BEFORE the emit so a handler that synchronously drains
+     * `getDiscoveredStrands()` sees this strand too. So this map — not the event — is what
+     * a late subscriber reads. See the `strand:discovered` doc in types.ts.
+     *
+     * NOTE: a replica launch that keeps failing leaves the watcher not tracking the strand,
+     * so if its control row is removed during the backoff no `handleStrandRemoved` arrives
+     * and this entry outlives the row. Needs a persistently failing launch AND a removal
+     * inside the backoff; if it is ever seen, have the watcher report removal of rows it
+     * forgot, since `detachStrand` is already a no-op for an untracked instance.
+     */
+    announceDiscoveredStrand(strand) {
+        if (this.discoveredStrands.has(strand.Id)) {
+            return;
+        }
+        log('No sAppConfig registered for strand %s - emitting strand:discovered', strand.Id);
+        this.discoveredStrands.set(strand.Id, strand);
+        this.emit('strand:discovered', { strandId: strand.Id, strand });
+    }
+    /**
+     * Record the sApp id a storage replica's `Strand.Header` names, for {@link getSAppId}.
+     * Runs whenever a replica's database may have just been published (launch, the
+     * first-sync gate opening, a wake); a no-op for a claimed strand, an unpublished
+     * database, or an id already recorded. Never throws: a failed read logs and leaves the
+     * id unknown, so an `sAppId` filter keeps the strand provisionally admitted — a
+     * syncing replica, which is harmless.
+     */
+    async recordReplicaSAppId(strandId) {
+        const database = this.strandManager.getInstance(strandId)?.database;
+        if (!database || this.sAppConfigs.has(strandId) || this.replicaSAppIds.has(strandId)) {
+            return;
+        }
+        try {
+            const sAppId = await readStrandHeaderSAppId(database.getDatabase());
+            if (sAppId !== undefined) {
+                this.replicaSAppIds.set(strandId, sAppId);
+                log('Storage replica %s serves sApp %s', strandId, sAppId);
+            }
+        }
+        catch (error) {
+            log('Could not read the sApp id of storage replica %s (left unknown): %o', strandId, error);
+        }
+    }
     async handleStrandRemoved(strandId) {
         log('Handling strand removed: %s', strandId);
         try {
@@ -3929,7 +4187,7 @@ export class CadreNode {
         }
         // Unregister strand solicitation service
         if (this.strandSolicitationService && this.controlNode) {
-            this.strandSolicitationService.unregisterResponder(this.controlNode);
+            await this.strandSolicitationService.unregisterResponder(this.controlNode);
             this.strandSolicitationService = null;
         }
         // Stop strand watcher
@@ -3943,6 +4201,7 @@ export class CadreNode {
         this.sAppConfigs.clear();
         this.strandLaunchRefusals.clear();
         this.discoveredStrands.clear();
+        this.replicaSAppIds.clear();
         // Drop delegate-admission state: the grants are scoped to the session that
         // recorded them, so a stop()/start() cycle on this object must not keep
         // admitting delegates announced under the previous one, nor carry stale
@@ -4003,6 +4262,7 @@ export class CadreNode {
         if (instance) {
             this.hibernationManager.recordActivity(instance);
         }
+        void this.recordReplicaSAppId(strandId);
         this.emit('strand:writable', { strandId });
     }
     // Hibernation callbacks
@@ -4016,27 +4276,18 @@ export class CadreNode {
     }
     /**
      * Hibernate a strand: release its strand-network resources via the strand
-     * manager (stop the libp2p node, close the StrandDatabase) and mark it
+     * manager (stop the libp2p node, close the StrandDatabase), which marks it
      * `hibernating`. A quiesced strand holds no open strand-network connections,
-     * transports, or DB handles. No-ops if the strand is missing; if already
-     * quiesced (defensive), just marks status and emits.
+     * transports, or DB handles. No-ops if the strand is missing; one already quiesced
+     * is only marked, and still emits.
      */
     async handleStrandHibernate(strandId) {
-        const instance = this.strandManager.getInstance(strandId);
-        if (!instance) {
+        if (!this.strandManager.getInstance(strandId)) {
             log('handleStrandHibernate: strand %s not found', strandId);
             return;
         }
-        if (!instance.libp2pNode && !instance.database) {
-            // Already quiesced — only the status flag needs updating.
-            instance.status = 'hibernating';
-            log('Strand %s already quiesced; marked hibernating', strandId);
-            this.emit('strand:hibernating', { strandId });
-            return;
-        }
         log('Hibernating strand %s — releasing strand-network resources', strandId);
         await this.strandManager.quiesceStrand(strandId);
-        instance.status = 'hibernating';
         this.emit('strand:hibernating', { strandId });
         log('Strand %s hibernating (resources released)', strandId);
     }
@@ -4046,7 +4297,13 @@ export class CadreNode {
      * its runtime via the strand manager. If it is still live (e.g. waking an idle
      * strand, which retains its resources), just flip the status. Overlapping wake
      * triggers are coalesced upstream by `HibernationManager`, so this runs once
-     * per wake; `resumeStrand` is itself idempotent as a backstop.
+     * per wake; a wake racing a check-in joins the check-in's rebuild in `resumeStrand`.
+     *
+     * A failed rebuild re-hibernates the strand (see {@link rehibernateIfResumeFailed});
+     * every failure rethrows, so the waker still sees the error.
+     *
+     * Records no activity itself: whoever asked for the wake did ({@link wakeStrand},
+     * `HibernationManager.recordActivity`), and {@link serviceWake}'s own probe must not.
      */
     async handleStrandWake(strandId) {
         const instance = this.strandManager.getInstance(strandId);
@@ -4055,10 +4312,14 @@ export class CadreNode {
             return;
         }
         // Still live (idle wake, or defensive double-wake): no rebuild needed. A joiner
-        // still behind its first-sync gate wakes back to `'syncing'`, not `'active'`.
-        if (instance.libp2pNode || instance.database) {
+        // still behind its first-sync gate wakes back to `'syncing'`, not `'active'`. A
+        // `'starting'` strand is mid-build (a check-in's resume, or its launch) with the node
+        // attached before the database: not live yet, so it falls through and joins that build.
+        // A strand being quiesced still holds its handles but is on its way down: it falls
+        // through too, and its resume runs after the quiesce.
+        if (instance.status !== 'starting' && (instance.libp2pNode || instance.database)
+            && !this.strandManager.isQuiescing(strandId)) {
             instance.status = liveStrandStatus(instance);
-            instance.lastActivity = new Date();
             log('Strand %s woke (already live)', strandId);
             this.emit('strand:waking', { strandId });
             return;
@@ -4066,17 +4327,58 @@ export class CadreNode {
         // Quiesced: re-resolve the volatile cohort input (the seed may have grown)
         // and rebuild the runtime.
         log('Waking strand %s — rebuilding strand-network resources', strandId);
-        await this.resumeStrandRuntime(strandId);
-        instance.lastActivity = new Date();
+        try {
+            await this.resumeStrandRuntime(strandId);
+        }
+        catch (error) {
+            await this.rehibernateIfResumeFailed(instance, 'Wake', error);
+            throw error;
+        }
         this.emit('strand:waking', { strandId });
         log('Strand %s awake (resources rebuilt)', strandId);
     }
+    /**
+     * Undo a failed {@link resumeStrandRuntime}, but only when the rebuild itself failed — this
+     * caller's, or the one it joined in `resumeStrand` — which leaves the instance `'error'`. A
+     * failure before the rebuild (the cohort seed read) built nothing, and may find the strand
+     * mid-build or just brought up by a concurrent wake or check-in; that runtime belongs to
+     * whoever is building or holding it, so quiescing it here would stop a node still in use.
+     */
+    async rehibernateIfResumeFailed(instance, context, error) {
+        if (instance.status !== 'error') {
+            log('%s of strand %s failed before its rebuild (status=%s); leaving the strand as it is: %o', context, instance.strandId, instance.status, error);
+            return;
+        }
+        log('%s of strand %s failed; re-hibernating so a later wake or check-in retries: %o', context, instance.strandId, error);
+        await this.rehibernateAfterFailedResume(instance, context);
+    }
+    /**
+     * Put a strand whose rebuild or wake window failed back to `'hibernating'`, through a
+     * best-effort quiesce that releases any runtime left up. `resumeStrand` leaves a failed
+     * strand `'error'`, which nothing retries: `HibernationManager` wakes only
+     * `idle`/`hibernating` strands, and reads any other status after a check-in as "woke",
+     * ending its chain. Safe to run twice for one failure (a wake that joined a failed
+     * check-in's rebuild): quiescing a quiesced strand only marks it.
+     *
+     * The quiesce writes the status itself, ordered before any resume requested meanwhile;
+     * this writes it only when the quiesce failed, since a failed release leaves the status
+     * alone.
+     */
+    async rehibernateAfterFailedResume(instance, context) {
+        try {
+            await this.strandManager.quiesceStrand(instance.strandId);
+        }
+        catch (cleanupErr) {
+            log('%s cleanup quiesce for strand %s failed: %o', context, instance.strandId, cleanupErr);
+            instance.status = 'hibernating';
+        }
+    }
     /**
      * Rebuild a quiesced strand's runtime, re-resolving the volatile cohort input
      * first: the discovery seed may have grown since the strand last ran. Shared by
      * the wake (`handleStrandWake`) and check-in (`handleStrandCheckIn`) paths so both
-     * apply the same fresh resolution. `resumeStrand` is idempotent
-     * (returns the live instance unchanged) as a backstop against double-resume.
+     * apply the same fresh resolution. `resumeStrand` returns a live instance unchanged
+     * and joins a rebuild already in flight, so the two paths never build twice.
      */
     async resumeStrandRuntime(strandId) {
         // Re-derive the transport peerId (deterministic and cheap — a quiesced
@@ -4095,6 +4397,7 @@ export class CadreNode {
         if (instance.libp2pNode) {
             await this.mergeStrandPeerAddrs(instance.libp2pNode, bootstrapNodes, strandId);
         }
+        void this.recordReplicaSAppId(strandId);
     }
     /**
      * Real cohort check-in for a hibernating strand (the `onCheckIn` callback).
@@ -4127,62 +4430,77 @@ export class CadreNode {
             log('handleStrandCheckIn: strand %s not hibernating (status=%s); skipping', strandId, instance.status);
             return;
         }
+        // Before the resume, so a wake that joins this rebuild, or activity recorded while it
+        // runs, counts: the window then leaves the strand up for it.
+        const activityMark = instance.lastActivity;
+        // 1. Resume exactly as a wake does: re-resolve the (possibly grown) cohort
+        //    seed, then rebuild the runtime.
+        log('Check-in: resuming strand %s to probe the cohort for pending activity', strandId);
         try {
-            // 1. Resume exactly as a wake does: re-resolve the (possibly grown) cohort
-            //    seed, then rebuild the runtime.
-            log('Check-in: resuming strand %s to probe the cohort for pending activity', strandId);
             await this.resumeStrandRuntime(strandId);
-            // 2-3. Bounded window for the strand network to connect + the app to act,
-            //      then re-hibernate-if-idle. Shared with the on-demand serviceWake.
