@serfab/cadre-core 1.8.0 → 1.10.0

package/src/cadre-node.ts

@@ -36,7 +36,9 @@ import type {
   CadrePeerVoucherFields,
   CadrePeerRow,
   PeerAddressRecord,
-  ResolveDeviceTokenOpts
+  ResolveDeviceTokenOpts,
+  PendingJoinRow,
+  PendingJoinStatus
 } from './types.js';
 import { controlClusterPolicy, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS, DEFAULT_CONNECTION_MONITOR } from './types.js';
 import { sign } from '@optimystic/quereus-plugin-crypto';
@@ -56,8 +58,7 @@ import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore, type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
 import { MemoryBootstrapPeerStore, type BootstrapPeerStore } from './bootstrap-peer-store.js';
-import { MemoryStrandPeerBookStore, type StrandPeerBookStore, type StrandPeerEntry } from './strand-peer-book.js';
-import type { StrandPeerObservation } from './strand-peer-observer.js';
+import { MemoryStrandNetworkStateStore, type StrandNetworkStateStore } from './strand-network-state.js';
 import { MemoryEnrolledMachineStore, type EnrolledMachineStore } from './enrolled-machine-store.js';
 import {
   JoinedStrandSession,
@@ -67,6 +68,7 @@ import {
   type PartyJoinedStrandLedger
 } from './joined-strand-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './peer-addr-book.js';
+import { strandFretPeerAddrs } from './strand-fret-addrs.js';
 import { verifyCadrePeerVoucher } from './peer-authorization.js';
 import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
 import {
@@ -103,10 +105,18 @@ import {
   CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS,
   type PeerDialBudget
 } from './peer-dial.js';
-import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, peerJoinPushBudget, relayAdmissionReserveDeadlineMs, relayReservationBudgetMs, relayedDialBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
+import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayAdmissionReserveDeadlineMs, relayReservationBudgetMs, relayedDialBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
-import { ControlDatabase, isStrandIdConflict, type RevokedRowRef } from './control-database.js';
+import { ControlDatabase, isPendingJoinConflict, isStrandIdConflict, pendingJoinId, type RevokedRowRef } from './control-database.js';
+import { FormationPostApprovalError } from './strand-formation-rejection.js';
+import {
+  PendingJoinRunner,
+  membershipInvitesToStage,
+  parseStoredDisclosure,
+  requestedPendingJoin,
+  type PendingJoinFields
+} from './pending-join-runner.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
 import { SeedBootstrapService, type SeedEventCallbacks, type SeedBootstrapConfig } from './seed-bootstrap.js';
 import type { SeedTrustPolicy } from './seed-trust-policy.js';
@@ -114,6 +124,8 @@ import {
   StrandSolicitationService,
   type StrandSolicitationServiceOptions
 } from './strand-solicitation.js';
+import { ControlFormationUsageRecorder } from './control-formation-recorder.js';
+import { selectInvitationSiblingAddrs, type InvitationSibling } from './invitation-bootstrap.js';
 import {
   createMembershipConnectionGater,
   DEFAULT_ENROLLMENT_WINDOW_MS,
@@ -208,8 +220,8 @@ function siblingAnswered(outcome: StrandAddrOutcome): boolean {
  * `primary` followed by the entries of `extra` it does not already contain, de-duplicated
  * and order-preserving.
  *
- * Used wherever a strand's discovery seed unions two sources of address strings — the
- * freshly-RPC'd sibling answers and the strand peer book's last-known addresses. The
+ * Used where a strand's discovery seed unions two sources of address strings — the
+ * freshly-RPC'd sibling answers and the addresses the strand's formation carried. The
  * caller passes the FRESHER source as `primary`, so a stale entry can only ever be
  * appended, never promoted ahead of a current one, and each source keeps whatever
  * signaling-first ordering it arrived with.
@@ -378,6 +390,15 @@ export class CadreNode implements SAppIdLookup {
   private enrollmentService: EnrollmentService;
   private seedBootstrapService: SeedBootstrapService | null = null;
   private strandSolicitationService: StrandSolicitationService | null = null;
+  /**
+   * The service whose formation handler is registered on the control node. Trails
+   * {@link strandSolicitationService} while {@link initializeStrandSolicitation} swaps a new
+   * one in: the field is set at once so concurrent callers reuse it, the handler only when
+   * its queued swap runs.
+   */
+  private registeredSolicitation: StrandSolicitationService | null = null;
+  /** Tail of the queued formation-handler swaps ({@link swapFormationResponder}). */
+  private solicitationSwaps: Promise<void> = Promise.resolve();
   private strandWakeService: StrandWakeService | null = null;
   /**
    * Control-network strand-address responder. Answers a co-cadre sibling's
@@ -615,36 +636,55 @@ export class CadreNode implements SAppIdLookup {
   private readonly strandAddrAskDueAt = new Map<string, number>();
 
   /**
-   * Node-local strand peer book (see `strand-peer-book.ts`): per strand, the strand
-   * peers this node has met and their last-known strand-network addresses. Three
-   * writers: {@link recordFormationStrandPeers} files the responder's live strand
-   * addrs a formation result carried back (`FormationResultMessage.strandAddrs`),
-   * {@link observeStrandPeer} files every strand peer a running strand node
-   * identifies, and the per-strand book swap (`strand-peer-book-swap.ts`, handed the
-   * store as `StartStrandConfig.strandPeerBook`) files the node's own signed entry
-   * plus every signed entry a strand peer sends it — the only writer whose entries
-   * carry a signature, and the only one that can refresh a peer's addresses without
-   * meeting that peer. Read by {@link resolveCohortSeed} (launch + hibernation resume) and
-   * re-merged by every {@link refreshStrandPeerAddrs} pass, which is what keeps the
-   * entries alive past the peerStore's one-hour address expiry.
-   *
-   * This is the ONLY cross-party discovery input there is. The strand-addr RPC that
+   * The strand-network addresses a formation carried back
+   * (`FormationResultMessage.strandAddrs`), by strand id: the responder's live strand
+   * node addresses, kept so the strand's first attach has something to dial. Written by
+   * {@link recordFormationStrandAddrs}, read by {@link resolveCohortSeed} (launch and
+   * hibernation resume) and by every refresh pass for the peers the strand node's FRET
+   * table holds no record for yet ({@link remergeUnrecordedFormationAddrs}).
+   *
+   * This is the only cross-party input a FIRST attach has. The strand-addr RPC that
    * resolves a strand's addresses is membership-gated and answers own-party siblings
-   * only, so without the book a joiner's cohort seed for a two-party strand is empty
-   * and the mesh never forms — and, with an in-memory book, never RE-forms after a
-   * restart (gotchoices/sereus#18). A STORE rather than a map so an embedder can make
-   * it outlive the process; constructed (or adopted from `config.strandPeers.store`)
-   * by {@link initializeStrandPeerBookStore} during {@link start}, deliberately NOT
+   * only, so without it a joiner's seed for a two-party strand is empty and the mesh
+   * never forms. Every later launch has the strand node's saved network state as well
+   * ({@link strandNetworkStateStore}), which is what a restart re-finds the other party
+   * from (gotchoices/sereus#18).
+   *
+   * A re-formation replaces the strand's list. An entry survives a {@link stopStrand}
+   * and a stop()→start() of this node instance ({@link cleanup} leaves the map alone),
+   * and is dropped where the saved network state is: {@link unpublishStrand},
+   * {@link forgetJoinedStrand} and self-revocation.
+   *
+   * NOTE: accepted tradeoff — in memory only, so a process restart between `formStrand`
+   * and the strand's first launch loses the carried addresses, and the strand then
+   * launches with no cross-party seed until it is re-formed. Persisting the list on the
+   * joined-strand record was weighed and declined: it mixes address state into the join
+   * record, and needs an "only until the first run" rule to stop dead addresses being
+   * dialled on every launch. Every embedder launches straight after forming, and once
+   * the strand has run the saved network state covers every later restart. Revisit if an
+   * embedder forms and launches in separate sessions.
+   */
+  private readonly formationStrandAddrs = new Map<string, string[]>();
+
+  /**
+   * Node-local strand network state (see `strand-network-state.ts`): per strand, the
+   * state db-p2p saves for the strand's libp2p node — its FRET routing table with each
+   * peer's signed address record. Handed to every strand launch as
+   * `StartStrandConfig.networkState`; the strand node saves into it on every connection
+   * and re-imports it when it is next built, which is what gives a restarted strand
+   * node addresses for the peers it was talking to.
+   *
+   * Constructed (or adopted from `config.strandNetworkState.store`) by
+   * {@link initializeStrandNetworkStateStore} during {@link start}, deliberately NOT
    * cleared by {@link cleanup}, so it survives a stop()→start() cycle of the same node
    * instance — same lifecycle as {@link bootstrapPeerStore}.
    *
-   * Entries survive a {@link stopStrand} (a stopped strand may be claimed again with
-   * {@link addStrand}, and is rediscovered on restart) and are forgotten by
-   * {@link unpublishStrand}, {@link forgetJoinedStrand} and self-revocation; the store
-   * ages the rest out after 14 days and caps each strand at 16 peers, so the book is
-   * bounded by time and by the strands this node runs rather than by its history.
+   * A strand's state survives a {@link stopStrand} and a hibernation quiesce, and is
+   * forgotten by {@link unpublishStrand}, {@link forgetJoinedStrand} and
+   * self-revocation. A strand detached because the watcher saw its row gone keeps its
+   * state (`NOTE:` on `PersistentStrandNetworkStateStore`).
    */
-  private strandPeerBookStore: StrandPeerBookStore | null = null;
+  private strandNetworkStateStore: StrandNetworkStateStore | null = null;
 
