@@ -146,17 +146,21 @@ Target gating is used extensively:
   the sync scheduler.
 - Browser startup starts fully warm networks independently, then coordinates
   missing targets under a shared Web Lock and their per-network leadership
-  locks. Networks led in another tab are left to their existing runners. Seeds
-  download in parallel; failed downloads leave only those targets for retry,
-  while successful downloads are rechecked against persisted watermarks and
-  imported together in one bounded sqlite-web session. A globally fresh DB drops
+  locks. Ownership transfers directly to cold runners, including on failure;
+  networks led in another tab are left to their existing runners. Seeds download
+  in parallel; failed downloads leave only those targets for retry, while
+  successful downloads are rechecked against persisted watermarks and imported
+  together in one bounded sqlite-web session. A globally fresh DB drops
   non-unique secondary indexes and rebuilds them once after all seeds; additions
-  to a populated DB retain existing indexes. PRIMARY KEY/UNIQUE indexes remain
-  enforced. One best-effort `ANALYZE` follows, then cold network loops catch up
-  and establish readiness. Import/manifest failures and unsupported coordination
-  fall back to per-network provisioning; stale-target refresh retains its
-  existing behavior. Remote waits are bounded to two minutes per request and
-  scheduler stop cancels coordination/import cleanup.
+  to a populated DB retain existing indexes. A shared import Web Lock covers
+  watermark/index preflight through commit or cancellation for both cohort and
+  per-network imports; without that ownership, or after SDK lease contention,
+  imports retain indexes. PRIMARY KEY/UNIQUE indexes remain enforced. Cold
+  network loops catch up, analyze their applied data and establish readiness;
+  the cohort does not run an additional `ANALYZE`. Import/manifest failures and
+  unsupported coordination fall back to per-network provisioning; stale-target
+  refresh retains its existing behavior. Remote waits are bounded to two minutes
+  per request and scheduler stop cancels coordination/import cleanup.
 - `LocalDbState` encapsulates the local DB handle, scheduler, `SyncReadiness`
   (tracks which chains have completed a sync cycle), and the set of configured
   chain IDs. Query routing uses `QuerySource::LocalDb` vs
 
@@ -232,6 +232,7 @@ struct ImportSessionGuard {
     executor: JsCallbackExecutor,
     pending: Option<PendingImport>,
     serialize: Option<OwnedMutexGuard<()>>,
+    ownership: Option<super::pipeline::runner::leadership::LeadershipGuard>,
 }
 
 enum PendingImport {
@@ -275,9 +276,11 @@ impl Drop for ImportSessionGuard {
         };
         let executor = self.executor.clone();
         let serialize = self.serialize.take();
+        let ownership = self.ownership.take();
         wasm_bindgen_utils::prelude::wasm_bindgen_futures::spawn_local(async move {
             // Keep later queries/imports serialized until rollback finishes.
             let _serialize = serialize;
+            let _ownership = ownership;
             let id = match pending {
                 PendingImport::Active { id, in_flight } => {
                     // The SDK rejects cancellation while an append/finish/cancel
@@ -410,6 +413,29 @@ impl JsCallbackExecutor {
                     })
             })
             .collect::<Result<Vec<_>, _>>()?;
+        // Both cohort and per-network imports hold the same cross-tab lock
+        // before reading watermarks. A competing import cannot populate the DB
+        // between this preflight and opening our worker session.
+        let started = js_sys::Date::now();
+        let ownership = loop {
+            match super::pipeline::runner::leadership::acquire_import().await {
+                Ok(Some(guard)) => break Some(guard),
+                Ok(None) if within_import_wait(started) => {
+                    gloo_timers::future::TimeoutFuture::new(IMPORT_WAIT_POLL_MS).await;
+                }
+                Ok(None) => {
+                    return Err(LocalDbQueryError::database(
+                        "Timed out waiting for import ownership",
+                    ));
+                }
+                Err(error) => {
+                    // Import still works through the SDK lease without Web
+                    // Locks, but preflight cannot safely justify index drops.
+                    tracing::warn!(%error, "Import ownership unavailable; retaining indexes");
+                    break None;
+                }
+            }
+        };
         // Only a globally fresh DB benefits from rebuilding every index. Adding
         // seeds to a populated DB keeps indexes over its existing history intact.
         let watermarks = self
@@ -419,7 +445,7 @@ impl JsCallbackExecutor {
             .await?;
         let has_watermarks: Vec<serde_json::Value> =
             serde_json::from_str(&watermarks).map_err(|_| LocalDbQueryError::invalid_response())?;
-        let defer_indexes = has_watermarks.is_empty();
+        let defer_indexes = ownership.is_some() && has_watermarks.is_empty();
         let mut prefix = String::from("BEGIN;\n");
         let mut suffix = String::new();
         if defer_indexes {
@@ -445,6 +471,7 @@ impl JsCallbackExecutor {
             executor: self.clone(),
             pending: None,
             serialize: Some(serialize),
+            ownership,
         };
         let started = js_sys::Date::now();
         let id = loop {
@@ -457,6 +484,11 @@ impl JsCallbackExecutor {
             match result {
                 Err(err) if err.is_import_in_progress() && within_import_wait(started) => {
                     guard.pending = None;
+                    // An older SDK caller may not participate in our Web Lock.
+                    // Its import invalidates preflight; retain indexes rather
+                    // than rebuild over data committed while we waited.
+                    prefix = String::from("BEGIN;\n");
+                    suffix = String::from("COMMIT;\n");
                     gloo_timers::future::TimeoutFuture::new(IMPORT_WAIT_POLL_MS).await;
                 }
                 result => break result?,
@@ -1318,6 +1350,41 @@ pub mod tests {
             }
         }
 