-            const windowMs = this.config.hibernation?.checkInWindowMs ?? DEFAULT_CHECKIN_WINDOW_MS;
-            await this.runWakeWindow(instance, windowMs);
         }
         catch (err) {
-            // A check-in that throws part-way — resume failing on a flaky network (the
-            // very scenario hibernation targets), the window rejecting, or quiesce
-            // throwing — must leave the strand HIBERNATING, not in the `error` status
-            // that `resumeStrand` sets on failure. `HibernationManager.runCheckIn`
-            // decides wake-vs-escalate purely from `instance.status` after this
-            // resolves: an `error` status reads as "woke", which STOPS the check-in
-            // chain and strands the strand with no runtime and no future check-in.
-            // Forcing it back to `hibernating` (after a best-effort quiesce to release
-            // any partially-rebuilt runtime) makes the manager escalate the backoff and
-            // retry on the next tick.
-            log('Check-in failed for strand %s; re-hibernating to retry on backoff: %o', strandId, err);
-            await this.strandManager.quiesceStrand(strandId).catch((cleanupErr) => {
-                log('Check-in cleanup quiesce for strand %s failed: %o', strandId, cleanupErr);
-            });
-            instance.status = 'hibernating';
+            // Every failure resolves: `HibernationManager.runCheckIn` decides wake-vs-escalate
+            // from `instance.status` alone. A failed rebuild — on a flaky network, the very
+            // scenario hibernation targets — leaves `resumeStrand`'s `error`, which reads as
+            // "woke" and would STOP the chain with no runtime and no future check-in, so it goes
+            // back to `hibernating` and the manager escalates the backoff and retries. A failure
+            // before the rebuild (the seed read) built nothing: the strand is still `hibernating`
+            // (the manager escalates), or a wake that began meanwhile is building or holding it,
+            // and the manager hands the chain to that wake, whose outcome restores or ends it.
+            await this.rehibernateIfResumeFailed(instance, 'Check-in', err);
+            return;
+        }
+        // 2-3. Bounded window for the strand network to connect + the app to act,
+        //      then re-hibernate-if-idle. Shared with the on-demand serviceWake.
+        const windowMs = this.config.hibernation?.checkInWindowMs ?? DEFAULT_CHECKIN_WINDOW_MS;
+        try {
+            await this.runWakeWindow(instance, activityMark, windowMs);
+        }
+        catch (err) {
+            // The window's quiesce threw with the rebuilt runtime up: release it best-effort and
+            // leave the strand `hibernating`, for the same reason as a failed rebuild above.
+            log('Check-in window failed for strand %s; re-hibernating to retry on backoff: %o', strandId, err);
+            await this.rehibernateAfterFailedResume(instance, 'Check-in');
         }
     }
     /**
      * Window-then-decide for a just-resumed strand, shared by the check-in timer
      * path ({@link handleStrandCheckIn}) and the on-demand {@link serviceWake}:
      *
-     *   1. Capture the post-resume activity marker. `recordActivity` assigns a
-     *      FRESH `Date`, so a changed reference after the window means real
-     *      activity landed during it — not millisecond-resolution noise.
-     *   2. Hold the strand live for `windowMs` so its strand network reaches the
+     *   1. Hold the strand live for `windowMs` so its strand network reaches the
      *      cohort and the app can drive pull-on-read activity.
-     *   3. If activity landed, leave the strand `active` (return `true`); otherwise
-     *      quiesce and mark it `hibernating` again (return `false`).
+     *   2. If activity landed since `activityMark`, leave the strand `active` (return
+     *      `true`); otherwise quiesce it, which marks it `hibernating` again (return `false`).
+     *      A wake or activity that lands during that quiesce rebuilds the strand after it.
      *
-     * @returns whether activity was observed during the window (strand left active).
+     * @param activityMark - `instance.lastActivity` as the caller read it BEFORE bringing the
+     *   strand up. The bring-up records none, and every writer assigns a FRESH `Date`, so a
+     *   changed reference means a wake or activity landed during the resume or the window —
+     *   not millisecond-resolution noise.
+     * @returns whether activity was observed (strand left active).
      */
-    async runWakeWindow(instance, windowMs) {
+    async runWakeWindow(instance, activityMark, windowMs) {
         const strandId = instance.strandId;
-        const activityMark = instance.lastActivity;
+        // NOTE: activity during the window arms the idle countdown, so a window longer than the
+        // hint's idle + hibernate timeouts (only reachable with a custom `windowMs`; the shortest
+        // default pair, archive's, is 40 s vs a 15 s window) can let the timer path quiesce the
+        // strand mid-window, which this then marks live. If such windows become real, suspend the
+        // idle countdown while a window holds the strand.
         await this.holdWakeWindow(instance, windowMs);
         const sawActivity = instance.lastActivity !== activityMark;
         if (sawActivity) {
-            instance.status = liveStrandStatus(instance);
-            this.emit('strand:waking', { strandId });
-            log('Wake window: strand %s saw activity during the window; staying active', strandId);
+            // A force-hibernate during the window has released the runtime and marked the strand
+            // `hibernating`, which stands; a wake queued behind it writes its own status.
+            if (instance.libp2pNode || instance.database) {
+                instance.status = liveStrandStatus(instance);
+                this.emit('strand:waking', { strandId });
+            }
+            log('Wake window: strand %s saw activity during the window; not re-hibernating', strandId);
             return true;
         }
         log('Wake window: no activity for strand %s; re-hibernating', strandId);
         await this.strandManager.quiesceStrand(strandId);
-        instance.status = 'hibernating';
         return false;
     }
     /**
@@ -4230,9 +4548,10 @@ export class CadreNode {
      * published (e.g. re-attaching its own orphan after a restart) founds it, and attaching
      * anyone else's row joins, without the caller needing to know which it is.
      *
-     * A joined row (no `founder: true`) this party's control database does not hold — a
-     * strand joined from another party — is remembered in the node's joined-strand store, so it is re-offered as
-     * `strand:discovered` after a restart (see {@link forgetJoinedStrand}).
+     * A joined row (no `founder: true`) this party's control database does not name — a
+     * strand joined from another party — is remembered in the node's joined-strand store, so it
+     * is re-offered as `strand:discovered` after a restart, and published party-wide by an
+     * owner machine's reconcile pass (see {@link forgetJoinedStrand}).
      *
      * A rejected call leaves nothing running but DOES leave the sApp config
      * registered, deliberately: both an explicit retry and the {@link StrandWatcher}'s
@@ -4458,7 +4777,7 @@ export class CadreNode {
         catch (error) {
             // Only the uniqueness collision is a candidate for the idempotent reading; every
             // other rejection (unauthorized signer, retired stamp) must keep surfacing.
-            if (!isStrandIdConflict(error)) {
+            if (!isStrandIdConflict(error, 'Strand')) {
                 throw error;
             }
             const landed = await this.controlDatabase.queryStrand(trimmed);
@@ -4606,7 +4925,7 @@ export class CadreNode {
      * — and with it the consent re-seat foreclosure — does propagate; but the physical row
      * deletion cannot be replayed, and `queryStrands` reads raw (no retired-stamp filter),
      * so siblings that already hold the row keep running the strand until the collection
-     * itself converges (logged loudly; see the delete-while-alone durability note in
+     * itself converges (logged loudly; see "Deletes made while alone" in
      * docs/architecture.md).
      *
      * A no-op (no throw, no tombstone) when the row is already absent — but a
@@ -4752,10 +5071,10 @@ export class CadreNode {
      * NOTE: "founding machine" here is the ROW's provenance, not the launch's resolved
      * `founder` flag — so an explicit `founder: false` over a row this machine published
      * still mints, an owner-signed write a caller that said "I am not founding" did not ask
-     * for. Harmless (the party needs that identity for the strand either way, and the mint
-     * is insert-if-absent) and unreachable today: the one explicit `founder: false` caller
-     * passes a row with a null `FounderOwnerKey`. If a caller ever pairs `founder: false`
-     * with its own published row, gate the mint on the resolved flag too.
+     * for. Reached by a storage replica of a row this machine published (always a joiner,
+     * see {@link launchStrand}) and kept on purpose: the party needs that identity for the
+     * strand either way, the mint is insert-if-absent, and a closed-strand replica runs its
+     * membership reconciler — which seats its own `MemberPeer` binding — only with a party key.
      */
     async resolveStrandPartyKey(strand, explicitKey) {
         if (explicitKey !== undefined) {
@@ -4921,9 +5240,18 @@ export class CadreNode {
      * A founder launch refused as pre-split (`PreSplitStrandIdentityError`) is recorded in
      * {@link strandLaunchRefusals} for the formation arm, then rethrown; a founder launch
      * that succeeds clears the record (it ran the bootstrap's pre-split check and passed).
+     *
+     * An absent `sAppConfig` launches a storage replica ({@link CadreNodeConfig.hostUnclaimedStrands}),
+     * which is ALWAYS a joiner whatever the row says: the founder bootstrap writes the sApp
+     * into `Strand.Header`, and a replica has none. So a self-founded row whose watcher poll
+     * wins the race against its app's `addStrand` after a restart comes up as a replica — and
+     * so does a `foundStrand` whose publish a watcher poll saw before its attach. A claim
+     * that finds a tracked replica upgrades it in place, over the same node and store
+     * ({@link StrandInstanceManager.attachSApp}), BEFORE any founding: the founder bootstrap
+     * needs the sApp the attach supplies.
      */
     async launchStrand(strand, sAppConfig, founder, explicitPartyKey) {
-        const resolvedFounder = founder ?? this.isSelfFoundedRow(strand);
+        const resolvedFounder = sAppConfig ? (founder ?? this.isSelfFoundedRow(strand)) : false;
         try {
             const instance = await this.startOrFoundStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey);
             if (resolvedFounder) {
@@ -4944,41 +5272,8 @@ export class CadreNode {
      */
     async startOrFoundStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey) {
         const timed = (step, op) => timedStep('startOrFoundStrand', strand.Id, step, op);
-        const existing = this.strandManager.getInstance(strand.Id);
-        if (existing) {
-            if (resolvedFounder) {
-                // The resolver runs only when the retained config lacks a party key for a
-                // closed strand (see foundExistingStrand), so the common watcher re-entry
-                // ('already-founder') still costs no control read.
-                const outcome = await timed('foundExistingStrand', () => this.strandManager.foundExistingStrand(strand.Id, () => this.resolveStrandPartyKey(strand, explicitPartyKey)));
-                if (outcome === 'needs-resume') {
-                    try {
-                        // Quiesced instance: the retained config now founds, but founding promises
-                        // the bootstrap has RUN by the time the caller resolves — wake through the
-                        // hibernation manager (coalesced with any in-flight wake, timer-aware) so
-                        // the rebuild executes it now rather than at some eventual wake.
-                        await timed('wakeStrand', () => this.wakeStrand(strand.Id));
-                        // The wake's rebuild founds — UNLESS a wake was already in flight when the
-                        // config flipped, in which case it had already read the pre-flip config and
-                        // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
-                        // (insert-if-absent) bootstrap so founding never resolves headerless.
-                        await timed('ensureFounderBootstrap', () => this.strandManager.ensureFounderBootstrap(strand.Id));
-                    }
-                    catch (error) {
-                        // The founding did not happen (e.g. the rebuild refused a pre-split strand and
-                        // rolled back, leaving the instance tracked with no runtime): withdraw the flip
-                        // so the next attempt re-runs the founding instead of resolving
-                        // 'already-founder' over an instance that never founded.