   /**
    * PENDING strand membership invitations learned at formation, keyed by strandId — the
@@ -673,10 +713,26 @@ export class CadreNode implements SAppIdLookup {
    * NOTE: entries live for the node's lifetime (one small pair per formed closed
    * strand); the number of keys is bounded only by the strands this node has ever
    * formed, not by time — if a node ever forms strands at scale, evict on
-   * `unpublishStrand` / `forgetJoinedStrand` as the strand peer book does.
+   * `unpublishStrand` / `forgetJoinedStrand` as {@link formationStrandAddrs} is.
    */
   private readonly pendingMembershipInvites = new Map<string, StrandMembershipInvite>();
 
+  /**
+   * Invite keys of the membership invitations this process has staged, by
+   * {@link adoptFormationMembershipInvite} or from a `joined` `PendingJoin` row
+   * ({@link stageMembershipInvitesFromPendingJoins}), so one the reconciler has settled is not
+   * staged again by the next pending-join pass. Same lifetime as
+   * {@link pendingMembershipInvites}: a restarted process stages each live one once more, and the
+   * reconciler settles it again (spent, or the party already seated).
+   */
+  private readonly stagedMembershipInviteKeys = new Set<string>();
+
+  /**
+   * The pending-join retry loop (`pending-join-runner.ts`): built by {@link start}, stopped by
+   * {@link cleanup}. It acts only while this machine is an enrolled owner.
+   */
+  private pendingJoinRunner: PendingJoinRunner | null = null;
+
   /**
    * Founder launches refused because the strand was founded before the per-party
    * identity split (`PreSplitStrandIdentityError`), keyed by strandId. Read by
@@ -1114,8 +1170,9 @@ export class CadreNode implements SAppIdLookup {
       // fails closed like the two above.
       this.initializeJoinedStrandStore();
 
-      // The strand peer book those joins are dialed from. Same placement, same reason.
-      this.initializeStrandPeerBookStore();
+      // Each strand node's saved network state, which those joins are dialed from after
+      // a restart. Same placement, same reason.
+      this.initializeStrandNetworkStateStore();
 
       // Read the party's enrolled-machine count out of its node-local record and
       // capture it for buildControlNodeOptions below. This MUST precede
@@ -1246,6 +1303,12 @@ export class CadreNode implements SAppIdLookup {
       });
       await this.strandAddrService.initialize(this.controlNode);
 
+      // Answer strand formation for this party from now on. Every machine of a party
+      // holds the replicated FormationInvite/FormationUsage rows, so an always-on one can
+      // check a token for an inviter that is offline. After the control database is up,
+      // so the responder never reads a database that cannot answer yet.
+      await this.installDefaultFormationResponder();
+
       // Server-side push-wake fan-out: only when push is configured.
       if (this.config.push) {
         this.pushFanoutService = this.buildPushFanout(this.config.push);
@@ -1286,6 +1349,9 @@ export class CadreNode implements SAppIdLookup {
       // Schedule self-registration in background
       this.scheduleSelfRegistration();
 
+      // Last: its first pass may dial another party's machines.
+      this.startPendingJoinRunner();
+
     } catch (error) {
       log('Failed to start CadreNode: %o', error);
       // `driveControlRelayReservation` throws AFTER `control:connected` was emitted,
@@ -1542,27 +1608,27 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Construct (or adopt) the node-local strand peer book (see
-   * {@link strandPeerBookStore}). Synchronous for the reason
+   * Construct (or adopt) the node-local strand network state (see
+   * {@link strandNetworkStateStore}). Synchronous for the reason
    * {@link initializeBootstrapPeerStore} is: an injected store has already loaded its
    * persisted entries by the time it is handed in, and the in-memory fallback has
    * nothing to load. The instance is kept across stop()→start(). A store scoped to a
-   * different party is a configuration error, fail closed: another party's strand
-   * peers must never enter this node's dial loop.
+   * different party is a configuration error, fail closed: another party's routing
+   * tables must never be imported into this node's strands.
    */
-  private initializeStrandPeerBookStore(): void {
+  private initializeStrandNetworkStateStore(): void {
     const partyId = this.config.controlNetwork.partyId;
-    if (this.strandPeerBookStore) {
+    if (this.strandNetworkStateStore) {
       return;
     }
-    const store = this.config.strandPeers?.store ?? new MemoryStrandPeerBookStore(partyId);
+    const store = this.config.strandNetworkState?.store ?? new MemoryStrandNetworkStateStore(partyId);
     if (store.partyId !== partyId) {
       throw new Error(
-        `CadreNodeConfig: strandPeers.store is scoped to party ${store.partyId}, ` +
-        `but this node serves party ${partyId} — refusing to mix strand peer books`
+        `CadreNodeConfig: strandNetworkState.store is scoped to party ${store.partyId}, ` +
+        `but this node serves party ${partyId} — refusing to mix strand network state`
       );
     }
-    this.strandPeerBookStore = store;
+    this.strandNetworkStateStore = store;
   }
 
   /**
@@ -1585,13 +1651,13 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * The node-local strand peer book (null before {@link start}) — per strand, the
-   * strand peers this node dials first on launch, resume and refresh. Exposed for
-   * diagnostics and for a host that wants to show "whom would this strand re-find
-   * after a restart?".
+   * The node-local strand network state (null before {@link start}) — per strand, the
+   * state its strand node last saved and will re-import when next built. Exposed for
+   * diagnostics and for a host that wants to show "what routing table would this
+   * strand restart with?".
    */
-  getStrandPeerBookStore(): StrandPeerBookStore | null {
-    return this.strandPeerBookStore;
+  getStrandNetworkStateStore(): StrandNetworkStateStore | null {
+    return this.strandNetworkStateStore;
   }
 
   /**
@@ -1884,11 +1950,15 @@ export class CadreNode implements SAppIdLookup {
       // replaces the default whole (see DEFAULT_CONNECTION_MONITOR).
       connectionMonitor: network?.connectionMonitor ?? DEFAULT_CONNECTION_MONITOR,
       // The declared link every cadre budget is derived from, stated to Optimystic too so it
-      // derives its own deadlines from the same number: its request dials and responses, its
-      // block pushes, and libp2p's `dialTimeout` and `inboundUpgradeTimeout`. Always stated,
-      // default included: undeclared, Optimystic keeps LAN deadlines that cannot open a
-      // relayed connection at the link sereus supports (`link-budget.ts`).
+      // derives its own deadlines from the same number: its request responses, its block
+      // pushes, and libp2p's `inboundUpgradeTimeout`. Always stated, default included:
+      // undeclared, Optimystic keeps LAN deadlines that cannot open a relayed connection at the
+      // link sereus supports (`link-budget.ts`).
       linkRoundTripMs: resolveLinkRoundTripMs(network?.linkRoundTripMs),
+      // The three limits on opening a connection (libp2p's per-address and whole-dial limits,
+      // and Optimystic's request dial): Optimystic's derivation from the same link plus the
+      // relay's and the called machine's admission decisions, which run on this dial's clock.
+      ...optimysticDialLimits(network?.linkRoundTripMs),
       // `{ wsPort }` when a listen entry names WebSocket, otherwise `{}` — and always
       // `{}` when `network.transports` is set, since the embedder owns transport policy
       // then. Spread NEXT to `transports` because the two answer the same question.
@@ -1971,11 +2041,9 @@ export class CadreNode implements SAppIdLookup {
    *     `StrandSolicitationService.hasOutstandingInvitation`). A formation
    *     initiator is another party's peer by design and its token is only
    *     checkable inside the protocol, so the gate asks the coarser question
-   *     "does this node expect a stranger at all?". Merely REGISTERING the
-   *     responder ({@link initializeStrandSolicitation}) no longer suspends
-   *     stranger denial — eager registration (as `reference-app-rn` does at
-   *     bring-up) and `formStrand`'s lazy initialization both leave the gate
-   *     armed, because neither mints an invitation.
+   *     "does this node expect a stranger at all?". REGISTERING the responder
+   *     does not suspend stranger denial: every node registers one at
+   *     {@link start}, and registering mints no invitation.
    *
    * Ordering is semantically free (the checks are OR'd) but decides who pays:
    * checks 1-3 are in-memory, 4/5 share one control-DB read, and only a peer
@@ -2007,6 +2075,11 @@ export class CadreNode implements SAppIdLookup {
    * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
    * read is safe here — unlike the per-stream gate, which must consult the
    * materialized {@link authorizedControlPeers} snapshot instead.
+   * NOTE: check 6 adds a second control read (`hasOutstandingFormationInvite`) for a
+   * stranger with no locally minted invitation in play, on every node now that every
+   * node runs the responder — a relay-enabled storage node included. If stranger
+   * connections to such a node ever arrive fast enough for that read to show, cache
+   * the answer for a few seconds.
    * NOTE: on a relay-DISABLED node, a sibling whose membership row has not yet
    * replicated here is denied until the row converges (typically via the
    * owner); either side's next outbound reconcile dial (outbound is never
@@ -2898,6 +2971,15 @@ export class CadreNode implements SAppIdLookup {
    * handling, is what keeps a mixed list from taking a whole peer offline.
    */
   async resolvePeerAddrs(peerId: string, opts: ResolveOpts = {}): Promise<Multiaddr[]> {
+    return (await this.resolvePeerRecord(peerId, opts))?.addrs ?? [];
+  }
+
+  /**
+   * {@link resolvePeerAddrs} with the record's `UpdatedAt` kept beside the addresses, for a
+   * caller that ranks peers by how recently they published. `null` wherever that returns `[]`
+   * for a failed gate.
+   */
+  private async resolvePeerRecord(peerId: string, opts: ResolveOpts): Promise<{ addrs: Multiaddr[]; updatedAt: number } | null> {
     if (!this.controlDatabase) {
       throw new Error('CadreNode must be started before resolving peer addrs');
     }
@@ -2905,14 +2987,14 @@ export class CadreNode implements SAppIdLookup {
     const record = await this.controlDatabase.queryPeerRecord(peerId);
     if (!record) {
       log('resolvePeerAddrs: no record for %s', peerId);
-      return [];
+      return null;
     }
 
