@serfab/cadre-core 1.13.0 → 1.14.0

package/src/control-database.ts

@@ -1,18 +1,19 @@
 import debug from 'debug';
 import { toString as uint8ArrayToString } from 'uint8arrays';
-import { Database, registerPlugin } from '@quereus/quereus';
+import { Database, FunctionFlags, TEXT_RETURN, createScalarFunction, registerPlugin } from '@quereus/quereus';
 import type { VTablePluginInfo, FunctionPluginInfo, SqlParameters, SqlValue } from '@quereus/quereus';
 import cryptoPlugin from '@optimystic/quereus-plugin-crypto/plugin';
 import optimysticPlugin from '@optimystic/quereus-plugin-optimystic/plugin';
 import { digest, randomBytes } from '@optimystic/quereus-plugin-crypto';
 import type { Libp2p } from '@libp2p/interface';
 import type { IRepo } from '@optimystic/db-core';
-import type { StrandRow, PendingJoinRow, PeerAddressRecord, CadrePeerRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow, PushPlatform } from './types.js';
+import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow, PushPlatform, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, SeedPeer } from './types.js';
 import { CONTROL_SCHEMA } from './control-schema.js';
 import { canonicalDatetime } from './canonical-datetime.js';
-import { controlAuthorizationFields, CONTROL_TABLES } from './control-authorization.js';
-import type { ControlTable, RevocableTable, ControlDomain, ControlAction } from './control-authorization.js';
-import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, CONTROL_TABLES } from './control-authorization.js';
+import type { ControlTable, RevocableTable, BoundControlDomain, UnboundControlDomain, ControlAction, CadreInviteSignedFields } from './control-authorization.js';
+import { ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { verifyCadreInviteRow } from './peer-authorization.js';
 import { retryControlWrite, SCHEMA_INIT_RETRY_POLICY } from './control-write-retry.js';
 import type { ControlWriteRetryOptions } from './control-write-retry.js';
 import { isCohortUnreachableRead, retryControlRead } from './control-read-retry.js';
@@ -94,13 +95,15 @@ export class FormationAbortedError extends Error {
 }
 
 /**
- * The invitation's seat budget is already spent: the count of recorded `FormationUsage` rows
- * for the token has reached `FormationInvite.TotalUses`, so this redemption cannot be given a
- * seat.
+ * The invitation's seat budget is already spent: the count of recorded usage rows for the
+ * invitation has reached its `TotalUses`, so this redemption cannot be given a seat. `token`
+ * is the `FormationInvite.Token` or the `CadreInvite.Key`, whichever table the caller
+ * redeemed against.
  *
  * Raised off the committed-count check ({@link ControlDatabase.assertSeatRemains}) ahead of
  * the write, inside {@link ControlDatabase.redeemInvitation} /
- * {@link ControlDatabase.recordFormationUsage}, and off the unlocked pre-check
+ * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
+ * ({@link ControlDatabase.redeemCadreInvite}), and off the unlocked pre-check
  * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
  * pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
@@ -124,6 +127,30 @@ export class InvitationExhaustedError extends Error {
   }
 }
 