-                        this.strandManager.withdrawFounderRequest(strand.Id);
-                        throw error;
-                    }
-                }
-                log('launchStrand: strand %s already tracked — founder request honored (%s)', strand.Id, outcome);
-            }
-            else {
-                log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
-            }
-            return existing;
+        if (this.strandManager.getInstance(strand.Id)) {
+            return this.claimTrackedStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey);
         }
         // A closed strand's launch carries the party's OWN membership identity key: the
         // explicit attach-time key, else the control-layer StrandPartyKey row — minted here
@@ -5000,9 +5295,9 @@ export class CadreNode {
         // `privateKey` — tests, and an embedder that opted out of a stable identity) the
         // strand node still runs under a key CADRE-CORE HOLDS: a fresh random Ed25519 key,
         // exactly what libp2p would generate internally if handed none, except that the
-        // book swap can sign this node's own entry with it (`strand-peer-book-swap.ts`) and
-        // the retained launch config keeps the same strand peer id across a hibernation
-        // resume. Stability across RESTARTS still needs an identity key.
+        // delegate announcement below can name the strand peer id before the node exists and
+        // the retained launch config keeps that id across a hibernation resume. Stability
+        // across RESTARTS still needs an identity key.
         //
         // NOTE: derivation requires an Ed25519 identity key, so a node configured
         // with some other key type now fails strand launch outright (surfaced as
@@ -5021,6 +5316,14 @@ export class CadreNode {
         // client awaits the replies).
         const delegatePeerId = transportKey ? peerIdFromPrivateKey(transportKey).toString() : undefined;
         const bootstrapNodes = await timed('resolveCohortSeed', () => this.resolveCohortSeed(strand.Id, delegatePeerId));
+        // Checked again after the awaits above: another launch of this strand may have started
+        // meanwhile (a replica's watcher launch racing an app's claim, in either order), and
+        // `startStrand` would hand its instance back unchanged — a claim holding a replica with
+        // no `App` tables, a founder request dropped. Nothing awaits between this check and
+        // `startStrand`'s own, so no third launch can slip in.
+        if (this.strandManager.getInstance(strand.Id)) {
+            return this.claimTrackedStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey);
+        }
         const instance = await timed('strandManager.startStrand', () => this.strandManager.startStrand({
             strandRow: strand,
             sAppConfig,
@@ -5046,15 +5349,12 @@ export class CadreNode {
                 this.forgetRevokedJoin(revokedStrandId);
                 this.emit('strand:revoked', { strandId: revokedStrandId });
             },
-            // The strand peer book's observation writer: every strand peer the node
-            // identifies is remembered with its dialable addresses, so a restart re-finds
-            // it. Retained with the launch config, so a hibernation wake re-arms it.
-            onStrandPeerIdentified: (observedStrandId, observation) => this.observeStrandPeer(observedStrandId, observation),
-            // The book's third writer, the signed swap between strand peers: the strand node
-            // reads and writes the store directly (`strand-peer-book-swap.ts`). Retained with
-            // the launch config too. `?? undefined`: the field is `null` before start(), and a
-            // strand cannot launch before start(), so this is belt and braces.
-            strandPeerBook: this.strandPeerBookStore ?? undefined,
+            // Where the strand node saves its network state and what it re-imports when it is
+            // built. Retained with the launch config, so a hibernation wake rebuilds the node
+            // over the table the quiesced node last saved. `?? undefined`: the field is `null`
+            // before start(), and a strand cannot launch before start(), so this is belt and
+            // braces.
+            networkState: this.strandNetworkStateStore ?? undefined,
             onRejoinBlocked: (blockedStrandId) => this.emit('strand:rejoin-blocked', { strandId: blockedStrandId }),
             // The joiner's first-sync write gate (strand-first-sync-gate.ts): a launch that
             // comes up `'syncing'` announces the moment its database is published.
@@ -5089,6 +5389,63 @@ export class CadreNode {
         this.emit('strand:started', { strandId: strand.Id });
         return instance;
     }
+    /**
+     * {@link startOrFoundStrand} for a strand the manager already tracks: a claim of a
+     * storage replica gives it the app's schema in place, then a founder request founds it,
+     * waking a quiesced instance so the bootstrap has run before this resolves. Emits
+     * nothing — `strand:started` fired when the instance launched.
+     *
+     * A launch of the strand still in flight (the watcher's launch racing an app's
+     * `addStrand`, in either order) is waited out first: until its build settles the tracked
+     * instance is `'starting'` with no database, and returning it would resolve `addStrand`
+     * with a strand the app cannot use — and skip that call's first-sync wait, which only a
+     * `'syncing'` instance gets. If that launch fails, this rejects too: its record is gone.
+     */
+    async claimTrackedStrand(strand, sAppConfig, resolvedFounder, explicitPartyKey) {
+        const timed = (step, op) => timedStep('startOrFoundStrand', strand.Id, step, op);
+        const existing = await this.strandManager.whenRuntimeBuilt(strand.Id);
+        if (!existing) {
+            throw new Error(`Strand ${strand.Id}: the launch this one waited on failed (reported by the call that started it)`);
+        }
+        // Before the founder branch: the founder bootstrap writes the sApp into Strand.Header,
+        // so it must run against the attached config.
+        if (sAppConfig && !existing.sAppInfo) {
+            const attached = await timed('attachSApp', () => this.strandManager.attachSApp(strand.Id, sAppConfig, { requireSignedSchemas: this.config.requireSignedSchemas }));
+            log('launchStrand: strand %s was running as a storage replica — sApp %s claimed it (%s)', strand.Id, sAppConfig.id, attached);
+        }
+        if (!resolvedFounder) {
+            log('launchStrand: strand %s already tracked locally — skipping re-launch', strand.Id);
+            return existing;
+        }
+        // The resolver runs only when the retained config lacks a party key for a
+        // closed strand (see foundExistingStrand), so the common watcher re-entry
+        // ('already-founder') still costs no control read.
+        const outcome = await timed('foundExistingStrand', () => this.strandManager.foundExistingStrand(strand.Id, () => this.resolveStrandPartyKey(strand, explicitPartyKey)));
+        if (outcome === 'needs-resume') {
+            try {
+                // Quiesced instance: the retained config now founds, but founding promises
+                // the bootstrap has RUN by the time the caller resolves — wake through the
+                // hibernation manager (coalesced with any in-flight wake, timer-aware) so
+                // the rebuild executes it now rather than at some eventual wake.
+                await timed('wakeStrand', () => this.wakeStrand(strand.Id));
+                // The wake's rebuild founds — UNLESS a wake was already in flight when the
+                // config flipped, in which case it had already read the pre-flip config and
+                // rebuilt as a joiner, and `wakeStrand` merely coalesced onto it. Re-run the
+                // (insert-if-absent) bootstrap so founding never resolves headerless.
+                await timed('ensureFounderBootstrap', () => this.strandManager.ensureFounderBootstrap(strand.Id));
+            }
+            catch (error) {
+                // The founding did not happen (e.g. the rebuild refused a pre-split strand and
+                // rolled back, leaving the instance tracked with no runtime): withdraw the flip
+                // so the next attempt re-runs the founding instead of resolving
+                // 'already-founder' over an instance that never founded.
+                this.strandManager.withdrawFounderRequest(strand.Id);
+                throw error;
+            }
+        }
+        log('launchStrand: strand %s already tracked — founder request honored (%s)', strand.Id, outcome);
+        return existing;
+    }
     /**
      * Resolve a strand's discovery seed — the dialable strand-network multiaddr
      * strings for cohort siblings. Membership comes from the control network's
@@ -5111,37 +5468,17 @@ export class CadreNode {
      * relay reservation — the gate denial there is fatal, not degraded. A
      * party-member relay answers the RPC (its control node admits us as a
      * member); a dedicated ops/ relay does not speak the protocol and the
-     * per-peer failure folds to `[]` — harmless, it has no membership gate and
+     * per-peer failure comes back `unreachable` — harmless, it has no membership gate and
      * needs no grant. The relay's direct addr rides along as the dial fallback
      * for a relay we are not yet connected to.
      */
     async resolveCohortSeed(strandId, delegatePeerId) {
         const siblings = await this.resolveSiblingSeed(strandId, delegatePeerId);
-        // Sibling answers FIRST: they were resolved just now, while a book entry is as old
-        // as the last connection to that peer. `unionAddrs` appends only what the siblings
+        // Sibling answers FIRST: they were resolved just now, while the formation-carried
+        // addresses are as old as the formation. `unionAddrs` appends only what the siblings
         // did not already name, so a fresher answer is never displaced and each source keeps
-        // its own signaling-first ordering. `delegatePeerId` IS this strand node's own id.
-        return unionAddrs(siblings, this.strandPeerBookAddrs(strandId, delegatePeerId));
-    }
-    /**
-     * The strand peer book's contribution to a strand's seed: every live entry's
-     * addresses, freshest peer first, minus this node's own entry when `selfPeerId` is
-     * known (the book swap files one under the strand transport id; a node must never
-     * dial itself). Empty before {@link start} builds the store.
-     */
-    strandPeerBookAddrs(strandId, selfPeerId) {
-        const store = this.strandPeerBookStore;
-        if (!store) {
-            return [];
-        }
-        const addrs = [];
-        for (const entry of store.entries(strandId)) {
-            if (entry.peerId === selfPeerId) {
-                continue;
-            }
-            addrs.push(...entry.addrs);
-        }
-        return addrs;
+        // its own ordering.
+        return unionAddrs(siblings, this.formationStrandAddrs.get(strandId) ?? []);
     }
     /**
      * The own-party half of {@link resolveCohortSeed}: strand-network addresses resolved
@@ -5161,10 +5498,13 @@ export class CadreNode {
             }
         }
         const bootstrapNodes = targets.length
-            ? await collectStrandAddrs(this.controlNode, targets, strandId, { delegatePeerId })
+            ? (await this.collectSiblingStrandAddrs(this.controlNode, targets, strandId, delegatePeerId)).addrs
             : [];
         // Throttle state for the RELAY targets only — refreshDelegateGrants never
-        // looks up a sibling key, so recording one would only be dead weight.
+        // looks up a sibling key, so recording one would only be dead weight. The
+        // siblings' refresh due times are deliberately left alone too: stamping here
+        // would race the refresh pass's pruning while the strand node is still coming
+        // up, and all it would save is one extra RPC per sibling on the first tick.
         this.recordDelegateAnnounces(relays.map((r) => r.relayPeerId), strandId);
         return bootstrapNodes;
     }
@@ -5246,9 +5586,10 @@ export class CadreNode {
      * Record the announce timestamps {@link refreshDelegateGrants} throttles on,
      * for every relay a delegate-carrying announce pass dialed.
      *
-     * Recorded OPTIMISTICALLY at announce time: `collectStrandAddrs` folds
-     * per-peer failure to `[]` and reports no per-peer success, and threading
-     * success out would change its API for little gain. A failed INITIAL announce
+     * Recorded OPTIMISTICALLY at announce time, whatever `collectStrandAddrs`
+     * reports per peer: a dedicated `ops/` relay never speaks the strand-addr
+     * protocol, so recording only on success would re-announce to it on every
+     * reconcile tick, one wasted protocol negotiation each. A failed INITIAL announce
      * costs the strand supervisor its first attempt only (the relay denies the
      * reservation; every re-drive re-announces first through
      * {@link announceDelegateToRelay}); a failed REFRESH retries within
@@ -5284,7 +5625,7 @@ export class CadreNode {
                 running.set(strandId, instance.libp2pNode.peerId.toString());
             }
         }
-        pruneStoppedStrandAnnounces(this.delegateAnnounceAt, new Set(running.keys()));
+        prunePeerStrandKeys(this.delegateAnnounceAt, new Set(running.keys()));
         if (running.size === 0) {
             return;
         }
@@ -5311,16 +5652,16 @@ export class CadreNode {
      * again right away.