     // publicKey <-> peerId binding: the stored key must be the one embedded in
     // the requested Ed25519 peer id (also rejects a non-Ed25519 / missing key).
     if (!record.publicKey || ed25519PublicKeyB64FromPeerId(peerId) !== record.publicKey) {
       log('resolvePeerAddrs: publicKey does not match peerId for %s', peerId);
-      return [];
+      return null;
     }
 
     // Self-signature over (peerId, addrs, updatedAt).
@@ -2923,14 +3005,14 @@ export class CadreNode implements SAppIdLookup {
       log('resolvePeerAddrs: signature verification failed for %s (updatedAt=%d, addrs=%o, sig=%s)',
         peerId, record.updatedAt, record.addrs,
         record.sig ? `${record.sig.slice(0, 16)}…` : '(empty)');
-      return [];
+      return null;
     }
 
     // Freshness: never hand back a dead relay reservation.
     const maxAgeMs = opts.maxAgeMs ?? DEFAULT_PEER_RECORD_MAX_AGE_MS;
     if (!isPeerRecordFresh(record.updatedAt, maxAgeMs, Date.now())) {
       log('resolvePeerAddrs: record for %s is stale (updatedAt=%d, maxAgeMs=%d)', peerId, record.updatedAt, maxAgeMs);
-      return [];
+      return null;
     }
 
     // Pluggable trust gate (defaults to current-member).
@@ -2943,7 +3025,7 @@ export class CadreNode implements SAppIdLookup {
     });
     if (!trusted) {
       log('resolvePeerAddrs: trust policy rejected %s', peerId);
-      return [];
+      return null;
     }
 
     // Order signaling-first (the on-record order was what we verified above),
@@ -2954,7 +3036,7 @@ export class CadreNode implements SAppIdLookup {
     if (opts.signalingOnly) {
       addrs = addrs.filter(isSignalingAddr);
     }
-    return this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId);
+    return { addrs: this.normalizeDialAddrs(this.parseMultiaddrs(addrs), peerId), updatedAt: record.updatedAt };
   }
 
   /**
@@ -3117,10 +3199,10 @@ export class CadreNode implements SAppIdLookup {
     if (!this._running || !this.controlNode || !this.controlDatabase) {
       return { dialed: [] };
     }
-    // Then re-warm each running strand's own address book from its peer book and
-    // from whichever siblings are due an ask. Same reasoning as warmSiblingAddrBook
-    // below, one layer down: replication runs on the STRAND network, and every
-    // layer under cadre-core dials strand peers by bare peer id.
+    // Then re-warm each running strand's own address book from its FRET address
+    // records and from whichever siblings are due an ask. Same reasoning as
+    // warmSiblingAddrBook below, one layer down: replication runs on the STRAND
+    // network, and every layer under cadre-core dials strand peers by bare peer id.
     await this.refreshStrandPeerAddrs();
     if (!this._running || !this.controlNode || !this.controlDatabase) {
       return { dialed: [] };
@@ -3515,15 +3597,18 @@ export class CadreNode implements SAppIdLookup {
    *
    * The list may name transports this node cannot dial (a lent node reports TCP
    * and `/ws` addresses to a phone that dials WebSockets only). That needs no
-   * filtering here: libp2p's dial queue (`calculateMultiaddrs`, libp2p 3.1.3)
+   * filtering here: libp2p's dial queue (`calculateMultiaddrs`, libp2p 3.3.11)
    * rejects an address no transport can dial before touching the network, so
    * such an address costs a log line.
    *
    * The list is NOT handed to one `dial()`. libp2p tries a multi-address dial's
-   * addresses one after another under a single deadline, with no limit per
-   * address, and sorts loopback addresses last — so one or two addresses that
-   * never answer used up the whole deadline before the address that worked was
-   * tried. {@link dialPeerAddrs} dials each address on its own time limit instead.
+   * addresses one after another under a single deadline, and sorts loopback
+   * addresses last — so one or two addresses that never answer use up most of
+   * the deadline before the address that works is tried. libp2p 3.3's
+   * per-address `addressDialTimeout` does not prevent that: cadre sizes it for a
+   * cold relayed open through two admission decisions (`optimysticDialLimits`,
+   * 39 s at the default declared link).
+   * {@link dialPeerAddrs} dials each address on its own time limit instead.
    */
   private async resolveControlDialAddrs(peerId: string, resolved: Multiaddr[]): Promise<Multiaddr[]> {
     if (resolved.length > 0) {
@@ -3912,6 +3997,9 @@ export class CadreNode implements SAppIdLookup {
 
     // 4. In-session pending owner authorize writes.
     await this.drainPendingPeerWrites();
+
+    // 5. `PendingJoin` rows this process wrote while alone. Their tombstones went out in step 1.
+    await this.pendingJoinRunner?.reissueWritesMadeAlone();
   }
 
   /**
@@ -4591,6 +4679,10 @@ export class CadreNode implements SAppIdLookup {
     // it is stopped here.
     this.relayReserveSupervisor?.stop();
     this.relayReserveSupervisor = null;
+    // Before anything it reads is torn down. An attempt in flight is not awaited (NOTE at
+    // `PendingJoinRunner.stop`).
+    this.pendingJoinRunner?.stop();
+    this.pendingJoinRunner = null;
     // Drop the rest of the relay-reservation posture: a torn-down node holds no
     // reservation, so neither a restarted instance nor a caller inspecting a failed
     // start reports the previous attempt's `reserved`.
@@ -4638,11 +4730,14 @@ export class CadreNode implements SAppIdLookup {
       this.pushFanoutService = null;
     }
 
-    // Unregister strand solicitation service
-    if (this.strandSolicitationService && this.controlNode) {
-      await this.strandSolicitationService.unregisterResponder(this.controlNode);
-      this.strandSolicitationService = null;
+    // Unregister the formation responder once any queued swap has run, so no swap
+    // registers a handler after this. A restarted node installs a fresh one.
+    await this.solicitationSwaps;
+    if (this.registeredSolicitation && this.controlNode) {
+      await this.registeredSolicitation.unregisterResponder(this.controlNode);
     }
+    this.registeredSolicitation = null;
+    this.strandSolicitationService = null;
 