+/**
+ * {@link ControlDatabase.seatCadreInvite} was refused by `CadreInvite.AuthorizedInsert`: the
+ * row's `IssuerKey` is not an owner on THIS node, or its `IssuerSig` does not verify. The
+ * common cause is the first — the issuing owner's `OwnerKey` row has not replicated here yet,
+ * or that owner has since been removed — which is why the redemption protocol maps this to a
+ * retryable code; a tampered row fails the same way and simply never succeeds.
+ */
+export class CadreInviteIssuerUnknownError extends Error {
+  constructor(
+    readonly inviteKey: string,
+    readonly issuerKey: string,
+    options?: { cause?: unknown }
+  ) {
+    super(
+      `Cadre invitation ${inviteKey} cannot be seated here: its issuer ${issuerKey} is not an owner on this node, or its signature does not verify`,
+      options
+    );
+    this.name = 'CadreInviteIssuerUnknownError';
+  }
+}
+
+/** The refusal {@link CadreInviteIssuerUnknownError} wraps — the constraint named, as the engine words it. */
+const CADRE_INVITE_UNAUTHORIZED = /CHECK constraint failed: AuthorizedInsert\b/;
+
 /**
  * What a recorded `FormationUsage` row came out as.
  *
@@ -167,14 +194,14 @@ function parseNullableStoredDatetimeMs(value: string | number | null | undefined
  * The message is a SINGLE framed SHA-256 digest over the ordered field vector from
  * {@link controlAuthorizationFields} (the crypto plugin's injective multi-field
  * encoding): two fixed literals — the domain tag naming the table rule and the action
- * tag — followed by the row fields in the schema's fixed order, with the single-use
- * StampId as the final field where the table has one:
+ * tag — then the party id, then the row fields in the schema's fixed order, with the
+ * single-use StampId as the final field where the table has one:
  *
- *   message = sha256(encodeFields([domain, action, field_1, ..., StampId]))   // raw digest bytes
+ *   message = sha256(encodeFields([domain, action, partyId, field_1, ..., StampId]))   // raw digest bytes
  *
  * ed25519 signs these raw digest bytes DIRECTLY (no second hash). The SQL constraints
  * verify the identical bytes with one variadic call
- * (`verify(digest('CadreControl.X', 'add', field_1, ...), context.Signature, A.Key, 'ed25519')`):
+ * (`verify(digest('CadreControl.X', 'add', party_id(), field_1, ...), context.Signature, A.Key, 'ed25519')`):
  * SQL `digest(...)` returns the base64url string of the same digest, which `verify`'s default
  * base64url input encoding decodes back to those raw bytes — so signer and verifier
  * operate on the same bytes. Every field is TEXT on both sides (the SQL columns are
@@ -182,16 +209,57 @@ function parseNullableStoredDatetimeMs(value: string | number | null | undefined
  * type tags agree. Binding the row contents closes captured-stamp replay; the leading
  * domain/action tags scope the signature to ONE table rule, so an approval minted for
  * one constraint can never satisfy another (e.g. a ValidationKey enrollment can no
- * longer double as an OwnerKey enrollment). Single source of truth: every signed writer
- * (and every test/harness signer) MUST build the message through this function with the
- * schema's tags and field order, or `verify` will reject the row.
+ * longer double as an OwnerKey enrollment); the party id scopes it to ONE party, so two
+ * parties sharing an owner key never accept each other's approvals. `partyId` is the
+ * party the signer is configured for, and the SQL side reads its own through the
+ * node-local `party_id()` ({@link registerPartyIdFunction}). Single source of truth:
+ * every signed writer (and every test/harness signer) MUST build the message through
+ * this function with the schema's tags and field order, or `verify` will reject the row.
  */
 export function buildAuthorizationMessage(
-  domain: ControlDomain,
+  domain: BoundControlDomain,
   action: ControlAction,
+  partyId: string,
   rowFields: string[],
 ): Uint8Array {
-  return digest(controlAuthorizationFields(domain, action, rowFields), 'sha256', 'bytes') as Uint8Array;
+  return digest(controlAuthorizationFields(domain, action, partyId, rowFields), 'sha256', 'bytes') as Uint8Array;
+}
+
+/**
+ * {@link buildAuthorizationMessage} for the two party-free digests (`UnboundControlDomain`):
+ * the same framed digest with no party id after the tags.
+ */
+function buildUnboundAuthorizationMessage(
+  domain: UnboundControlDomain,
+  action: ControlAction,
+  rowFields: string[],
+): Uint8Array {
+  return digest(unboundAuthorizationFields(domain, action, rowFields), 'sha256', 'bytes') as Uint8Array;
+}
+
+/**
+ * Register the zero-argument scalar `party_id()` on `db`: the party id this machine is
+ * configured for, which every party-bound `digest(...)` in the control schema puts third.
+ * Node-local by design — a `context` value would be the writer's choice (a cohort member
+ * that re-ran the statement would replay it as a literal), and a stored `Party` table would
+ * be replicated data the schema already treats as untrusted. A cohort member that re-runs a
+ * statement therefore evaluates its OWN party id, and the schema text stays identical for
+ * every party. Each `Database` carries its own registration, so a process serving two
+ * parties holds two.
+ *
+ * NOTE: flagged deterministic, so the planner may fold the call into a plan; plans are
+ * per `Database` today. If Quereus ever shares plans across `Database` instances, drop
+ * the DETERMINISTIC flag or one party's id would be folded into another's checks.
+ *
+ * `ControlDatabase.initialize` calls this before hydrating persisted schemas, because a
+ * warm restart parses the persisted CHECK text, which calls it. Exported for specs that
+ * build their own `Database` around a copy of a bound constraint.
+ */
+export function registerPartyIdFunction(db: Database, partyId: string): void {
+  db.registerFunction(createScalarFunction(
+    { name: 'party_id', numArgs: 0, flags: FunctionFlags.UTF8 | FunctionFlags.DETERMINISTIC, returnType: TEXT_RETURN },
+    () => partyId,
+  ));
 }
 