      *
      * Against a dedicated ops relay (no strand-addr RPC) the request fails per-peer
-     * and `collectStrandAddrs` folds it to `[]`: one wasted protocol negotiation per
+     * and `collectStrandAddrs` reports it `unreachable`: one wasted protocol negotiation per
      * re-drive attempt, bounded by the supervisor's backoff. Never throws on that
      * path; a relay addr that names no peer id is logged and skipped (the hook's
      * caller runs the drive regardless).
      *
      * NOTE: against a relay that is DOWN this hook costs up to two strand-addr
-     * timeouts (10 s each: dial by peer id, then by addr) before the reservation drive even
-     * starts, so one failed re-drive holds the supervisor `driving` for those 20 s plus the
-     * drive's own deadline — 34 s at the default declared link round trip, and longer on a host
-     * that declared a slower one (`link-budget.ts`).
+     * timeouts (dial by peer id, then by addr; 23 s each at the default declared link round trip)
+     * before the reservation drive even starts, so one failed re-drive holds the supervisor
+     * `driving` for those 46 s plus the drive's own deadline — 64 s at the default, and longer on
+     * a host that declared a slower one (`link-budget.ts`).
      * Bounded and harmless while the relay is unreachable anyway; if recovery
      * latency after a relay comes back ever matters, skip the announce when the
      * control node holds no connection to the relay (the drive's own dial fails
@@ -5336,7 +5677,7 @@ export class CadreNode {
             log('announceDelegateToRelay: relay addr %s names no peer id; strand %s not announced', relayAddr, strandId);
             return;
         }
-        await collectStrandAddrs(controlNode, [{ peerId: relayPeerId, addrs: [multiaddr(relayAddr)] }], strandId, { delegatePeerId });
+        await this.collectSiblingStrandAddrs(controlNode, [{ peerId: relayPeerId, addrs: [multiaddr(relayAddr)] }], strandId, delegatePeerId);
         this.recordDelegateAnnounces([relayPeerId], strandId);
     }
     /** One strand's share of {@link refreshDelegateGrants}: announce to the relays whose grant is due. */
@@ -5349,21 +5690,29 @@ export class CadreNode {
         if (due.length === 0) {
             return;
         }
-        await collectStrandAddrs(controlNode, due.map(relayStrandAddrPeer), strandId, { delegatePeerId });
+        await this.collectSiblingStrandAddrs(controlNode, due.map(relayStrandAddrPeer), strandId, delegatePeerId);
         this.recordDelegateAnnounces(due.map((relay) => relay.relayPeerId), strandId, now);
     }
     /**
-     * Re-resolve each running strand's SIBLING addresses over the control mesh and
-     * merge them into that strand's own libp2p address book, throttled to once per
-     * {@link STRAND_PEER_ADDR_REFRESH_MS} per strand.
+     * Keep each running strand's own libp2p address book warm: re-merge the address
+     * records its FRET routing table holds on every pass
+     * ({@link remergeStrandFretRecords}), and re-ask each connected SIBLING for its
+     * strand addresses over the control mesh when that (sibling, strand) is due
+     * ({@link strandAddrAskDueAt}).
      *
-     * Without this, a strand's address book is written exactly once — the
+     * Without this, cadre-core writes a strand's address book exactly once — the
      * launch/resume seed — and everything below cadre-core that dials a strand peer
      * by bare peer id (Optimystic's cluster and repo clients, FRET ping/announce)
-     * loses its address for any sibling it is not currently connected to: a sibling
+     * loses its address for any peer it is not currently connected to: a sibling
      * that restarted its strand node or rotated its relay reservation is never
-     * re-resolved, and even the original seed addresses fall off at the peerStore's
-     * one-hour expiry (see `peer-addr-book.ts`).
+     * re-resolved, and every address, another party's included, falls off at the
+     * peerStore's one-hour expiry (see `peer-addr-book.ts`).
+     *
+     * Due times are per (sibling, strand) and set from each sibling's own outcome, so
+     * a sibling that connects late — a phone joining after the party's always-on
+     * machines — is asked on the next tick, and one that could not answer or refused
+     * (its view of the membership may not include us yet) is retried within
+     * {@link STRAND_PEER_ADDR_RETRY_MS} rather than {@link STRAND_PEER_ADDR_REFRESH_MS}.
      *
      * Distinct from {@link refreshDelegateGrants}, deliberately: that pass covers
      * RELAYS on a `DELEGATE_GRANT_TTL_MS / 2` throttle to keep circuit-relay
@@ -5388,54 +5737,65 @@ export class CadreNode {
                 running.add(strandId);
             }
         }
-        // Drop stamps for strands no longer running: the map must not grow for the
-        // node's lifetime, and a resumed strand should refresh immediately rather
-        // than inherit the stamp its previous incarnation left.
-        for (const strandId of this.strandPeerAddrRefreshAt.keys()) {
-            if (!running.has(strandId)) {
-                this.strandPeerAddrRefreshAt.delete(strandId);
-            }
-        }
-        const refreshMs = this.config.network?.controlCohort?.strandAddrRefreshMs ?? STRAND_PEER_ADDR_REFRESH_MS;
-        const due = [...running].filter((strandId) => now - (this.strandPeerAddrRefreshAt.get(strandId) ?? 0) >= refreshMs);
-        if (due.length === 0) {
+        if (running.size === 0) {
+            this.strandAddrAskDueAt.clear();
             return;
         }
-        // `connectedSiblingTargets`' membership read is unbounded, and with zero
-        // connections its answer is empty whatever the table holds, so decide it from the
-        // connection list instead of paying for the read once a tick. Note this only skips
-        // the RPC: a strand with peer-book entries still refreshes below, because those
-        // never came from a sibling in the first place.
-        //
-        // NOTE: one strand-addr RPC per (due strand × connected sibling) per refresh
-        // interval — each a tiny request/response on an already-open control
-        // connection. If a node ever runs MANY strands at once, batch the RPC to
-        // carry several strand ids per request rather than one fan-out per strand.
-        const targets = this.controlNode.getConnections().length === 0
-            ? []
-            : await this.connectedSiblingTargets().catch((error) => {
-                log('refreshStrandPeerAddrs: sibling enumeration failed (skipping pass): %o', error);
-                return [];
-            });
+        const targets = await this.strandAddrRefreshTargets();
         // A shutdown landed mid-enumeration.
         if (!this._running || !this.controlNode) {
             return;
         }
-        await Promise.all(due.map((strandId) => this.refreshOneStrandPeerAddrs(strandId, targets, now)));
+        // Drop due times for strands no longer running and siblings no longer connected:
+        // the map must not grow for the node's lifetime, a resumed strand must not
+        // inherit its previous incarnation's due times, and a sibling that reconnects (a
+        // phone restart, a new relay reservation) must be asked on its next connected
+        // tick. An enumeration failure prunes everything, which costs one extra round of
+        // asks, never a missed one.
+        prunePeerStrandKeys(this.strandAddrAskDueAt, running, new Set(targets.map((t) => t.peerId)));
+        await Promise.all([...running].map((strandId) => this.refreshOneStrandPeerAddrs(strandId, targets, now)));
+    }
+    /**
+     * The siblings {@link refreshStrandPeerAddrs} may ask this pass: the connected
+     * cohort, or none when enumeration fails (logged, never thrown).
+     *
+     * `connectedSiblingTargets`' membership read is unbounded, and with zero
+     * connections its answer is empty whatever the table holds, so decide it from the
+     * connection list instead of paying for the read once a tick.
+     *
+     * NOTE: otherwise the read runs on EVERY tick with a running strand, not only when
+     * some (sibling, strand) is due: pruning a departed sibling needs the current
+     * target set, and whether anyone is due cannot be told without it (a connected
+     * non-member never gets a due time to compare). One more `CadrePeer` read per 15 s
+     * tick, on top of the two `runReconcileControlCohort` already makes; if those reads
+     * get costly, share one row-set across the pass (see the NOTE there) rather than
+     * skipping ticks here.
+     *
+     * NOTE: one strand-addr RPC per (running strand × due sibling) — each a tiny
+     * request/response on an already-open control connection. If a node ever runs
+     * MANY strands at once, batch the RPC to carry several strand ids per request
+     * rather than one fan-out per strand.
+     */
+    async strandAddrRefreshTargets() {
+        if (this.controlNode?.getConnections().length === 0) {
+            return [];
+        }
+        return this.connectedSiblingTargets().catch((error) => {
+            log('refreshStrandPeerAddrs: sibling enumeration failed (asking nobody this pass): %o', error);
+            return [];
+        });
     }
     /**
-     * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings, union their
-     * answers with this strand's peer-book addresses, and merge the lot into the strand's
-     * address book. Errors are logged and swallowed so one strand's failure never costs
-     * the others their refresh.
+     * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings that are
+     * due and merge their answers into the strand's address book, then re-merge the
+     * address records the strand node's FRET table holds. Errors are logged and
+     * swallowed so one strand's failure never costs the others their refresh.
      *
-     * `targets` may be EMPTY — a solo node, or one whose only control peers are strangers.
-     * The peer-book addresses still have to be re-merged in that case: nothing re-resolves
-     * another party's addresses, so this periodic re-merge is the ONLY thing standing
-     * between them and the peerStore's one-hour expiry. A strand with neither a sibling to
-     * ask nor a book entry does nothing and leaves its throttle unstamped, so the next
-     * reconcile tick retries rather than sitting out the whole refresh interval having
-     * done nothing.
+     * The sibling half runs first, so a failure reading the FRET table cannot cost a
+     * sibling answer its merge. The FRET half, and the formation-carried addresses of
+     * the peers it holds no record for, run on EVERY pass, whether or not any sibling is
+     * due or connected — see {@link remergeStrandFretRecords} and
+     * {@link remergeUnrecordedFormationAddrs} for why.
      */
     async refreshOneStrandPeerAddrs(strandId, targets, now) {
         const controlNode = this.controlNode;
@@ -5446,42 +5806,124 @@ export class CadreNode {
         try {
             // Inside the try: a strand node torn down mid-pass may throw on any read, and one
             // strand's failure must never cost the others their refresh.
-            const contactAddrs = this.strandPeerBookAddrs(strandId, strandNode.peerId.toString());
-            if (targets.length === 0 && contactAddrs.length === 0) {
-                return;
-            }
+            const strandPeerId = strandNode.peerId.toString();
+            const due = targets.filter((target) => now >= (this.strandAddrAskDueAt.get(peerStrandKey(target.peerId, strandId)) ?? 0));
             // The running strand node's own peerId is the delegate to announce — see
             // the relationship note on refreshStrandPeerAddrs.
-            const siblingAddrs = targets.length === 0
+            const siblingAddrs = due.length === 0
                 ? []
-                : await collectStrandAddrs(controlNode, [...targets], strandId, {
-                    delegatePeerId: strandNode.peerId.toString()
-                });
-            // Stamped on the pass having happened, not on its answer: the fan-out is
-            // what the throttle exists to bound, and an all-empty round is a normal
-            // steady state for a strand no connected sibling currently runs.
-            this.strandPeerAddrRefreshAt.set(strandId, now);
-            // Re-read the instance after the await — a strand stopped mid-pass (or one
-            // already restarted onto a new node) must never have its store written to.