     // Stop strand watcher
     if (this.strandWatcher) {
@@ -5851,9 +5946,9 @@ export class CadreNode implements SAppIdLookup {
     // `privateKey` — tests, and an embedder that opted out of a stable identity) the
     // strand node still runs under a key CADRE-CORE HOLDS: a fresh random Ed25519 key,
     // exactly what libp2p would generate internally if handed none, except that the
-    // book swap can sign this node's own entry with it (`strand-peer-book-swap.ts`) and
-    // the retained launch config keeps the same strand peer id across a hibernation
-    // resume. Stability across RESTARTS still needs an identity key.
+    // delegate announcement below can name the strand peer id before the node exists and
+    // the retained launch config keeps that id across a hibernation resume. Stability
+    // across RESTARTS still needs an identity key.
     //
     // NOTE: derivation requires an Ed25519 identity key, so a node configured
     // with some other key type now fails strand launch outright (surfaced as
@@ -5908,16 +6003,12 @@ export class CadreNode implements SAppIdLookup {
         this.forgetRevokedJoin(revokedStrandId);
         this.emit('strand:revoked', { strandId: revokedStrandId });
       },
-      // The strand peer book's observation writer: every strand peer the node
-      // identifies is remembered with its dialable addresses, so a restart re-finds
-      // it. Retained with the launch config, so a hibernation wake re-arms it.
-      onStrandPeerIdentified: (observedStrandId, observation) =>
-        this.observeStrandPeer(observedStrandId, observation),
-      // The book's third writer, the signed swap between strand peers: the strand node
-      // reads and writes the store directly (`strand-peer-book-swap.ts`). Retained with
-      // the launch config too. `?? undefined`: the field is `null` before start(), and a
-      // strand cannot launch before start(), so this is belt and braces.
-      strandPeerBook: this.strandPeerBookStore ?? undefined,
+      // Where the strand node saves its network state and what it re-imports when it is
+      // built. Retained with the launch config, so a hibernation wake rebuilds the node
+      // over the table the quiesced node last saved. `?? undefined`: the field is `null`
+      // before start(), and a strand cannot launch before start(), so this is belt and
+      // braces.
+      networkState: this.strandNetworkStateStore ?? undefined,
       onRejoinBlocked: (blockedStrandId) => this.emit('strand:rejoin-blocked', { strandId: blockedStrandId }),
       // The joiner's first-sync write gate (strand-first-sync-gate.ts): a launch that
       // comes up `'syncing'` announces the moment its database is published.
@@ -6050,32 +6141,11 @@ export class CadreNode implements SAppIdLookup {
    */
   private async resolveCohortSeed(strandId: string, delegatePeerId?: string): Promise<string[]> {
     const siblings = await this.resolveSiblingSeed(strandId, delegatePeerId);
-    // Sibling answers FIRST: they were resolved just now, while a book entry is as old
-    // as the last connection to that peer. `unionAddrs` appends only what the siblings
+    // Sibling answers FIRST: they were resolved just now, while the formation-carried
+    // addresses are as old as the formation. `unionAddrs` appends only what the siblings
     // did not already name, so a fresher answer is never displaced and each source keeps
-    // its own signaling-first ordering. `delegatePeerId` IS this strand node's own id.
-    return unionAddrs(siblings, this.strandPeerBookAddrs(strandId, delegatePeerId));
-  }
-
-  /**
-   * The strand peer book's contribution to a strand's seed: every live entry's
-   * addresses, freshest peer first, minus this node's own entry when `selfPeerId` is
-   * known (the book swap files one under the strand transport id; a node must never
-   * dial itself). Empty before {@link start} builds the store.
-   */
-  private strandPeerBookAddrs(strandId: string, selfPeerId?: string): string[] {
-    const store = this.strandPeerBookStore;
-    if (!store) {
-      return [];
-    }
-    const addrs: string[] = [];
-    for (const entry of store.entries(strandId)) {
-      if (entry.peerId === selfPeerId) {
-        continue;
-      }
-      addrs.push(...entry.addrs);
-    }
-    return addrs;
+    // its own ordering.
+    return unionAddrs(siblings, this.formationStrandAddrs.get(strandId) ?? []);
   }
 
   /**
@@ -6263,9 +6333,9 @@ export class CadreNode implements SAppIdLookup {
    * caller runs the drive regardless).
    *
    * NOTE: against a relay that is DOWN this hook costs up to two strand-addr
-   * timeouts (dial by peer id, then by addr; 23 s each at the default declared link round trip)
+   * timeouts (dial by peer id, then by addr; 28.5 s each at the default declared link round trip)
    * before the reservation drive even starts, so one failed re-drive holds the supervisor
-   * `driving` for those 46 s plus the drive's own deadline — 64 s at the default, and longer on
+   * `driving` for those 57 s plus the drive's own deadline — 75 s at the default, and longer on
    * a host that declared a slower one (`link-budget.ts`).
    * Bounded and harmless while the relay is unreachable anyway; if recovery
    * latency after a relay comes back ever matters, skip the announce when the
@@ -6311,18 +6381,19 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Keep each running strand's own libp2p address book warm: re-merge its strand
-   * peer book on every pass, and re-ask each connected SIBLING for its strand
-   * addresses over the control mesh when that (sibling, strand) is due
+   * Keep each running strand's own libp2p address book warm: re-merge the address
+   * records its FRET routing table holds on every pass
+   * ({@link remergeStrandFretRecords}), and re-ask each connected SIBLING for its
+   * strand addresses over the control mesh when that (sibling, strand) is due
    * ({@link strandAddrAskDueAt}).
    *
-   * Without this, a strand's address book is written exactly once — the
+   * Without this, cadre-core writes a strand's address book exactly once — the
    * launch/resume seed — and everything below cadre-core that dials a strand peer
    * by bare peer id (Optimystic's cluster and repo clients, FRET ping/announce)
-   * loses its address for any sibling it is not currently connected to: a sibling
+   * loses its address for any peer it is not currently connected to: a sibling
    * that restarted its strand node or rotated its relay reservation is never
-   * re-resolved, and even the original seed addresses fall off at the peerStore's
-   * one-hour expiry (see `peer-addr-book.ts`).
+   * re-resolved, and every address, another party's included, falls off at the
+   * peerStore's one-hour expiry (see `peer-addr-book.ts`).
    *
    * Due times are per (sibling, strand) and set from each sibling's own outcome, so
    * a sibling that connects late — a phone joining after the party's always-on
@@ -6405,15 +6476,15 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * One strand's share of {@link refreshStrandPeerAddrs}: RPC the siblings that are
-   * due, union their answers with this strand's peer-book addresses, and merge the
-   * lot into the strand's address book. Errors are logged and swallowed so one
-   * strand's failure never costs the others their refresh.
+   * due and merge their answers into the strand's address book, then re-merge the
+   * address records the strand node's FRET table holds. Errors are logged and
+   * swallowed so one strand's failure never costs the others their refresh.
    *
-   * The peer book merges on EVERY pass, whether or not any sibling is due or
-   * connected: nothing re-resolves another party's addresses, so this re-merge is the
-   * ONLY thing standing between them and the peerStore's one-hour expiry — and it is
-   * also how a re-formation's freshly carried addresses reach a running strand on the
-   * next tick. A strand with nobody due and no book entry does nothing.
+   * The sibling half runs first, so a failure reading the FRET table cannot cost a
+   * sibling answer its merge. The FRET half, and the formation-carried addresses of
+   * the peers it holds no record for, run on EVERY pass, whether or not any sibling is
+   * due or connected — see {@link remergeStrandFretRecords} and
+   * {@link remergeUnrecordedFormationAddrs} for why.
    */
   private async refreshOneStrandPeerAddrs(
     strandId: string,
@@ -6429,7 +6500,6 @@ export class CadreNode implements SAppIdLookup {
       // Inside the try: a strand node torn down mid-pass may throw on any read, and one
       // strand's failure must never cost the others their refresh.
       const strandPeerId = strandNode.peerId.toString();
-      const contactAddrs = this.strandPeerBookAddrs(strandId, strandPeerId);
       const due = targets.filter(
         (target) => now >= (this.strandAddrAskDueAt.get(peerStrandKey(target.peerId, strandId)) ?? 0)
       );
@@ -6438,26 +6508,95 @@ export class CadreNode implements SAppIdLookup {
       const siblingAddrs = due.length === 0
         ? []
         : await this.askSiblingsForStrandAddrs(controlNode, due, strandId, strandPeerId, now);
-      // Re-read the instance after the await — a strand stopped mid-pass (or one
-      // already restarted onto a new node) must never have its store written to.
-      if (!this._running || this.strandManager.getInstance(strandId)?.libp2pNode !== strandNode) {
+      if (!this.isRunningStrandNode(strandId, strandNode)) {
         return;
       }
-      const addrs = unionAddrs(siblingAddrs, contactAddrs);
-      if (addrs.length === 0) {
-        return;
+      if (siblingAddrs.length > 0) {
+        await this.mergeStrandPeerAddrs(strandNode, siblingAddrs, strandId);
       }
-      // NOTE: with no sibling due this still merges the whole book — up to 16 peers ×
-      // 16 addrs, so 16 `peerStore.merge` calls per running strand per 15 s tick. An
-      // unchanged address set writes nothing in libp2p's persistent peer store, so it
-      // is cheap today; if many strands run at once, merge only book entries changed
-      // since the last tick plus those nearing the one-hour expiry.
-      await this.mergeStrandPeerAddrs(strandNode, addrs, strandId);
+      const recorded = await this.remergeStrandFretRecords(strandNode, strandId);
+      await this.remergeUnrecordedFormationAddrs(strandNode, strandId, recorded);
     } catch (error) {
       log('refreshStrandPeerAddrs: strand %s refresh failed (continuing): %o', strandId, error);
     }
   }
 