+        #[wasm_bindgen_test]
+        async fn import_lease_contention_retains_preflight_indexes() {
+            let local_db = Function::new_no_args(r#"return {
+                chunks: [], begins: 0,
+                query(sql) { return {value: sql.includes('target_watermarks') ? '[]' :
+                    '[{"name":"idx_t_value","sql":"CREATE INDEX idx_t_value ON t(value)"}]'}; },
+                transaction() {}, wipeAndRecreate() {},
+                beginSqlDumpImport() {
+                    if (++this.begins === 1) return {error:{msg:'busy',readableMsg:'SQL dump import is in progress'}};
+                    return {value:'session'};
+                },
+                appendSqlDumpChunk(id, sql) { this.chunks.push(sql); return {value:''}; },
+                finishSqlDumpImport() { return {value:''}; }, cancelSqlDumpImport() {}
+            };"#).call0(&JsValue::UNDEFINED).unwrap();
+            let exec = JsCallbackExecutor::new(local_db.clone()).unwrap();
+            exec.execute_sql_dump(Arc::new("BEGIN; INSERT INTO t VALUES (1); COMMIT;".into()))
+                .await
+                .unwrap();
+            let chunks = Reflect::get(&local_db, &"chunks".into())
+                .unwrap()
+                .dyn_into::<Array>()
+                .unwrap();
+            let sql = chunks
+                .iter()
+                .map(|v| v.as_string().unwrap())
+                .collect::<String>();
+            assert!(sql.contains("INSERT INTO t VALUES (1)"));
+            assert!(!sql.contains("DROP INDEX"));
+            assert!(!sql.contains("CREATE INDEX"));
+            assert_eq!(
+                Reflect::get(&local_db, &"begins".into()).unwrap().as_f64(),
+                Some(2.0)
+            );
+        }
+
         #[wasm_bindgen_test]
         async fn cohort_rejects_bad_envelopes_before_opening_a_session() {
             let local_db = Function::new_no_args(
 
@@ -416,6 +416,62 @@ mod wasm_tests {
 
     wasm_bindgen_test_configure!(run_in_browser);
 