-            if (!this._running || this.strandManager.getInstance(strandId)?.libp2pNode !== strandNode) {
+                : await this.askSiblingsForStrandAddrs(controlNode, due, strandId, strandPeerId, now);
+            if (!this.isRunningStrandNode(strandId, strandNode)) {
                 return;
             }
-            await this.mergeStrandPeerAddrs(strandNode, unionAddrs(siblingAddrs, contactAddrs), strandId);
+            if (siblingAddrs.length > 0) {
+                await this.mergeStrandPeerAddrs(strandNode, siblingAddrs, strandId);
+            }
+            const recorded = await this.remergeStrandFretRecords(strandNode, strandId);
+            await this.remergeUnrecordedFormationAddrs(strandNode, strandId, recorded);
         }
         catch (error) {
             log('refreshStrandPeerAddrs: strand %s refresh failed (continuing): %o', strandId, error);
         }
     }
+    /**
+     * Is `strandNode` still the node `strandId` runs on? Asked again after every await
+     * in a refresh pass: a strand stopped mid-pass, or one already restarted onto a new
+     * node, must never have its store written to.
+     */
+    isRunningStrandNode(strandId, strandNode) {
+        return this._running && this.strandManager.getInstance(strandId)?.libp2pNode === strandNode;
+    }
+    /**
+     * Re-merge, into a running strand node's address book, the addresses of every peer
+     * its FRET routing table holds a signed address record for (`strand-fret-addrs.ts`).
+     *
+     * This is what keeps ANOTHER PARTY's strand nodes dialable from a node that stays
+     * up. Nothing re-resolves their addresses — the strand-addr RPC answers own-party
+     * siblings only — and the peerStore hides an address one hour after it was first
+     * observed. FRET keeps each peer's record but hands it to the peerStore only when it
+     * arrives or is imported, so without this pass a connection to another party that
+     * drops after the first hour could not be redialed by either side.
+     *
+     * A record is held while FRET holds the peer's table entry, and at most 14 days after
+     * it was last confirmed, so that is also how long a wrong address can keep being
+     * re-merged. Each record is signed by the peer it names and verified before use, so
+     * the exposure is failed dials to an address that peer itself published.
+     *
+     * NOTE: every pass serialises the whole FRET table (`exportTable()`), verifies one
+     * signature per record and makes one `peerStore.merge` per peer, per running strand
+     * per 15 s tick. Fine at strand table sizes, and an unchanged address set writes
+     * nothing in libp2p's persistent peer store. If many strands or large tables make it
+     * show up, read only the entries whose address stamp is near the one-hour mark.
+     *
+     * @returns the ids of the peers the table holds a usable record for.
+     */
+    async remergeStrandFretRecords(strandNode, strandId) {
+        const { peers, rejected } = await strandFretPeerAddrs(strandNode);
+        const recorded = new Set(peers.keys());
+        if ((peers.size === 0 && rejected === 0) || !this.isRunningStrandNode(strandId, strandNode)) {
+            return recorded;
+        }
+        const counts = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
+        for (const [peerId, addrs] of peers) {
+            counts[await mergePeerAddrs(strandNode, peerId, addrs)]++;
+        }
+        log('strand %s FRET address records re-merged (peers=%d, merged=%d, restamped=%d, failed=%d, rejected=%d)', strandId, peers.size, counts.merged, counts.restamped, counts.failed, rejected);
+        return recorded;
+    }
+    /**
+     * Re-merge the addresses this strand's formation carried ({@link formationStrandAddrs})
+     * for every peer the strand node's FRET table holds no record for (`recorded`).
+     *
+     * Until the first connection to the responder, the carried addresses are the only
+     * thing naming it, and the launch seed writes them once. FRET's `bootstraps` keep only
+     * the peer id, so if the responder stays unreachable past the peerStore's one-hour
+     * expiry, nothing could dial it when it returns. Once FRET holds the peer's own signed
+     * record, that record supersedes what the formation carried and this stops.
+     */
+    async remergeUnrecordedFormationAddrs(strandNode, strandId, recorded) {
+        const carried = this.formationStrandAddrs.get(strandId);
+        if (!carried) {
+            return;
+        }
+        const unrecorded = [...groupAddrsByPeerId(carried)]
+            .filter(([peerId]) => !recorded.has(peerId))
+            .flatMap(([, addrs]) => addrs.map((addr) => addr.toString()));
+        if (unrecorded.length === 0 || !this.isRunningStrandNode(strandId, strandNode)) {
+            return;
+        }
+        await this.mergeStrandPeerAddrs(strandNode, unrecorded, strandId);
+    }
+    /**
+     * RPC `due` siblings for `strandId` and set each one's next due time from its own
+     * outcome: an answer, even an empty one, waits the full refresh interval; anything
+     * else retries in {@link STRAND_PEER_ADDR_RETRY_MS} (or the refresh interval, if
+     * configured shorter). Stamped before the caller
+     * re-checks that the strand is still running, so a strand torn down mid-pass still
+     * records who was asked.
+     */
+    async askSiblingsForStrandAddrs(controlNode, due, strandId, delegatePeerId, now) {
+        const { addrs, outcomes } = await this.collectSiblingStrandAddrs(controlNode, [...due], strandId, delegatePeerId);
+        const refreshMs = this.config.network?.controlCohort?.strandAddrRefreshMs ?? STRAND_PEER_ADDR_REFRESH_MS;
+        // A configured refresh shorter than the retry must not leave a failing sibling
+        // waiting longer than a healthy one.
+        const retryMs = Math.min(refreshMs, STRAND_PEER_ADDR_RETRY_MS);
+        for (const [peerId, outcome] of outcomes) {
+            const waitMs = siblingAnswered(outcome) ? refreshMs : retryMs;
+            this.strandAddrAskDueAt.set(peerStrandKey(peerId, strandId), now + waitMs);
+        }
+        return addrs;
+    }
     /**
      * Merge strand-network addresses into ONE strand node's libp2p address book,
      * attributed per peer. Best-effort throughout: an address-book write must never
      * fail a launch, a resume, or a reconcile pass.
      *
-     * `addrs` is the peer-agnostic union the strand-addr RPC returns, so
-     * {@link groupAddrsByPeerId} attributes each entry to the **strand transport**
-     * peerId in its final `/p2p/` component — never the sibling's control peerId,
-     * which names a different libp2p node entirely. Entries that name no peer are
-     * dropped there and counted here, once per pass.
+     * `addrs` is a peer-agnostic list — the union the strand-addr RPC returns, or the
+     * addresses a formation carried — so {@link groupAddrsByPeerId} attributes each
+     * entry to the **strand transport** peerId in its final `/p2p/` component — never
+     * the sibling's control peerId, which names a different libp2p node entirely.
+     * Entries that name no peer are dropped there and counted here, once per pass.
      *
      * NOTE: a member could answer with arbitrary multiaddrs bound to arbitrary peer
      * ids and poison this address book. That is the same exposure the launch-time
@@ -5491,14 +5933,13 @@ export class CadreNode {
      * peerStore's one-hour expiry. No new gating here — cross-party strand trust is
      * `backlog/strand-network-nat-relay-reachability`.
      *
-     * NOTE: one input ages out on a slower clock — the strand peer book's entries
-     * ({@link strandPeerBookStore}). Nothing can re-resolve another party's addresses,
-     * so {@link refreshStrandPeerAddrs} re-merges the book every pass, which means a
-     * junk entry from a responder or a peer's identify survives until the book drops it
-     * (14 days unrefreshed, or the peer's next connection replacing the entry) rather
-     * than an hour. Bounded to 16 peers × 16 addrs per strand, forgotten on
-     * `unpublishStrand` / `forgetJoinedStrand`, and still authority-free — so the
-     * exposure is a handful of failed dials, not a trust hole.
+     * NOTE: one input outlives that hour — a formation's carried addresses
+     * ({@link formationStrandAddrs}) are in every launch and resume seed for as long as
+     * this process remembers the formation, and re-merged on every refresh pass until the
+     * strand node's FRET table holds the peer's own record, so a junk address from a
+     * responder that is never met keeps being re-merged. Bounded by `sanitizeStrandAddrs`,
+     * replaced by a re-formation, dropped on `unpublishStrand` / `forgetJoinedStrand`, and
+     * still authority-free — so the exposure is a handful of failed dials, not a trust hole.
      */
     async mergeStrandPeerAddrs(strandNode, addrs, strandId) {
         const counts = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
@@ -5547,7 +5988,7 @@ export class CadreNode {
         // is normally a no-op; it is the guard for a bare listen addr and for a relay hop
         // whose trailing `/p2p/` names the RELAY. An addr terminating in a DIFFERENT id is
         // dropped rather than announced — it does not reach this node, and announcing it
-        // would file our address under someone else's id in the receiver's book.
+        // would file our address under someone else's id in the receiver's address book.
         //
         // Re-parsed through this package's own `multiaddr` rather than passed straight in:
         // libp2p hands back its nested `@multiformats/multiaddr` copy, a structurally
@@ -5565,27 +6006,36 @@ export class CadreNode {
         return orderSignalingFirst(addrs);
     }
     /**
-     * Leave a strand joined from another party: forget its remembered join, so no later
-     * start re-offers it, then {@link stopStrand} it here. The "leave" a joiner has, since it
-     * cannot {@link unpublishStrand} a row its party's control database never held. For one
-     * of this party's own strands the forget is a no-op and this is just {@link stopStrand}.
+     * Leave a strand joined from another party, for the whole party: remove its party-wide
+     * `JoinedStrand` row (owner-signed, with a `Revocation` tombstone), then this machine's
+     * unpublished record, its formation-carried addresses, its saved network state and any
+     * session-kept entry, then
+     * {@link stopStrand} it here. Every other machine's watcher then sees the row gone and
+     * detaches the strand, a storage replica included; a machine offline at the time reaps the
+     * row once the tombstone reaches it. The joiner's counterpart of {@link unpublishStrand},
+     * which only works on a row the party's own `Strand` table holds. For one of those, or for
+     * a join still local-only, there is no party-wide row and this is a local forget plus
+     * {@link stopStrand}.
      *
-     * Touches nothing beyond this node — the other members are not told, and this party's
-     * membership row in the strand stays.
+     * The other members of the strand are not told, and this party's membership row in the
+     * strand stays, so a later re-formation reuses the same identity.
+     *
+     * @throws when a party-wide row exists and this machine cannot sign its removal (not an
+     *   enrolled owner) — {@link stopStrand} stops the strand on this machine only — or when
+     *   the party-wide table cannot be read.
      */
     async forgetJoinedStrand(strandId) {
         if (!this._running) {
             throw new Error('CadreNode not running');
         }
-        await this.joinedStrandRows.forget(strandId);
+        await this.joinedStrands.leave(strandId);
         this.forgetStrandPeers(strandId, 'forgetJoinedStrand');
         await this.stopStrand(strandId);
     }
     /**
-     * Record `row` as a join from another party when this party's control database holds no
-     * row for it — the one case nothing else would re-offer after a restart. Skips the write
-     * when an identical record is already there (an app re-claiming a remembered join on
-     * every start), and keeps the first `joinedAt`.
+     * Record `row` as a join from another party when this party's control database names it
+     * neither as its own strand nor as a party-wide join — the one case nothing else would
+     * re-offer after a restart (`JoinedStrandSession.rememberForeign`).
      *
      * Best-effort, for {@link addStrand}: a failure costs the strand its re-offer after the
      * next restart, not this attach, so it is reported and the attach goes on.
@@ -5599,24 +6049,11 @@ export class CadreNode {
      * tombstone here before recording.