 /**
@@ -209,6 +277,10 @@ export function buildAuthorizationMessage(
  * that same nonce, then pass BOTH the nonce and the signature to
  * {@link ControlDatabase.redeemInvitation} / {@link ControlDatabase.recordFormationUsage}:
  * signing one nonce and inserting another fails the CHECK.
+ *
+ * No party id, unlike every owner digest: the approver is sent only these five fields
+ * (`formation-approval.ts`), and the `token` it binds is a random secret seated in one
+ * party's `FormationInvite` table (the schema's `FormationUsage.Authorized` comment).
  */
 export function formationVouchMessage(fields: {
   token: string;
@@ -217,7 +289,7 @@ export function formationVouchMessage(fields: {
   peerKey: string;
   disclosure: string;
 }): Uint8Array {
-  return buildAuthorizationMessage('CadreControl.FormationUsage', 'vouch', [
+  return buildUnboundAuthorizationMessage('CadreControl.FormationUsage', 'vouch', [
     fields.token, fields.usageStampId, fields.strandId, fields.peerKey, fields.disclosure,
   ]);
 }
@@ -238,7 +310,9 @@ export function formationVouchMessage(fields: {
  * the strand when it signs (a bound invite's host strand arrives only in the result
  * frame; an unbound strand is minted by the responder). The responder cannot
  * substitute one anyway — a bound invite is pinned to its own strand by `Authorized`,
- * and an unbound redemption mints a fresh strand, so there is no victim to name.
+ * and an unbound redemption mints a fresh strand, so there is no victim to name. The
+ * party id is absent for the same reason (it too arrives only in the result frame) and
+ * the `token` scopes the digest to one party instead, as for {@link formationVouchMessage}.
  */
 export function formationConsentMessage(fields: {
   token: string;
@@ -246,11 +320,56 @@ export function formationConsentMessage(fields: {
   peerKey: string;
   disclosure: string;
 }): Uint8Array {
-  return buildAuthorizationMessage('CadreControl.FormationUsage', 'consent', [
+  return buildUnboundAuthorizationMessage('CadreControl.FormationUsage', 'consent', [
     fields.token, fields.usageStampId, fields.peerKey, fields.disclosure,
   ]);
 }
 
+/**
+ * The exact bytes an owner signs to seat a `CadreInvite` row — the TS mirror of the `'add'`
+ * digest in `CadreInvite.AuthorizedInsert`, over the whole row in the schema's order with
+ * nullable columns as `''` (`cadreInviteRowFields`, shared with the base64url verifier
+ * `peer-authorization.ts`'s `cadreInviteAddDigest`). `expiresAt` must already be the stored
+ * canonical `datetime` string ({@link canonicalDatetime}), as {@link ControlDatabase.insertCadreInvite}
+ * produces it, or the signed segment will not match what the CHECK sees after coercion.
+ */
+export function cadreInviteAddMessage(partyId: string, row: CadreInviteSignedFields): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.CadreInvite', 'add', partyId, cadreInviteRowFields(row));
+}
+
+/** The fields both redemption signatures cover; see {@link cadreInviteRedeemMessage}. */
+export interface CadreInviteRedemptionFields {
+  inviteKey: string;
+  /** The single-use nonce the redeeming device minted for this redemption (`generateStampId`). */
+  usageStampId: string;
+  /** The redeeming device's own ed25519 public key (base64url). */
+  peerKey: string;
+}
+
+/**
+ * The exact bytes the HOLDER of a cadre invitation signs, with the invitation's private key,
+ * to redeem it once — the TS mirror of the `'redeem'` digest `CadreInviteUsage.InvitePossessed`
+ * verifies against the invitation's public key. Binding the device and the nonce means a
+ * captured redemption can admit no other device and spend no other use.
+ */
+export function cadreInviteRedeemMessage(partyId: string, fields: CadreInviteRedemptionFields): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.CadreInviteUsage', 'redeem', partyId, [
+    fields.inviteKey, fields.usageStampId, fields.peerKey,
+  ]);
+}
+
+/**
+ * The exact bytes the DEVICE signs, with its own key, to consent to being admitted by one
+ * redemption — the TS mirror of the `'consent'` digest `CadreInviteUsage.PeerConsented`
+ * verifies against `PeerKey`. Same fields as {@link cadreInviteRedeemMessage} under a
+ * distinct action tag, so neither signature can stand in for the other.
+ */
+export function cadreInviteConsentMessage(partyId: string, fields: CadreInviteRedemptionFields): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.CadreInviteUsage', 'consent', partyId, [
+    fields.inviteKey, fields.usageStampId, fields.peerKey,
+  ]);
+}
+
 /**
  * Minimal interface for the CollectionFactory returned by the optimystic plugin.
  * We only need the methods we actually use.
@@ -296,12 +415,17 @@ const GUARDED_KEY_COLUMN: Readonly<Record<RevocableTable, GuardedKeyColumn>> = {
   Strand: 'Id',
   StrandPartyKey: 'Id',
   JoinedStrand: 'Id',
-  PendingJoin: 'Id',
+  JoinRequest: 'Id',
   DeviceToken: 'PeerId',
+  CadreInvite: 'Key',
 };
 