+  /**
+   * Is `strandNode` still the node `strandId` runs on? Asked again after every await
+   * in a refresh pass: a strand stopped mid-pass, or one already restarted onto a new
+   * node, must never have its store written to.
+   */
+  private isRunningStrandNode(strandId: string, strandNode: Libp2p): boolean {
+    return this._running && this.strandManager.getInstance(strandId)?.libp2pNode === strandNode;
+  }
+
+  /**
+   * Re-merge, into a running strand node's address book, the addresses of every peer
+   * its FRET routing table holds a signed address record for (`strand-fret-addrs.ts`).
+   *
+   * This is what keeps ANOTHER PARTY's strand nodes dialable from a node that stays
+   * up. Nothing re-resolves their addresses — the strand-addr RPC answers own-party
+   * siblings only — and the peerStore hides an address one hour after it was first
+   * observed. FRET keeps each peer's record but hands it to the peerStore only when it
+   * arrives or is imported, so without this pass a connection to another party that
+   * drops after the first hour could not be redialed by either side.
+   *
+   * A record is held while FRET holds the peer's table entry, and at most 14 days after
+   * it was last confirmed, so that is also how long a wrong address can keep being
+   * re-merged. Each record is signed by the peer it names and verified before use, so
+   * the exposure is failed dials to an address that peer itself published.
+   *
+   * NOTE: every pass serialises the whole FRET table (`exportTable()`), verifies one
+   * signature per record and makes one `peerStore.merge` per peer, per running strand
+   * per 15 s tick. Fine at strand table sizes, and an unchanged address set writes
+   * nothing in libp2p's persistent peer store. If many strands or large tables make it
+   * show up, read only the entries whose address stamp is near the one-hour mark.
+   *
+   * @returns the ids of the peers the table holds a usable record for.
+   */
+  private async remergeStrandFretRecords(strandNode: Libp2p, strandId: string): Promise<ReadonlySet<string>> {
+    const { peers, rejected } = await strandFretPeerAddrs(strandNode);
+    const recorded = new Set(peers.keys());
+    if ((peers.size === 0 && rejected === 0) || !this.isRunningStrandNode(strandId, strandNode)) {
+      return recorded;
+    }
+    const counts: Record<MergeAddrsResult, number> = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
+    for (const [peerId, addrs] of peers) {
+      counts[await mergePeerAddrs(strandNode, peerId, addrs)]++;
+    }
+    log('strand %s FRET address records re-merged (peers=%d, merged=%d, restamped=%d, failed=%d, rejected=%d)',
+      strandId, peers.size, counts.merged, counts.restamped, counts.failed, rejected);
+    return recorded;
+  }
+
+  /**
+   * Re-merge the addresses this strand's formation carried ({@link formationStrandAddrs})
+   * for every peer the strand node's FRET table holds no record for (`recorded`).
+   *
+   * Until the first connection to the responder, the carried addresses are the only
+   * thing naming it, and the launch seed writes them once. FRET's `bootstraps` keep only
+   * the peer id, so if the responder stays unreachable past the peerStore's one-hour
+   * expiry, nothing could dial it when it returns. Once FRET holds the peer's own signed
+   * record, that record supersedes what the formation carried and this stops.
+   */
+  private async remergeUnrecordedFormationAddrs(
+    strandNode: Libp2p,
+    strandId: string,
+    recorded: ReadonlySet<string>
+  ): Promise<void> {
+    const carried = this.formationStrandAddrs.get(strandId);
+    if (!carried) {
+      return;
+    }
+    const unrecorded = [...groupAddrsByPeerId(carried)]
+      .filter(([peerId]) => !recorded.has(peerId))
+      .flatMap(([, addrs]) => addrs.map((addr) => addr.toString()));
+    if (unrecorded.length === 0 || !this.isRunningStrandNode(strandId, strandNode)) {
+      return;
+    }
+    await this.mergeStrandPeerAddrs(strandNode, unrecorded, strandId);
+  }
+
   /**
    * RPC `due` siblings for `strandId` and set each one's next due time from its own
    * outcome: an answer, even an empty one, waits the full refresh interval; anything
@@ -6490,11 +6629,11 @@ export class CadreNode implements SAppIdLookup {
    * attributed per peer. Best-effort throughout: an address-book write must never
    * fail a launch, a resume, or a reconcile pass.
    *
-   * `addrs` is the peer-agnostic union the strand-addr RPC returns, so
-   * {@link groupAddrsByPeerId} attributes each entry to the **strand transport**
-   * peerId in its final `/p2p/` component — never the sibling's control peerId,
-   * which names a different libp2p node entirely. Entries that name no peer are
-   * dropped there and counted here, once per pass.
+   * `addrs` is a peer-agnostic list — the union the strand-addr RPC returns, or the
+   * addresses a formation carried — so {@link groupAddrsByPeerId} attributes each
+   * entry to the **strand transport** peerId in its final `/p2p/` component — never
+   * the sibling's control peerId, which names a different libp2p node entirely.
+   * Entries that name no peer are dropped there and counted here, once per pass.
    *
    * NOTE: a member could answer with arbitrary multiaddrs bound to arbitrary peer
    * ids and poison this address book. That is the same exposure the launch-time
@@ -6504,14 +6643,13 @@ export class CadreNode implements SAppIdLookup {
    * peerStore's one-hour expiry. No new gating here — cross-party strand trust is
    * `backlog/strand-network-nat-relay-reachability`.
    *
-   * NOTE: one input ages out on a slower clock — the strand peer book's entries
-   * ({@link strandPeerBookStore}). Nothing can re-resolve another party's addresses,
-   * so {@link refreshStrandPeerAddrs} re-merges the book every pass, which means a
-   * junk entry from a responder or a peer's identify survives until the book drops it
-   * (14 days unrefreshed, or the peer's next connection replacing the entry) rather
-   * than an hour. Bounded to 16 peers × 16 addrs per strand, forgotten on
-   * `unpublishStrand` / `forgetJoinedStrand`, and still authority-free — so the
-   * exposure is a handful of failed dials, not a trust hole.
+   * NOTE: one input outlives that hour — a formation's carried addresses
+   * ({@link formationStrandAddrs}) are in every launch and resume seed for as long as
+   * this process remembers the formation, and re-merged on every refresh pass until the
+   * strand node's FRET table holds the peer's own record, so a junk address from a
+   * responder that is never met keeps being re-merged. Bounded by `sanitizeStrandAddrs`,
+   * replaced by a re-formation, dropped on `unpublishStrand` / `forgetJoinedStrand`, and
+   * still authority-free — so the exposure is a handful of failed dials, not a trust hole.
    */
   private async mergeStrandPeerAddrs(strandNode: Libp2p, addrs: string[], strandId: string): Promise<void> {
     const counts: Record<MergeAddrsResult, number> = { merged: 0, restamped: 0, skipped: 0, failed: 0 };
@@ -6562,7 +6700,7 @@ export class CadreNode implements SAppIdLookup {
     // is normally a no-op; it is the guard for a bare listen addr and for a relay hop
     // whose trailing `/p2p/` names the RELAY. An addr terminating in a DIFFERENT id is
     // dropped rather than announced — it does not reach this node, and announcing it
-    // would file our address under someone else's id in the receiver's book.
+    // would file our address under someone else's id in the receiver's address book.
     //
     // Re-parsed through this package's own `multiaddr` rather than passed straight in:
     // libp2p hands back its nested `@multiformats/multiaddr` copy, a structurally
@@ -6583,7 +6721,8 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Leave a strand joined from another party, for the whole party: remove its party-wide
    * `JoinedStrand` row (owner-signed, with a `Revocation` tombstone), then this machine's
-   * unpublished record, its strand peer book entries and any session-kept entry, then
+   * unpublished record, its formation-carried addresses, its saved network state and any
+   * session-kept entry, then
    * {@link stopStrand} it here. Every other machine's watcher then sees the row gone and
    * detaches the strand, a storage replica included; a machine offline at the time reaps the
    * row once the tombstone reaches it. The joiner's counterpart of {@link unpublishStrand},
@@ -6641,8 +6780,9 @@ export class CadreNode implements SAppIdLookup {
    * session here — the `strand:revoked` contract is that nothing is torn down for the app —
    * and its party-wide row is queued for removal by the next connected owner reconcile pass
    * (`JoinedStrandSession.forgetAfterThisSession`). A no-op for this party's own strands,
-   * which have neither record; the strand peer book is forgotten either way, since a
-   * removed party must not keep dialing the strand's peers.
+   * which have neither record; the formation-carried addresses and the saved network
+   * state are forgotten either way, since a removed party must not keep dialing the
+   * strand's peers.
    *
    * NOTE: accepted tradeoff — a sibling machine that has not raised `strand:revoked` itself
    * detaches the strand (`strand:stopped`) when the party-wide removal reaches it, instead
@@ -6668,47 +6808,16 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Forget a strand's entries in the peer book (see {@link strandPeerBookStore}):
-   * fire-and-log, like every book write — the removal is visible synchronously by the
-   * store's contract, and a failed persist costs restart survival only.
+   * Forget what this node holds about a strand's peers: the addresses its formation
+   * carried (see {@link formationStrandAddrs}) and its saved network state (see
+   * {@link strandNetworkStateStore}). The store write is fire-and-log — the removal is
+   * visible synchronously by the store's contract, and a failed persist only leaves the
+   * entry on disk for the next start.
    */
   private forgetStrandPeers(strandId: string, caller: string): void {
-    void this.strandPeerBookStore?.forget(strandId).catch((error: unknown) => {
-      log('%s: forgetting strand %s peers failed (continuing): %o', caller, strandId, error);
-    });
-  }
-
-  /**
-   * The strand peer book's observation writer (`StartStrandConfig.onStrandPeerIdentified`):
-   * a strand node identified a strand peer at `observation.addrs`, so remember it as an
-   * unsigned entry seen just now. The observer never reports self, and the store binds
-   * every address to the peer id before filing it.
-   */
-  private observeStrandPeer(strandId: string, observation: StrandPeerObservation): void {
-    this.rememberStrandPeer(strandId, {
-      peerId: observation.peerId,
-      addrs: observation.addrs,
-      issuedAt: 0,
-      lastSeenAt: Date.now()
-    }, 'observeStrandPeer');
-  }
-
-  /**
-   * Merge one entry into the peer book. Fire-and-log: the entry is visible
-   * synchronously by the store's contract, and the promise tracks durability only. A
-   * persist failure costs restart survival, never this session's seed — the same trade
-   * {@link retainDialTarget} makes.
-   */
-  private rememberStrandPeer(strandId: string, entry: StrandPeerEntry, caller: string): void {
-    const store = this.strandPeerBookStore;
-    if (!store) {
-      // Unreachable in production: start() builds the store before any strand can
-      // launch or form. Logged rather than thrown, for the same reason as retainDialTarget.
-      log('%s: no strand peer book yet — not remembering %s for strand %s', caller, entry.peerId, strandId);
-      return;
-    }
-    void store.merge(strandId, entry).catch((error: unknown) => {
-      log('%s: persisting strand %s peer %s failed (continuing): %o', caller, strandId, entry.peerId, error);
+    this.formationStrandAddrs.delete(strandId);
+    void this.strandNetworkStateStore?.forget(strandId).catch((error: unknown) => {
+      log('%s: forgetting strand %s network state failed (continuing): %o', caller, strandId, error);
     });
   }
 