      */
     async rememberForeignStrand(row) {
-        const store = this.joinedStrandStore;
-        if (!store || !this.controlDatabase) {
+        if (!this.joinedStrands || !this.controlDatabase) {
             return;
         }
         try {
-            if (await this.controlDatabase.queryStrand(row.Id)) {
-                return;
-            }
-            const existing = (await store.list()).find((record) => record.Id === row.Id);
-            if (existing?.Type === row.Type && existing.MemberPrivateKey === row.MemberPrivateKey) {
-                return;
-            }
-            await store.record({
-                Id: row.Id,
-                Type: row.Type,
-                MemberPrivateKey: row.MemberPrivateKey,
-                joinedAt: existing?.joinedAt ?? Date.now()
-            });
+            await this.joinedStrands.rememberForeign(row);
         }
         catch (error) {
             console.warn(`addStrand(${row.Id}): could not remember this strand as joined from another party, ` +
@@ -5624,66 +6061,47 @@ export class CadreNode {
         }
     }
     /**
-     * Self-revocation arm of the joined-strand record: a party removed from a strand must
-     * not re-attach it on every launch. The strand keeps running this session — the
-     * `strand:revoked` contract is that nothing is torn down for the app — and is gone
-     * after the next start. The join record is a no-op for this party's own strands, which
-     * have none; the strand peer book is forgotten either way, since a removed party must
-     * not keep dialing the strand's peers.
+     * Self-revocation arm of the joined-strand records: a party removed from a strand must
+     * not re-attach it on every launch of every machine. The strand keeps running this
+     * session here — the `strand:revoked` contract is that nothing is torn down for the app —
+     * and its party-wide row is queued for removal by the next connected owner reconcile pass
+     * (`JoinedStrandSession.forgetAfterThisSession`). A no-op for this party's own strands,
+     * which have neither record; the formation-carried addresses and the saved network
+     * state are forgotten either way, since a removed party must not keep dialing the
+     * strand's peers.
+     *
+     * NOTE: accepted tradeoff — a sibling machine that has not raised `strand:revoked` itself
+     * detaches the strand (`strand:stopped`) when the party-wide removal reaches it, instead
+     * of keeping it for the session, which weakens "nothing is stopped on the removed
+     * machine's behalf" for siblings. Weighed against a party-wide row that brings a revoked
+     * strand back on every start of every machine. Revisit if apps need the "you were
+     * removed" screen on every device: the sibling could re-check its own revocation state
+     * (`refreshRevocationEnforcement`) before detaching a vanished joined row.
      *
      * NOTE: a manager can re-admit a removed party directly (`addMemberByManager`), and the
-     * membership loop then finishes the join on its own — but the record is gone by then, so
-     * the next start does not re-attach the strand. Re-forming records it again. If direct
+     * membership loop then finishes the join on its own — but the records are gone by then,
+     * so the next start does not re-attach the strand. Re-forming records it again. If direct
      * re-admission becomes a routine flow, re-record the join when the revoked-peer gate
      * clears for this node.
      */
     forgetRevokedJoin(strandId) {
-        void this.joinedStrandRows?.forgetAfterThisSession(strandId).catch((error) => {
+        void this.joinedStrands?.forgetAfterThisSession(strandId).catch((error) => {
             log('forgetting revoked joined strand %s failed; it will be re-offered on the next start: %o', strandId, error);
         });
         // The strand's peers go with the join: a removed party must not keep dialing them.
         this.forgetStrandPeers(strandId, 'self-revocation');
     }
     /**
-     * Forget a strand's entries in the peer book (see {@link strandPeerBookStore}):
-     * fire-and-log, like every book write — the removal is visible synchronously by the
-     * store's contract, and a failed persist costs restart survival only.
+     * Forget what this node holds about a strand's peers: the addresses its formation
+     * carried (see {@link formationStrandAddrs}) and its saved network state (see
+     * {@link strandNetworkStateStore}). The store write is fire-and-log — the removal is
+     * visible synchronously by the store's contract, and a failed persist only leaves the
+     * entry on disk for the next start.
      */
     forgetStrandPeers(strandId, caller) {
-        void this.strandPeerBookStore?.forget(strandId).catch((error) => {
-            log('%s: forgetting strand %s peers failed (continuing): %o', caller, strandId, error);
-        });
-    }
-    /**
-     * The strand peer book's observation writer (`StartStrandConfig.onStrandPeerIdentified`):
-     * a strand node identified a strand peer at `observation.addrs`, so remember it as an
-     * unsigned entry seen just now. The observer never reports self, and the store binds
-     * every address to the peer id before filing it.
-     */
-    observeStrandPeer(strandId, observation) {
-        this.rememberStrandPeer(strandId, {
-            peerId: observation.peerId,
-            addrs: observation.addrs,
-            issuedAt: 0,
-            lastSeenAt: Date.now()
-        }, 'observeStrandPeer');
-    }
-    /**
-     * Merge one entry into the peer book. Fire-and-log: the entry is visible
-     * synchronously by the store's contract, and the promise tracks durability only. A
-     * persist failure costs restart survival, never this session's seed — the same trade
-     * {@link retainDialTarget} makes.
-     */
-    rememberStrandPeer(strandId, entry, caller) {
-        const store = this.strandPeerBookStore;
-        if (!store) {
-            // Unreachable in production: start() builds the store before any strand can
-            // launch or form. Logged rather than thrown, for the same reason as retainDialTarget.
-            log('%s: no strand peer book yet — not remembering %s for strand %s', caller, entry.peerId, strandId);
-            return;
-        }
-        void store.merge(strandId, entry).catch((error) => {
-            log('%s: persisting strand %s peer %s failed (continuing): %o', caller, strandId, entry.peerId, error);
+        this.formationStrandAddrs.delete(strandId);
+        void this.strandNetworkStateStore?.forget(strandId).catch((error) => {
+            log('%s: forgetting strand %s network state failed (continuing): %o', caller, strandId, error);
         });
     }
     /**
@@ -5774,10 +6192,19 @@ export class CadreNode {
         void this.pushFanoutService?.notify(strandId, reason);
     }
     /**
-     * Force wake a hibernating strand
+     * Force wake a hibernating strand. A requested wake is activity, recorded before the
+     * wake starts: a check-in holding the strand — or rebuilding it, a rebuild this wake then
+     * joins — leaves it up instead of re-quiescing it at the end of its window. Once awake the
+     * strand's idle countdown runs, so it hibernates again if nothing uses it.
      */
     async wakeStrand(strandId) {
-        await this.hibernationManager.wakeStrand(strandId);
+        const instance = this.strandManager.getInstance(strandId);
+        if (!instance) {
+            log('wakeStrand: strand %s not found; nothing to wake', strandId);
+            return;
+        }
+        instance.lastActivity = new Date();
+        await this.hibernationManager.wakeStrand(instance);
     }
     // ============================================================================
     // Mobile background lifecycle primitives
@@ -5793,7 +6220,7 @@ export class CadreNode {
      * Routes through {@link HibernationManager.forceHibernate}, which cancels the
      * strand's pending idle/hibernate (and check-in) timers — so a stale timer
      * can't re-fire on or resurrect the strand — then runs the same `onHibernate`
-     * path as the timer (`quiesceStrand` + `status='hibernating'` +
+     * path as the timer (`quiesceStrand`, which marks it `hibernating`, then
      * `strand:hibernating`). Unlike the timer path it does NOT re-arm check-ins:
      * the strand stays down until the caller drives a wake (e.g. {@link serviceWake}).
      */
@@ -5854,9 +6281,14 @@ export class CadreNode {
      * strand share one in-flight operation ({@link serviceWakePromises}), and the
      * underlying resume coalesces with a racing push-wake via
      * {@link HibernationManager}'s wake coalescing — one runtime build, one window,
-     * one re-hibernate decision. Returns `{ serviced: false }` (never throws) when
-     * the node is not running or the strand is unknown, and surfaces a resume
-     * failure as `{ serviced: true, hadActivity: false }` after re-hibernating.
+     * one re-hibernate decision. A wake or activity from elsewhere that lands during
+     * the resume or the window leaves the strand up; this call's own wake does not.
+     * Afterwards a strand left up has its idle countdown running, and a re-hibernated one
+     * gets back the check-in chain this call interrupted — it never gains one it lacked,
+     * so a strand the mobile runner force-hibernated stays down until the next push.
+     * Returns `{ serviced: false }` (never throws) when
+     * the node is not running or the strand is unknown, and surfaces a wake or
+     * window failure as `{ serviced: true, hadActivity: false }`.
      *
      * @param strandId - the strand a push said has pending activity.
      * @param opts.windowMs - override the live-window duration (defaults to the
@@ -5890,30 +6322,58 @@ export class CadreNode {
             log('serviceWake: strand %s unknown to this node; not serviced', strandId);
             return { strandId, serviced: false, hadActivity: false };
         }
-        // Already live (active or idle — both retain their runtime): servicing is a
-        // no-op success. Do NOT run a window that would re-hibernate a strand the app
-        // may be actively using, and do NOT rebuild a second runtime.
-        if (instance.libp2pNode || instance.database) {
+        // Already live (active or idle — both retain their runtime) or coming up (a launch,
+        // or a check-in with its own window): servicing is a no-op success. Do NOT run a
+        // window that would re-hibernate a strand the app may be actively using, and do NOT
+        // rebuild a second runtime. `'starting'` counts before any handle is attached. A strand
+        // being quiesced does not count: the wake below rebuilds it after the quiesce.
+        if (!this.strandManager.isQuiescing(strandId)
+            && (instance.status === 'starting' || instance.libp2pNode || instance.database)) {
             log('serviceWake: strand %s already live; no-op success', strandId);
             return { strandId, serviced: true, hadActivity: true };
         }
+        // Before the resume, as the check-in takes it (see handleStrandCheckIn).
+        // NOTE: a `wakeStrand` already resuming when this runs stamped its activity before this
+        // mark, so the probe joins it without counting it and the window can re-hibernate a strand
+        // that wake asked to keep up; if foreground wakes and serviceWake overlap in practice, mark
+        // before the joined wake's stamp instead.
+        const activityMark = instance.lastActivity;
+        const windowMs = opts?.windowMs ?? this.config.hibernation?.checkInWindowMs ?? DEFAULT_CHECKIN_WINDOW_MS;
+        try {
+            return await this.wakeAndHoldForService(instance, activityMark, windowMs);
+        }
+        finally {
+            // After the window (or a failure) decided the state: the idle countdown if the strand
+            // stayed up, else the check-in chain this probe interrupted, if any.
+            this.hibernationManager.endProbe(instance);
+        }
+    }
+    /**
+     * The wake and window of {@link runServiceWake}. A failure in either — the network
+     * unreachable inside a Doze grant, say — must not throw out of a background task, so it
+     * reports no activity. Each stage cleans up only what it owns.
+     */
+    async wakeAndHoldForService(instance, activityMark, windowMs) {
+        const { strandId } = instance;
+        try {
+            // Coalesced resume: HibernationManager.beginWake, so a racing push-wake shares this
+            // single runtime build. Not through `wakeStrand`, which records the wake as activity:
+            // this probe's own wake must not count as a reason to stay up.
+            await this.hibernationManager.probeWake(instance);
+        }
+        catch (error) {
+            // handleStrandWake has already re-hibernated a failed rebuild, and left alone a strand
+            // it failed before building, which may be a check-in's.