+    #[wasm_bindgen_test]
+    async fn import_preflight_waits_for_cross_tab_ownership() {
+        use super::pipeline::runner::leadership::acquire_import;
+        use js_sys::{Array, Function, Reflect};
+        use std::sync::Arc;
+        let mut holder = None;
+        for _ in 0..100 {
+            holder = acquire_import().await.unwrap();
+            if holder.is_some() {
+                break;
+            }
+            TimeoutFuture::new(5).await;
+        }
+        let holder = holder.expect("previous test must release import ownership");
+        let local_db = Function::new_no_args(r#"return {
+            reads:0, populated:false, chunks:[],
+            query(sql) {
+                this.reads++;
+                if (!sql.includes('target_watermarks')) throw new Error('must retain populated indexes');
+                return {value:this.populated ? '[{"present":1}]' : '[]'};
+            },
+            transaction() {}, wipeAndRecreate() {},
+            beginSqlDumpImport() { return {value:'session'}; },
+            appendSqlDumpChunk(id, sql) { this.chunks.push(sql); return {value:''}; },
+            finishSqlDumpImport() { return {value:''}; }, cancelSqlDumpImport() {}
+        };"#).call0(&JsValue::UNDEFINED).unwrap();
+        let exec = JsCallbackExecutor::new(local_db.clone()).unwrap();
+        let mut import = exec.execute_sql_dumps(vec![Arc::new(
+            "BEGIN; INSERT INTO t VALUES (2); COMMIT;".into(),
+        )]);
+        for _ in 0..10 {
+            assert!(futures::poll!(import.as_mut()).is_pending());
+            gloo_timers::future::TimeoutFuture::new(1).await;
+        }
+        assert_eq!(
+            Reflect::get(&local_db, &"reads".into()).unwrap().as_f64(),
+            Some(0.0)
+        );
+        Reflect::set(&local_db, &"populated".into(), &JsValue::TRUE).unwrap();
+        drop(holder);
+        import.await.unwrap();
+        assert_eq!(
+            Reflect::get(&local_db, &"reads".into()).unwrap().as_f64(),
+            Some(1.0)
+        );
+        let chunks = Reflect::get(&local_db, &"chunks".into())
+            .unwrap()
+            .dyn_into::<Array>()
+            .unwrap();
+        let sql = chunks
+            .iter()
+            .map(|v| v.as_string().unwrap())
+            .collect::<String>();
+        assert!(!sql.contains("DROP INDEX"));
+    }
+
     fn single_raindex_settings_yaml() -> String {
         format!(
             r#"
 
@@ -139,9 +139,8 @@ where
     db.execute_sql_dumps(dumps)
         .await
         .map_err(LocalDbError::DumpImportFailed)?;
-    if let Err(error) = db.query_text(&SqlStatement::new("ANALYZE")).await {
-        tracing::warn!(%error, "Coordinated bootstrap ANALYZE failed");
-    }
+    // The normal first catch-up cycle analyzes its applied data. An ANALYZE
+    // here would repeat that full-database scan before the networks are ready.
     Ok(())
 }
 
@@ -345,7 +344,7 @@ local-db-sync:
             assert_eq!(imports[0].len(), 2);
             assert!(imports[0][0].contains("'a'"));
             assert!(imports[0][1].contains("'b'"));
-            assert_eq!(*db.analyzes.borrow(), 1);
+            assert_eq!(*db.analyzes.borrow(), 0, "catch-up owns ANALYZE");
         }
     }
 
@@ -369,7 +368,7 @@ local-db-sync:
         let imports = db.imports.borrow();
         assert_eq!(imports.len(), 1);
         assert_eq!(imports[0].len(), 2);
-        assert_eq!(*db.analyzes.borrow(), 1);
+        assert_eq!(*db.analyzes.borrow(), 0, "catch-up owns ANALYZE");
     }
 
     #[wasm_bindgen_test]
@@ -445,7 +444,7 @@ local-db-sync:
         assert_eq!(imports.len(), 1);
         assert_eq!(imports[0].len(), 1);
         assert!(imports[0][0].contains("'a'"));
-        assert_eq!(*db.analyzes.borrow(), 1);
+        assert_eq!(*db.analyzes.borrow(), 0, "catch-up owns ANALYZE");
     }
 
     #[wasm_bindgen_test]
 
@@ -117,6 +117,16 @@ pub(crate) async fn acquire_bootstrap() -> Result<Option<LeadershipGuard>, Local
     acquire_bootstrap_lock("local-db-bootstrap").await
 }
 
+/// Serialize browser dump preflight and import, including per-network fallback.
+#[cfg(target_family = "wasm")]
+pub(crate) async fn acquire_import() -> Result<Option<LeadershipGuard>, LocalDbError> {
+    // Non-browser Wasm callers have no cross-tab ownership to coordinate.
+    if window().is_none() {
+        return Ok(Some(LeadershipGuard::new_noop()));
+    }
+    acquire_bootstrap_lock("local-db-sql-dump-import").await
+}
+
 /// Protect initial seed writes from existing per-network leaders in other tabs.
 #[cfg(target_family = "wasm")]
 pub(crate) async fn acquire_network_bootstrap(
 
@@ -136,6 +136,13 @@ where
         !self.manifests_loaded || !self.has_provisioned_dumps
     }
 
+    /// Keep the coordinator's network ownership through the first sync cycle.
+    #[cfg(any(target_family = "wasm", test))]
+    pub(crate) fn with_initial_leadership(mut self, guard: Option<LeadershipGuard>) -> Self {
+        self.leadership_guard = guard;
+        self
+    }
+
     pub async fn run<DB>(&mut self, db: &DB) -> Result<RunOutcome, LocalDbError>
     where
         DB: LocalDbQueryExecutor + ?Sized,
@@ -1520,6 +1527,29 @@ raindexes:
         assert_eq!(telemetry.builder_inits(), 4);
     }
 