@@ -7219,6 +7328,9 @@ export class CadreNode implements SAppIdLookup {
       ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
     }), this.controlNode, this.controlDatabase);
     log('Seed bootstrap service initialized');
+    // Embedders wire the owner key after start(), so the runner's first pass usually found
+    // this machine not yet an owner; without this it would wait a full poll interval.
+    this.pendingJoinRunner?.kick();
   }
 
   /**
@@ -7939,20 +8051,33 @@ export class CadreNode implements SAppIdLookup {
   // ============================================================================
 
   /**
-   * Initialize the strand solicitation service.
-   * This enables forming strands with other parties via open invitations.
+   * Replace this node's strand solicitation service — the formation responder every node
+   * installs at {@link start}, and the initiator side of {@link formStrand}. Optional: call it
+   * only to customize the responder (an approver, a provisioner, formation deadlines). The
+   * new service's handler replaces the previous one's on the control node, and invitations
+   * the previous service minted stay outstanding.
+   *
+   * Without `options.formationUsageRecorder`, tokens are checked against this party's
+   * replicated `FormationInvite`/`FormationUsage` rows ({@link ControlFormationUsageRecorder}).
+   * A responder that accepts every token is reachable only by constructing
+   * {@link StrandSolicitationService} directly.
    *
    * @param options - Configuration for the solicitation service
    */
   async initializeStrandSolicitation(options?: StrandSolicitationServiceOptions): Promise<void> {
-    if (!this.controlNode) {
+    const controlNode = this.controlNode;
+    const controlDatabase = this.controlDatabase;
+    if (!controlNode || !controlDatabase) {
       throw new Error('CadreNode must be started before initializing strand solicitation');
     }
 
     const service = new StrandSolicitationService({
       ...options,
+      formationUsageRecorder: options?.formationUsageRecorder ?? new ControlFormationUsageRecorder(controlDatabase),
       partyId: this.config.controlNetwork.partyId,
-      cadrePeerAddrs: this.getMultiaddrs(),
+      // Read per formation: the responder is installed during start, before a relay
+      // reservation gives a relay-only node any address, and addresses change after.
+      cadrePeerAddrs: () => this.getMultiaddrs(),
       // Every formation deadline derives from this node's declared link, like every other
       // dial budget here; a caller's own declaration on the formation config still wins.
       formationConfig: {
@@ -7970,24 +8095,61 @@ export class CadreNode implements SAppIdLookup {
         this.issueStrandMembershipInvite(strandId, signal)
     });
 
-    // Set before the registration is awaited, so a concurrent createOpenInvitation /
-    // formStrand uses this service instead of building a second one whose handler
-    // would collide; a failed registration puts the previous service back.
-    // NOTE: same stray-handler caveat as installSeedBootstrapService — a failed
-    // peer-store merge leaves the formation handler registered, so a retry is a duplicate.
     const previous = this.strandSolicitationService;
+    if (previous) {
+      service.adoptMintedInvitations(previous);
+    }
+    // Set before the swap is awaited, so a concurrent createOpenInvitation / formStrand
+    // uses this service instead of building another.
     this.strandSolicitationService = service;
+    const swap = this.solicitationSwaps.then(() => this.swapFormationResponder(service, controlNode));
+    // The queue only orders swaps; a failed one rejects this call's own await below.
+    this.solicitationSwaps = swap.catch(() => undefined);
+    await swap;
+    log('Strand solicitation service initialized');
+  }
+
+  /**
+   * Answer formation from start. Log-and-continue: a node that cannot is still useful, and
+   * {@link createOpenInvitation} / {@link formStrand} install the responder when it is missing.
+   */
+  private async installDefaultFormationResponder(): Promise<void> {
+    try {
+      await this.initializeStrandSolicitation();
+    } catch (error) {
+      log('Formation responder not installed at start; createOpenInvitation/formStrand will retry: %o', error);
+    }
+  }
+
+  /**
+   * Move the control node's formation handler from the registered service to `service`.
+   * Queued by {@link initializeStrandSolicitation} so swaps run one at a time: libp2p allows
+   * one handler per protocol id, and two overlapping swaps would each find the other's
+   * handler in the way. A failed swap registers the previous service again, points
+   * {@link strandSolicitationService} back at it unless a later call has replaced it, and
+   * rethrows.
+   *
+   * NOTE: same stray-handler caveat as {@link installSeedBootstrapService} — a failed
+   * peer-store merge leaves the formation handler registered, so the restore below (and a
+   * retry) rejects as a duplicate.
+   */
+  private async swapFormationResponder(service: StrandSolicitationService, controlNode: Libp2p): Promise<void> {
+    const previous = this.registeredSolicitation;
     try {
-      await service.registerResponder(this.controlNode);
+      await previous?.unregisterResponder(controlNode);
+      await service.registerResponder(controlNode);
+      this.registeredSolicitation = service;
     } catch (error) {
       if (this.strandSolicitationService === service) this.strandSolicitationService = previous;
+      await previous?.registerResponder(controlNode).catch((restoreError: unknown) =>
+        log('Re-registering the previous formation responder failed; none answers until the next initializeStrandSolicitation: %o', restoreError));
       throw error;
     }
-    log('Strand solicitation service initialized');
   }
 
   /**
-   * Get the strand solicitation service (for advanced use)
+   * Get the strand solicitation service (for advanced use). Non-null on a started node unless
+   * the install at {@link start} failed.
    */
   getStrandSolicitationService(): StrandSolicitationService | null {
     return this.strandSolicitationService;
@@ -7996,20 +8158,25 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Create an open invitation for others to form strands with this party.
    *
+   * The invitation's bootstrap list names this machine first (it is the one most likely to
+   * run the host strand), then a few of the party's other machines
+   * ({@link siblingInvitationAddrs}), so a joiner can still form while this one is offline.
+   *
    * @param sAppId - The sApp to use for formed strands
    * @param expirationMs - How long the invitation is valid (ms from now)
    * @returns The open invitation to share out-of-band
+   * @throws when neither this machine nor any other machine of the party has an address
    */
   async createOpenInvitation(
     sAppId: string,
     expirationMs: number = 24 * 60 * 60 * 1000 // 24 hours default
   ): Promise<OpenInvitation> {
     if (!this.strandSolicitationService) {
-      // Create a temporary service for creating invitations
+      // Only when the install at start failed.
       await this.initializeStrandSolicitation();
     }
 