+            log('serviceWake: wake of strand %s failed: %o', strandId, error);
+            return { strandId, serviced: true, hadActivity: false };
+        }
         try {
-            // Coalesced resume: routes through wakeStrand → HibernationManager.beginWake
-            // so a racing push-wake shares this single runtime build.
-            await this.wakeStrand(strandId);
-            const windowMs = opts?.windowMs ?? this.config.hibernation?.checkInWindowMs ?? DEFAULT_CHECKIN_WINDOW_MS;
-            const hadActivity = await this.runWakeWindow(instance, windowMs);
+            const hadActivity = await this.runWakeWindow(instance, activityMark, windowMs);
             return { strandId, serviced: true, hadActivity };
         }
         catch (error) {
-            // Resume failing mid-window (network unreachable inside a Doze grant, etc.)
-            // must not throw out of a background task: re-hibernate and report no
-            // activity, mirroring handleStrandCheckIn's re-hibernate-on-error.
             log('serviceWake: strand %s failed during wake window; re-hibernating: %o', strandId, error);
-            await this.strandManager.quiesceStrand(strandId).catch((cleanupErr) => {
-                log('serviceWake cleanup quiesce for strand %s failed: %o', strandId, cleanupErr);
-            });
-            instance.status = 'hibernating';
+            await this.rehibernateAfterFailedResume(instance, 'serviceWake');
             return { strandId, serviced: true, hadActivity: false };
         }
     }
@@ -5946,8 +6406,8 @@ export class CadreNode {
      *
      * BUDGET: the supervisor's first attempt is what `start()` waits on — deliberately the drive's
      * ordinary deadline rather than a boot-specific one. That deadline is now COUNTED, four link
-     * round trips at the declared `network.linkRoundTripMs` (14 s at its default, where it was a
-     * fixed 10 s): a healthy dial-plus-reserve is sub-second even over a WAN, so this is slack for
+     * round trips at the declared `network.linkRoundTripMs` plus the relay's two admission
+     * decisions (18 s at its default, where it was a fixed 10 s): a healthy dial-plus-reserve is sub-second even over a WAN, so this is slack for
      * a slow link, while going much longer would make a dead relay indistinguishable from a hung
      * start and much shorter would fail nodes on links that were merely slow. A host that declares
      * a slower link lengthens it without touching this path — `link-budget.ts`. The retries carry
@@ -6086,7 +6546,7 @@ export class CadreNode {
      *
      * @param ownerPrivateKey - The owner's private key (base64url encoded)
      */
-    initializeSeedBootstrap(ownerPrivateKey) {
+    async initializeSeedBootstrap(ownerPrivateKey) {
         if (!this.controlNode || !this.controlDatabase) {
             throw new Error('CadreNode must be started before initializing seed bootstrap');
         }
@@ -6110,18 +6570,16 @@ export class CadreNode {
                 .trust(ed25519PublicKeyFromPrivate(ownerPrivateKey), 'genesis')
                 .catch((error) => log('Trusted-owner genesis anchor persist failed: %o', error));
         }
-        this.seedBootstrapService = new SeedBootstrapService({
+        await this.installSeedBootstrapService(new SeedBootstrapService({
             partyId: this.config.controlNetwork.partyId,
             ownerPrivateKey,
             inviteAddressResolver: () => this.resolveInviteAddresses(),
-            dialBudget: this.controlDialBudget(),
+            ...this.seedServiceBudgets(),
             trustPolicy: this.config.seedTrustPolicy,
             // Seed trust anchors on the node-local store (seeded just above with this
             // node's own genesis key), never on the replicated OwnerKey table.
             ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
-        });
-        this.seedBootstrapService.setEventCallbacks(this.seedEventCallbacks());
-        this.seedBootstrapService.initialize(this.controlNode, this.controlDatabase);
+        }), this.controlNode, this.controlDatabase);
         log('Seed bootstrap service initialized');
     }
     /**
@@ -6318,7 +6776,8 @@ export class CadreNode {
      * is reachable through its circuit-relay address), dials `WAKE_PROTOCOL`, sends
      * the {@link WakeRequest}, and returns the peer's {@link WakeAck}. The receiver
      * gates the request on cadre membership and only resumes a strand it already
-     * participates in.
+     * participates in; it acks once it has decided, before the strand is up. The
+     * dial deadlines derive from this node's `network.linkRoundTripMs`.
      *
      * @param targetPeerId - The hibernating cadre peer to wake.
      * @param strandId - The strand the caller knows has pending activity.
@@ -6334,14 +6793,14 @@ export class CadreNode {
             throw new Error(`No dialable control-network address for peer ${targetPeerId}`);
         }
         const request = { strandId, reason };
-        return await dialWake(this.controlNode, addrs, request);
+        return await dialWake(this.controlNode, addrs, request, { linkRoundTripMs: this.config.network?.linkRoundTripMs });
     }
     /**
      * Enable the seed listener for receiving seeds via the /sereus/seed/1.0.0 protocol.
      * This is for drone nodes that need to receive seeds without being an owner.
      * Does not require an owner key.
      */
-    enableSeedListener() {
+    async enableSeedListener() {
         if (!this.controlNode || !this.controlDatabase) {
             throw new Error('CadreNode must be started before enabling seed listener');
         }
@@ -6350,19 +6809,17 @@ export class CadreNode {
             log('Seed bootstrap service already initialized');
             return;
         }
-        this.seedBootstrapService = new SeedBootstrapService({
+        await this.installSeedBootstrapService(new SeedBootstrapService({
             partyId: this.config.controlNetwork.partyId,
             // No owner key - this node only receives seeds
             inviteAddressResolver: () => this.resolveInviteAddresses(),
-            dialBudget: this.controlDialBudget(),
+            ...this.seedServiceBudgets(),
             trustPolicy: this.config.seedTrustPolicy,
             // A listener-only node accepts a wire-delivered seed solely against this
             // anchor (there is no per-call override on the inbound handler): with no
             // genesis/invite/operator pin it authorizes nobody, which is the point.
             ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
-        });
-        this.seedBootstrapService.setEventCallbacks(this.seedEventCallbacks());
-        this.seedBootstrapService.initialize(this.controlNode, this.controlDatabase);
+        }), this.controlNode, this.controlDatabase);
         log('Seed listener enabled');
     }
     /**
@@ -6371,6 +6828,30 @@ export class CadreNode {
     getSeedBootstrapService() {
         return this.seedBootstrapService;
     }
+    /**
+     * Make `service` this node's seed service and register its inbound seed handler.
+     * The field is set before the registration is awaited, so a concurrent
+     * {@link enableSeedListener} finds it and does not register a second handler; a
+     * failed registration puts the previous service back and rethrows.
+     *
+     * NOTE: libp2p's registrar stores the handler before its peer-store merge, so a
+     * failed merge leaves SEED_PROTOCOL registered with no service owning it and a retry
+     * here rejects as a duplicate; if peer-store writes can fail in practice, unhandle on
+     * a non-duplicate failure (never on a duplicate — that handler belongs to someone else).
+     */
+    async installSeedBootstrapService(service, controlNode, controlDatabase) {
+        service.setEventCallbacks(this.seedEventCallbacks());
+        const previous = this.seedBootstrapService;
+        this.seedBootstrapService = service;
+        try {
+            await service.initialize(controlNode, controlDatabase);
+        }
+        catch (error) {
+            if (this.seedBootstrapService === service)
+                this.seedBootstrapService = previous;
+            throw error;
+        }
+    }
     /**
      * The event callbacks every {@link SeedBootstrapService} this node owns is
      * wired with — shared by the owner-capable service ({@link initializeSeedBootstrap})
@@ -6585,7 +7066,7 @@ export class CadreNode {
             const tempService = new SeedBootstrapService({
                 partyId: seed.partyId,
                 trustPolicy: this.config.seedTrustPolicy,
-                dialBudget: this.controlDialBudget(),
+                ...this.seedServiceBudgets(),
                 // The anchor is node-scoped, not service-scoped: a throwaway service
                 // must consult (and persist an accepted signer into) the SAME store the
                 // persistent one would, or a cold-start enrollment via this path would
@@ -6593,7 +7074,7 @@ export class CadreNode {
                 ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
             });
             if (this.controlNode && this.controlDatabase) {
-                tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
+                await tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
             }
             const tempResult = await tempService.applySeed(seed, options);
             this.noteAppliedSeed(tempResult, seed);
@@ -6765,10 +7246,10 @@ export class CadreNode {
             const tempService = new SeedBootstrapService({
                 partyId: invite.partyId,
                 trustPolicy: this.config.seedTrustPolicy,
-                dialBudget: this.controlDialBudget(),
+                ...this.seedServiceBudgets(),
             });
             if (this.controlNode && this.controlDatabase) {
-                tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
+                await tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
             }
             await tempService.dialInvite(invite);
             return;
@@ -6784,14 +7265,20 @@ export class CadreNode {
      *
      * @param options - Configuration for the solicitation service
      */
-    initializeStrandSolicitation(options) {
+    async initializeStrandSolicitation(options) {
         if (!this.controlNode) {
             throw new Error('CadreNode must be started before initializing strand solicitation');
         }
-        this.strandSolicitationService = new StrandSolicitationService({
+        const service = new StrandSolicitationService({
             ...options,
             partyId: this.config.controlNetwork.partyId,
             cadrePeerAddrs: this.getMultiaddrs(),
+            // Every formation deadline derives from this node's declared link, like every other
+            // dial budget here; a caller's own declaration on the formation config still wins.
+            formationConfig: {
+                linkRoundTripMs: this.config.network?.linkRoundTripMs,
+                ...options?.formationConfig
+            },
             // Overrides any caller-supplied hook, exactly like partyId/cadrePeerAddrs: only
             // this node can say which strand-network addresses it is actually listening on,
             // and a wrong answer here seeds a joiner's mesh with addresses that reach nobody.
@@ -6799,10 +7286,23 @@ export class CadreNode {
             // Overridden on the same grounds: only this node holds the running strand
             // instance's database and this party's `StrandPartyKey` identity, and a wrong
             // issuer here would admit joiners under someone else's authority.
-            issueMembershipInvite: (strandId) => this.issueStrandMembershipInvite(strandId)
+            issueMembershipInvite: (strandId, signal) => this.issueStrandMembershipInvite(strandId, signal)
         });
-        // Register as responder on the control node
-        this.strandSolicitationService.registerResponder(this.controlNode);
+        // Set before the registration is awaited, so a concurrent createOpenInvitation /
+        // formStrand uses this service instead of building a second one whose handler
+        // would collide; a failed registration puts the previous service back.
+        // NOTE: same stray-handler caveat as installSeedBootstrapService — a failed
+        // peer-store merge leaves the formation handler registered, so a retry is a duplicate.
+        const previous = this.strandSolicitationService;
+        this.strandSolicitationService = service;
+        try {
+            await service.registerResponder(this.controlNode);
+        }
+        catch (error) {
+            if (this.strandSolicitationService === service)
+                this.strandSolicitationService = previous;
+            throw error;
+        }
         log('Strand solicitation service initialized');
     }
     /**
@@ -6822,7 +7322,7 @@ export class CadreNode {
     ) {
         if (!this.strandSolicitationService) {
             // Create a temporary service for creating invitations
-            this.initializeStrandSolicitation();
+            await this.initializeStrandSolicitation();
         }
         const bootstrap = this.getMultiaddrs();
         if (bootstrap.length === 0) {
@@ -6842,10 +7342,10 @@ export class CadreNode {
             throw new Error('CadreNode must be started before forming strands');
         }
         if (!this.strandSolicitationService) {
-            this.initializeStrandSolicitation();
+            await this.initializeStrandSolicitation();
         }
         const result = await this.strandSolicitationService.formStrand(invitation, disclosure, this.controlNode);
-        this.recordFormationStrandPeers(result.strandId, result.strandAddrs);
+        await this.recordFormationStrandAddrs(result.strandId, result.strandAddrs);
         // A closed host strand's approval carries the joiner's own membership invitation —
         // persist this party's identity key and stage the invitation for bring-up to redeem.
