Use separate LAN and relay transport clients, dialled sequentially inside one admission-guarded future. Bound the LAN leg at 5 seconds only when a relay client exists, because that deadline exists solely to reserve caller budget for the alternate leg; credentials with no relay origin keep today's unbounded ladder. This survives the untimed TLS-handshake case that ladder shortening alone cannot fix, without raising any caller budget. Only the relay client holds the refreshable device token, preserving exactly one refresh single-flight. Wire the existing ensure_registered path into the sync worker's unregistered branch. After a failed owner start, the first attempt fires on the first wake, whether a notification or the 60-second periodic tick, because owner start does not stamp last_recovery_attempt; after that, the 300-second recovery cooldown is the bound. Keep the terminal signals distinct: RepairOutcome::GuardRefused at owner start still ends startup with RegistrationInvalid, while UploadClient::is_revoked(), latched by a 403, is checked at the sync call site because ensure_registered deliberately does not consult revocation. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>