-    const bootstrap = this.getMultiaddrs();
+    const bootstrap = [...this.getMultiaddrs(), ...await this.siblingInvitationAddrs()];
     if (bootstrap.length === 0) {
       throw new Error('No multiaddrs available for invitation');
     }
@@ -8022,11 +8189,44 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Form a strand with a responder via an open invitation.
+   * Addresses of the party's other machines for an invitation's bootstrap list
+   * ({@link selectInvitationSiblingAddrs} picks which). The source is each authorized
+   * member's signed `CadrePeer` record ({@link resolvePeerRecord}), so a machine whose record
+   * is missing, stale or untrusted is left out; live connections only order them.
+   *
+   * Best-effort: a failed read leaves the invitation naming this machine alone, which is what
+   * it named before siblings were added.
+   */
+  private async siblingInvitationAddrs(): Promise<string[]> {
+    const controlNode = this.controlNode;
+    if (!controlNode || !this.controlDatabase) {
+      return [];
+    }
+    try {
+      const siblings: InvitationSibling[] = [];
+      for (const { peerId } of await this.listAuthorizedMembers()) {
+        const resolved = await this.resolvePeerRecord(peerId, {});
+        if (resolved && resolved.addrs.length > 0) {
+          siblings.push({ peerId, updatedAt: resolved.updatedAt, addrs: resolved.addrs.map(String) });
+        }
+      }
+      const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
+      return selectInvitationSiblingAddrs(siblings, connected);
+    } catch (error) {
+      log('createOpenInvitation: resolving the other machines failed; the invitation names only this one: %o', error);
+      return [];
+    }
+  }
+
+  /**
+   * Form a strand with a responder via an open invitation: one attempt, from this machine, with
+   * nothing recorded party-wide. {@link requestJoin} is the path that keeps trying.
    *
    * @param invitation - The open invitation received out-of-band
    * @param disclosure - Identity/context information to share with the responder
    * @returns The member key and strand info if successful
+   * @throws `FormationRejectedError` or `FormationUnreachableError` when the formation fails, and
+   *   `FormationPostApprovalError` when it was approved and a step on this machine then failed
    */
   async formStrand(
     invitation: OpenInvitation,
@@ -8045,7 +8245,7 @@ export class CadreNode implements SAppIdLookup {
       disclosure,
       this.controlNode
     );
-    this.recordFormationStrandPeers(result.strandId, result.strandAddrs);
+    await this.recordFormationStrandAddrs(result.strandId, result.strandAddrs);
     // A closed host strand's approval carries the joiner's own membership invitation —
     // persist this party's identity key and stage the invitation for bring-up to redeem.
     // Runs AFTER the addr recording so a persistence failure (which throws — see the
@@ -8057,6 +8257,190 @@ export class CadreNode implements SAppIdLookup {
     return result;
   }
 