         // Runs AFTER the addr recording so a persistence failure (which throws — see the
@@ -6858,7 +7358,9 @@ export class CadreNode {
     }
     /**
      * Remember the strand a formation just joined (see {@link joinedStrandStore}), so it
-     * is re-offered after a restart even when the app is killed before its `addStrand`.
+     * is re-offered after a restart even when the app is killed before its `addStrand`, and
+     * published party-wide by the next connected owner reconcile pass. A re-join also
+     * cancels a party-wide removal a self-revocation queued for the strand.
      * Last in {@link formStrand}, after the membership adoption, so a failure here leaves
      * the party key and staged invitation in place for the re-formation it asks for.
      *
@@ -6867,7 +7369,7 @@ export class CadreNode {
      */
     async rememberFormedStrand(result) {
         try {
-            await this.joinedStrandStore.record({
+            await this.joinedStrands.remember({
                 Id: result.strandId,
                 Type: result.memberPrivateKey ? 'c' : 'o',
                 MemberPrivateKey: result.memberPrivateKey ?? null,
@@ -6958,9 +7460,15 @@ export class CadreNode {
      *   founder's publish/launch paths mint it, so this is a not-yet-converged sibling.)
      *   The manager maps the throw to a clean retryable rejection BEFORE the formation
      *   token is spent.
-     * - Closed host strand with no running local instance/database → throw, same mapping:
-     *   a joiner admitted without an invitation would look joined and never become a
-     *   member, and a responder not running the strand cannot serve its sync anyway.
+     * - Closed host strand whose runtime is HIBERNATING or being quiesced → woken first
+     *   ({@link wakeHostStrandForFormation}, bounded by `signal`), then issued as below. In
+     *   every state the redemption counts as activity, so the host stays up for the
+     *   joiner's first sync.
+     * - Closed host strand with no running local instance/database (never launched, still
+     *   starting, or a hibernating one whose wake failed or outran `signal`) →
+     *   throw, same mapping: a joiner admitted without an invitation would look joined and
+     *   never become a member, and a responder not running the strand cannot serve its sync
+     *   anyway.
      * - Closed host strand whose LIVE rows carry the pre-split fingerprint
      *   (`assertNotPreSplitStrand`) → throw `PreSplitStrandIdentityError`, same mapping as
      *   the recorded refusal. Covers the responders that never ran a refused founder launch:
@@ -6970,7 +7478,12 @@ export class CadreNode {
      * permanent diagnosis. Identity is checked BEFORE the runtime: it is the cheaper read
      * and the more actionable diagnosis when both are missing (a missing runtime is
      * transient, a missing identity is not), and it keeps the branch reachable without
-     * standing a strand runtime up.
+     * standing a strand runtime up. For the same reason every control-database check runs
+     * before a wake: a strand that cannot issue anyway is not woken.
+     *
+     * `signal` is the formation's provisioning budget. Once it has aborted nothing is
+     * issued — the joiner has already been told to retry, and an invitation written now
+     * would only sit in the strand until it expires.
      *
      * The invitation expires `MEMBERSHIP_INVITE_TTL_MS` from now — see that constant for
      * the slow-joiner / lost-result tradeoff.
@@ -6985,7 +7498,7 @@ export class CadreNode {
      * `MEMBERSHIP_INVITE_UNAVAILABLE_REASON` forever; that flow needs manager delegation,
      * not a retry.
      */
-    async issueStrandMembershipInvite(strandId) {
+    async issueStrandMembershipInvite(strandId, signal) {
         if (!this.controlDatabase) {
             throw new Error(`Cannot issue a membership invitation for strand ${strandId}: control database unavailable`);
         }
@@ -7007,56 +7520,99 @@ export class CadreNode {
             throw new Error(`Cannot issue a membership invitation for closed strand ${strandId}: this party holds ` +
                 'no StrandPartyKey row for it (identity not yet converged from the machine that published it)');
         }
+        await this.wakeHostStrandForFormation(strandId, signal);
         const db = this.strandManager.getInstance(strandId)?.database?.getDatabase();
         if (!db) {
             throw new Error(`Cannot issue a membership invitation for closed strand ${strandId}: its runtime is ` +
-                'not live on this responder (not launched, hibernating, or quiescing)');
+                'not live on this responder (not launched, or still starting)');
         }
         if (row.MemberPrivateKey) {
             await assertNotPreSplitStrand(db, strandId, strandMemberKeyPair(row.MemberPrivateKey).publicKeyB64);
         }
+        if (signal?.aborted) {
+            throw new Error(`Cannot issue a membership invitation for closed strand ${strandId}: the formation ` +
+                'provisioning budget expired before issuance');
+        }
         return await issueInvite(db, {
             managerKeyPair: strandMemberKeyPair(partyKey),
             expiration: Date.now() + MEMBERSHIP_INVITE_TTL_MS
         });
     }
     /**
-     * Remember the responder's strand-network addresses for a strand this node just
-     * formed in the strand peer book (see {@link strandPeerBookStore}), so the strand's
-     * discovery seed has something to work with when the app launches it — and again
-     * after every restart.
+     * Count a bound closed-strand redemption as activity on the host strand, and wake the
+     * strand when it is HIBERNATING or being quiesced (its database is closing) so the
+     * membership invitation can be issued. Only reached after the formation manager has
+     * authorized the redemption (token, disclosure, outside approval, seat pre-check), so only
+     * a caller already entitled to the strand's member key can cause a wake. No other state is
+     * woken — never launched or still starting is not something this node recovers from on
+     * demand; the caller's live-database check refuses those.
+     *
+     * The activity is recorded in every state, through the hibernation manager rather than
+     * {@link recordStrandActivity}, whose push fan-out would wake this party's phones for
+     * nothing. It keeps the host up for the joiner's first sync: a live strand's idle timer
+     * restarts, a check-in window that happens to have the strand live sees activity and
+     * leaves it up instead of re-quiescing it, and a hibernating strand has its idle →
+     * hibernate timers re-armed once the wake leaves it `active`. The explicit
+     * {@link wakeStrand} coalesces onto the wake `recordActivity` began, and still wakes when
+     * `recordActivity` is a no-op (hibernation disabled but the strand force-hibernated, or
+     * the manager stopped).
+     *
+     * Bounded by `signal` (the formation's provisioning budget): when it aborts first this
+     * throws — a retryable rejection, token unspent — and leaves the wake running, so the
+     * joiner's retry finds the strand live.
+     */
+    async wakeHostStrandForFormation(strandId, signal) {
+        const instance = this.strandManager.getInstance(strandId);
+        if (!instance) {
+            return;
+        }
+        this.hibernationManager.recordActivity(instance);
+        if (!this.strandManager.isQuiescing(strandId) && (instance.status !== 'hibernating' || instance.database)) {
+            return;
+        }
+        log('wakeHostStrandForFormation: waking host strand %s (%s) for an authorized formation', strandId, instance.status);
+        const wake = this.wakeStrand(strandId);
+        if (await resolvesBeforeAbort(wake, signal)) {
+            return;
+        }
+        void wake.catch((error) => log('wakeHostStrandForFormation: background wake of host strand %s failed: %o', strandId, error));
+        throw new Error(`Cannot issue a membership invitation for closed strand ${strandId}: its hibernating ` +
+            'runtime did not wake within the formation provisioning budget (still waking)');
+    }
+    /**
+     * Keep the responder's strand-network addresses for a strand this node just formed
+     * (see {@link formationStrandAddrs}), so the strand's discovery seed has something to
+     * dial when the app launches it.
      *
      * The carried list is peer-agnostic (`sanitizeStrandAddrs` bounds and parses it,
      * nothing more), so it is attributed per peer here (`groupAddrsByPeerId`, the same
-     * rule the address-book merge applies) and each peer becomes one unsigned entry seen
-     * just now: the responder disclosed the addresses live a moment ago. An entry naming
-     * no destination peer is dropped there. Scoped strictly to `strandId`: these
-     * addresses reach ONE strand node of ONE other party and must never seed another
-     * strand's mesh or the control peerStore. An empty list records nothing, so a later
-     * formation against the same strand that DOES disclose addresses is not shadowed.
-     */
-    recordFormationStrandPeers(strandId, strandAddrs) {
-        if (strandAddrs.length === 0) {
-            log('formStrand: responder disclosed no strand addrs for %s — cross-party seed stays empty', strandId);
+     * rule the address-book merge applies) and kept grouped by peer; an entry naming no
+     * destination peer is dropped there. Scoped strictly to `strandId`: these addresses
+     * reach ONE strand node of ONE other party and must never seed another strand's mesh
+     * or the control peerStore.
+     *
+     * A list that names a peer REPLACES the strand's earlier one: the responder
+     * disclosed its current addresses, so the older list is stale. An empty list, or one
+     * naming no peer, records nothing, so it cannot wipe an earlier disclosure.
+     *
+     * A strand already running when this lands (a re-formation, which is the recovery
+     * path for a dead address) gets the new addresses merged into its address book now.
+     * Nothing else would deliver them: the seed is read only at launch and resume, and the
+     * refresh pass skips a peer FRET already holds a record for — the stale one, here.
+     */
+    async recordFormationStrandAddrs(strandId, strandAddrs) {
+        const attributed = [...groupAddrsByPeerId([...strandAddrs]).values()]
+            .flatMap((peerAddrs) => peerAddrs.map((addr) => addr.toString()));
+        if (attributed.length === 0) {
+            log('formStrand: responder disclosed no usable strand addrs for %s (%d carried) — cross-party seed unchanged', strandId, strandAddrs.length);
             return;
         }
-        const now = Date.now();
-        let peers = 0;
-        for (const [peerId, addrs] of groupAddrsByPeerId([...strandAddrs])) {
-            this.rememberStrandPeer(strandId, {
-                peerId,
-                addrs: addrs.map((ma) => ma.toString()),
-                issuedAt: 0,
-                lastSeenAt: now
-            }, 'formStrand');
-            peers++;
-        }
-        // A strand already running when this lands (a re-formation) would otherwise wait out
-        // the rest of its ~10-minute refresh throttle before the new addresses reached its
-        // address book. Clearing the stamp makes the next 15 s reconcile tick merge them,
-        // which matters precisely because re-forming is the recovery path for a dead entry.
-        this.strandPeerAddrRefreshAt.delete(strandId);
-        log('formStrand: recorded %d cross-party strand addr(s) for %s under %d peer(s)', strandAddrs.length, strandId, peers);
+        this.formationStrandAddrs.set(strandId, attributed);
+        log('formStrand: kept %d of %d cross-party strand addr(s) for %s', attributed.length, strandAddrs.length, strandId);
+        const runningNode = this.strandManager.getInstance(strandId)?.libp2pNode;
+        if (runningNode) {
+            await this.mergeStrandPeerAddrs(runningNode, attributed, strandId);
+        }
     }
     /**
      * Encode an open invitation for out-of-band delivery (QR, link, etc.).