+    #[tokio::test]
+    async fn transferred_leadership_skips_reacquisition() {
+        let telemetry = Telemetry::default();
+        let environment = build_environment(manifest_for_both(), HashMap::new(), 1, 2, telemetry);
+        // No acquire is allowed: the coordinator already owns this network,
+        // even if one of its seed downloads failed and the runner must retry.
+        let leadership = SequenceLeadership::new(Vec::new());
+        let mut runner =
+            ClientRunner::with_environment(two_raindexes_settings_yaml(), environment, leadership)
+                .unwrap()
+                .with_initial_leadership(Some(LeadershipGuard::new_noop()));
+        let db = RecordingDb::default();
+        prepare_db_for_targets(&db, &runner.base_targets);
+        assert!(matches!(
+            runner.run(&db).await.unwrap(),
+            RunOutcome::Report(_)
+        ));
+        assert!(matches!(
+            runner.run(&db).await.unwrap(),
+            RunOutcome::Report(_)
+        ));
+    }
+
     #[tokio::test]
     async fn leadership_guard_reused_across_runs() {
         let telemetry = Telemetry::default();
 
@@ -1,7 +1,7 @@
 use super::super::bootstrap::{provision_missing_targets, warm_network_keys};
 use super::super::config::NetworkRunnerConfig;
 use super::super::environment::default_environment;
-use super::super::leadership::DefaultLeadership;
+use super::super::leadership::{DefaultLeadership, LeadershipGuard};
 use super::super::ClientRunner;
 use crate::local_db::pipeline::adapters::bootstrap::BootstrapPipeline;
 use crate::local_db::pipeline::adapters::{
@@ -31,7 +31,7 @@ use js_sys::Function;
 use raindex_app_settings::local_db_manifest::DB_SCHEMA_VERSION;
 use raindex_app_settings::network::NetworkCfg;
 use std::cell::Cell;
-use std::collections::HashSet;
+use std::collections::{HashMap, HashSet};
 use std::future::Future;
 use std::pin::Pin;
 use std::rc::Rc;
@@ -151,7 +151,7 @@ pub(crate) fn start(
             }
         }
 
-        let spawn_network = |network: &NetworkCfg| {
+        let spawn_network = |network: &NetworkCfg, ownership: Option<LeadershipGuard>| {
             let config =
                 match NetworkRunnerConfig::from_global_settings(&settings_clone, &network.key) {
                     Ok(config) => config,
@@ -169,7 +169,7 @@ pub(crate) fn start(
             let environment = default_environment(status_store.clone());
 
             let runner = match ClientRunner::from_config(config.clone(), environment, leadership) {
-                Ok(r) => r,
+                Ok(r) => r.with_initial_leadership(ownership),
                 Err(err) => {
                     emit_network_status(
                         &status_store,
@@ -220,10 +220,19 @@ pub(crate) fn start(
         }
         for network in &networks_for_spawn {
             if warm.contains(&network.key) {
-                spawn_network(network);
+                spawn_network(network, None);
             }
         }
+        if networks_for_spawn
+            .iter()
+            .all(|network| warm.contains(&network.key))
+        {
+            return;
+        }
 
+        // Retain guards even on provisioning failure, and hand them directly to
+        // the runners. Dropping/reacquiring Web Locks has an asynchronous gap.
+        let mut network_ownership = HashMap::new();
         let provisioning = async {
             let _ownership = loop {
                 if let Some(guard) = super::super::leadership::acquire_bootstrap().await? {
@@ -235,7 +244,6 @@ pub(crate) fn start(
             // fallback/RPC leaders from writing the same target in another tab.
             let mut cohort_settings = settings_clone.clone();
             cohort_settings.syncs.clear();
-            let mut network_ownership = Vec::new();
             for network in &networks_for_spawn {
                 if warm.contains(&network.key) {
                     continue;
@@ -247,7 +255,7 @@ pub(crate) fn start(
                         cohort_settings
                             .syncs
                             .insert(network.key.clone(), sync.clone());
-                        network_ownership.push(guard);
+                        network_ownership.insert(network.key.clone(), guard);
                     }
                 }
             }
@@ -280,7 +288,7 @@ pub(crate) fn start(
 
         for network in &networks_for_spawn {
             if !warm.contains(&network.key) {
-                spawn_network(network);
+                spawn_network(network, network_ownership.remove(&network.key));
             }
         }
     });