+  /**
+   * Ask to join through `invitation` and have the party keep trying until the join works, the
+   * invitation is used up or expires, or the request is dismissed: across restarts, and from
+   * any owner machine of the party (`docs/strands.md` → "Joining while the inviter is
+   * offline"). Records a party-wide `PendingJoin` row, runs one attempt on this machine at
+   * once, and returns the status after it: `'joined'` when the inviter answered yes, `'waiting'`
+   * when it was unreachable or not ready, `'failed'` when it refused for good.
+   *
+   * Asking again for an invitation whose request is still pending adopts that request as it
+   * is; asking again after it finished starts a fresh one. Later changes arrive as
+   * `pendingJoin:changed`. A joined strand is offered through `strand:discovered` like any
+   * {@link formStrand} join. Do not also call {@link formStrand} with the same invitation:
+   * nothing coordinates the two, and one of them gets `token-spent`.
+   *
+   * @throws on a machine that is not an enrolled owner (the row is owner-signed), and on an
+   *   invitation already past its expiration
+   */
+  async requestJoin(invitation: OpenInvitation, disclosure: StrandFormationDisclosure = {}): Promise<PendingJoinStatus> {
+    const { database, runner } = this.requirePendingJoins();
+    const signer = await this.requireOwnerSigner(
+      'requestJoin needs an enrolled owner machine of this party, because the party-wide join request is ' +
+      'owner-signed. formStrand(invitation, disclosure) joins once from this machine, with no retries.'
+    );
+    const now = Date.now();
+    const expiresAt = invitation.expiration.getTime();
+    if (!Number.isFinite(expiresAt)) {
+      throw new Error('The invitation carries no valid expiration');
+    }
+    if (now >= expiresAt) {
+      throw new Error(`The invitation expired at ${invitation.expiration.toISOString()}; ask the inviter for a fresh one`);
+    }
+    const requested = requestedPendingJoin(
+      pendingJoinId(invitation.token), this.encodeInvitation(invitation), disclosure, expiresAt, now);
+    const row = await this.recordJoinRequest(database, requested, signer);
+    log('requestJoin: pending join %s recorded; attempting now', row.Id);
+    return runner.attemptNow(row);
+  }
+
+  /**
+   * Every join asked for with {@link requestJoin} and not dismissed, pending or finished, as this
+   * machine sees it (see `PendingJoinStatus` for which states are machine-local).
+   */
+  async listPendingJoins(): Promise<PendingJoinStatus[]> {
+    const { database, runner } = this.requirePendingJoins();
+    return (await database.queryPendingJoins()).map((row) => runner.statusOf(row));
+  }
+
+  /**
+   * Remove a join request party-wide. On a pending request this cancels it: every owner machine
+   * stops at its next read, and an attempt already running does not record its outcome (a join
+   * it made stays on that machine, as any {@link formStrand} join does). Owner machines only.
+   * Resolves `false` when there was no such request.
+   */
+  async dismissPendingJoin(id: string): Promise<boolean> {
+    const { database, runner } = this.requirePendingJoins();
+    const { ownerKey, signMessage } = await this.requireOwnerSigner(
+      'dismissPendingJoin needs an enrolled owner machine of this party: the removal is owner-signed');
+    const removed = await database.deletePendingJoin(id, ownerKey, signMessage);
+    runner.forgetRow(id);
+    return removed;
+  }
+
+  private requirePendingJoins(): { database: ControlDatabase; runner: PendingJoinRunner } {
+    if (!this._running || !this.controlDatabase || !this.pendingJoinRunner) {
+      throw new Error('CadreNode must be started before using pending joins');
+    }
+    return { database: this.controlDatabase, runner: this.pendingJoinRunner };
+  }
+
+  /** This machine's owner key and signer for an owner-signed control write, or a throw carrying `refusal`. */
+  private async requireOwnerSigner(refusal: string): Promise<{ ownerKey: string; signMessage: (message: Uint8Array) => string }> {
+    const signingKey = await this.enrolledOwnerSigningKey();
+    if (!signingKey) {
+      throw new Error(refusal);
+    }
+    return { ownerKey: signingKey.publicKeyB64, signMessage: signMessageWith(signingKey.privateKeyB64) };
+  }
+
+  /**
+   * Write a join request's row, or adopt the party's existing row for the same invitation: a
+   * pending one as it is, a finished one replaced by `requested` (the user asked again).
+   */
+  private async recordJoinRequest(
+    database: ControlDatabase,
+    requested: PendingJoinFields,
+    { ownerKey, signMessage }: { ownerKey: string; signMessage: (message: Uint8Array) => string }
+  ): Promise<PendingJoinRow> {
+    let written: PendingJoinRow;
+    try {
+      written = await database.insertPendingJoin(requested, ownerKey, signMessage);
+    } catch (error) {
+      if (!isPendingJoinConflict(error)) {
+        throw error;
+      }
+      const existing = await database.queryPendingJoin(requested.Id);
+      if (!existing) {
+        throw new Error(
+          `A removed join request for this invitation (${requested.Id}) is still held on this machine until its ` +
+          'clean-up runs, which needs a connection to the party. Ask again once connected.',
+          { cause: error }
+        );
+      }
+      if (existing.Outcome === null) {
+        return existing;
+      }
+      written = await database.replacePendingJoin(existing.StampId, requested, ownerKey, signMessage);
+    }
+    this.pendingJoinRunner?.noteWritten(written);
+    return written;
+  }
+
+  /** Build and start the pending-join retry loop over this node (see {@link pendingJoinRunner}). */
+  private startPendingJoinRunner(): void {
+    const database = (): ControlDatabase => {
+      if (!this.controlDatabase) {
+        throw new Error('CadreNode is stopped: no control database for pending joins');
+      }
+      return this.controlDatabase;
+    };
+    const outcomeSigner = (): Promise<{ ownerKey: string; signMessage: (message: Uint8Array) => string }> =>
+      this.requireOwnerSigner('Cannot record a pending join outcome: this machine is not an enrolled owner of the party');
+    this.pendingJoinRunner = new PendingJoinRunner({
+      selfId: this.controlNode!.peerId.toString(),
+      linkRoundTripMs: this.config.network?.linkRoundTripMs,
+      isOwner: async () => (await this.enrolledOwnerSigningKey()) !== null,
+      // NOTE: one owner-key read and one `PendingJoin` read per pass (30 s); for a party that never
+      // asked for a join the second reads a never-written block, which consults the cohort. If it
+      // shows up in a device profile, poll more slowly while the table reads empty.
+      readRows: () => database().queryPendingJoins(),
+      readRow: (id) => database().queryPendingJoin(id),
+      attempt: (row) => this.formStrand(this.pendingJoinInvitation(row), parseStoredDisclosure(row)),
+      replace: async (expectedStampId, next) => {
+        const { ownerKey, signMessage } = await outcomeSigner();
+        return database().replacePendingJoin(expectedStampId, next, ownerKey, signMessage);
+      },
+      remove: async (id) => {
+        const { ownerKey, signMessage } = await outcomeSigner();
+        return database().deletePendingJoin(id, ownerKey, signMessage);
+      },
+      isAlone: () => this.committedAlone(),
+      sAppIdOf: (row) => this.pendingJoinSAppId(row),
+      observeRows: (rows) => this.stageMembershipInvitesFromPendingJoins(rows),
+      emit: (status) => this.emit('pendingJoin:changed', status),
+    });
+    this.pendingJoinRunner.start();
+  }
+
+  /** The invitation a `PendingJoin` row stores. A failure names the row, never the invitation, which is a bearer credential. */
+  private pendingJoinInvitation(row: PendingJoinRow): OpenInvitation {
+    try {
+      return this.decodeInvitation(row.Invitation);
+    } catch {
+      throw new Error(`PendingJoin ${row.Id}: the stored invitation does not decode`);
+    }
+  }
+
+  private pendingJoinSAppId(row: PendingJoinRow): string {
+    try {
+      return this.decodeInvitation(row.Invitation).sAppId;
+    } catch {
+      log('PendingJoin %s: the stored invitation does not decode; reporting no sApp', row.Id);
+      return '';
+    }
+  }
+
+  /**
+   * Stage the membership invitation of each `joined` row this process has not staged yet, so a
+   * closed strand joined on another owner machine is seated by whichever machine launches it
+   * first; the party key it admits is the replicated `StrandPartyKey` row the finishing machine
+   * seated. A strand that already has an invitation staged keeps it, for the reconciler to
+   * settle first.
+   */
+  private stageMembershipInvitesFromPendingJoins(rows: readonly PendingJoinRow[]): void {
+    for (const { rowId, strandId, invite } of membershipInvitesToStage(rows, this.stagedMembershipInviteKeys, Date.now())) {
+      this.stagedMembershipInviteKeys.add(invite.inviteKey);
+      if (this.pendingMembershipInvites.has(strandId)) {
+        continue;
+      }
+      this.pendingMembershipInvites.set(strandId, invite);
+      log('pending join %s: staged its membership invitation for strand %s', rowId, strandId);
+      this.strandManager.notifyMembershipInviteStaged(strandId);
+    }
+  }
+
   /**
    * Remember the strand a formation just joined (see {@link joinedStrandStore}), so it
    * is re-offered after a restart even when the app is killed before its `addStrand`, and
@@ -8077,7 +8461,8 @@ export class CadreNode implements SAppIdLookup {
         joinedAt: Date.now()
       });
     } catch (error) {
-      throw new Error(
+      throw new FormationPostApprovalError(
+        result.strandId,
         `Formation for strand ${result.strandId} was approved (its one-time token is spent), but ` +
         'remembering the join in this node\'s joined-strand store failed, so the strand would not ' +
         'come back after a restart. Fix the store (usually the configured keyStore), then redeem a ' +
@@ -8113,7 +8498,8 @@ export class CadreNode implements SAppIdLookup {
     try {
       await this.ensureStrandPartyKey(strandId);
     } catch (error) {
-      throw new Error(
+      throw new FormationPostApprovalError(
+        strandId,
         `Formation for strand ${strandId} was approved (its one-time token is spent), but ` +
         'persisting this party\'s membership identity (StrandPartyKey) failed — the joiner ' +
         'cannot become a member without it. Fix the underlying cause, then redeem a fresh ' +
@@ -8122,6 +8508,7 @@ export class CadreNode implements SAppIdLookup {
       );
     }
     this.pendingMembershipInvites.set(strandId, invite);
+    this.stagedMembershipInviteKeys.add(invite.inviteKey);
     log('formStrand: staged membership invitation for strand %s (party key persisted)', strandId);
     this.strandManager.notifyMembershipInviteStaged(strandId);
   }
@@ -8303,41 +8690,40 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Remember the responder's strand-network addresses for a strand this node just
-   * formed in the strand peer book (see {@link strandPeerBookStore}), so the strand's
-   * discovery seed has something to work with when the app launches it — and again
-   * after every restart.
+   * Keep the responder's strand-network addresses for a strand this node just formed
+   * (see {@link formationStrandAddrs}), so the strand's discovery seed has something to
+   * dial when the app launches it.
    *
    * The carried list is peer-agnostic (`sanitizeStrandAddrs` bounds and parses it,
    * nothing more), so it is attributed per peer here (`groupAddrsByPeerId`, the same
-   * rule the address-book merge applies) and each peer becomes one unsigned entry seen
-   * just now: the responder disclosed the addresses live a moment ago. An entry naming
-   * no destination peer is dropped there. Scoped strictly to `strandId`: these
-   * addresses reach ONE strand node of ONE other party and must never seed another
-   * strand's mesh or the control peerStore. An empty list records nothing, so a later
-   * formation against the same strand that DOES disclose addresses is not shadowed.
-   */
-  private recordFormationStrandPeers(strandId: string, strandAddrs: readonly string[]): void {
-    if (strandAddrs.length === 0) {
-      log('formStrand: responder disclosed no strand addrs for %s — cross-party seed stays empty', strandId);
+   * rule the address-book merge applies) and kept grouped by peer; an entry naming no
+   * destination peer is dropped there. Scoped strictly to `strandId`: these addresses
+   * reach ONE strand node of ONE other party and must never seed another strand's mesh
+   * or the control peerStore.
+   *
+   * A list that names a peer REPLACES the strand's earlier one: the responder
+   * disclosed its current addresses, so the older list is stale. An empty list, or one
+   * naming no peer, records nothing, so it cannot wipe an earlier disclosure.
+   *
+   * A strand already running when this lands (a re-formation, which is the recovery
+   * path for a dead address) gets the new addresses merged into its address book now.
+   * Nothing else would deliver them: the seed is read only at launch and resume, and the
+   * refresh pass skips a peer FRET already holds a record for — the stale one, here.
+   */
+  private async recordFormationStrandAddrs(strandId: string, strandAddrs: readonly string[]): Promise<void> {
+    const attributed = [...groupAddrsByPeerId([...strandAddrs]).values()]
+      .flatMap((peerAddrs) => peerAddrs.map((addr) => addr.toString()));
+    if (attributed.length === 0) {
+      log('formStrand: responder disclosed no usable strand addrs for %s (%d carried) — cross-party seed unchanged',
+        strandId, strandAddrs.length);
       return;
     }
-    const now = Date.now();
-    let peers = 0;
-    for (const [peerId, addrs] of groupAddrsByPeerId([...strandAddrs])) {
-      this.rememberStrandPeer(strandId, {
-        peerId,
-        addrs: addrs.map((ma) => ma.toString()),
-        issuedAt: 0,
-        lastSeenAt: now
-      }, 'formStrand');
-      peers++;
-    }
-    // A strand already running when this lands (a re-formation) needs nothing more: the
-    // refresh pass merges the book into its address book on every reconcile tick, so the
-    // new addresses land within 15 s — which matters because re-forming is the recovery
-    // path for a dead entry.
-    log('formStrand: recorded %d cross-party strand addr(s) for %s under %d peer(s)', strandAddrs.length, strandId, peers);
+    this.formationStrandAddrs.set(strandId, attributed);
+    log('formStrand: kept %d of %d cross-party strand addr(s) for %s', attributed.length, strandAddrs.length, strandId);
+    const runningNode = this.strandManager.getInstance(strandId)?.libp2pNode;
+    if (runningNode) {
+      await this.mergeStrandPeerAddrs(runningNode, attributed, strandId);
+    }
   }
 
   /**