-/** A guarded table an owner may remove a row from (no production `OwnerKey` removal path exists yet). */
-type RemovableTable = Exclude<RevocableTable, 'OwnerKey'>;
+/**
+ * A guarded table an owner may remove a row from. `CadreInvite` is excluded by design — its
+ * rows are never deleted (`NoDelete`), and withdrawing one is a tombstone alone
+ * ({@link ControlDatabase.withdrawCadreInvite}).
+ */
+type RemovableTable = Exclude<RevocableTable, 'CadreInvite'>;
 
 /**
  * One row incarnation's owner-signed removal, ready for {@link ControlDatabase.execGuardedRemoval}:
@@ -316,16 +440,37 @@ interface GuardedRemoval {
   readonly revocationSignature: string;
 }
 
+/**
+ * The exact bytes an owner signs to append one `Revocation` tombstone — `Revocation.Authorized`
+ * binds the whole (TableName, RowKey, StampId) row under its own domain tag. Shared by every
+ * tombstone writer (a guarded removal, a `CadreInvite` withdrawal, the ledger marker) so the
+ * field order lives in one place; the base64url verifier is `peer-authorization.ts`'s
+ * `revocationDigest`.
+ */
+function revocationTombstoneMessage(partyId: string, ref: { tableName: string; rowKey: string; stampId: string }): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.Revocation', 'remove', partyId, [ref.tableName, ref.rowKey, ref.stampId]);
+}
+
+/**
+ * The exact bytes an owner signs to seat a further `OwnerKey` row (the signed-add branch of
+ * `OwnerKey.Authorized`); the base64url twin is `peer-authorization.ts`'s `ownerKeyAddDigest`.
+ */
+function ownerKeyAddMessage(partyId: string, key: string, stampId: string): Uint8Array {
+  return buildAuthorizationMessage('CadreControl.OwnerKey', 'add', partyId, [key, stampId]);
+}
+
 function signGuardedRemoval(
+  partyId: string,
   tableName: RemovableTable,
   rowKey: string,
   stampId: string,
   signMessage: (message: Uint8Array) => string
 ): GuardedRemoval {
+  const ref = { tableName, rowKey, stampId };
   return {
-    ref: { tableName, rowKey, stampId },
-    signature: signMessage(buildAuthorizationMessage(`CadreControl.${tableName}`, 'remove', [rowKey, stampId])),
-    revocationSignature: signMessage(buildAuthorizationMessage('CadreControl.Revocation', 'remove', [tableName, rowKey, stampId])),
+    ref,
+    signature: signMessage(buildAuthorizationMessage(`CadreControl.${tableName}`, 'remove', partyId, [rowKey, stampId])),
+    revocationSignature: signMessage(revocationTombstoneMessage(partyId, ref)),
   };
 }
 
@@ -333,7 +478,7 @@ function signGuardedRemoval(
 type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
 
 /** The control tables keyed by an `Id` column whose repeat insert a caller may classify. */
-type IdKeyedTable = StrandIdTable | Extract<RevocableTable, 'PendingJoin'>;
+type IdKeyedTable = StrandIdTable | Extract<RevocableTable, 'JoinRequest'>;
 
 /**
  * The rejection a second insert of an already-seated id into `table` produces, as the
@@ -368,8 +513,8 @@ export function isStrandIdConflict(error: unknown, table: StrandIdTable): boolea
 }
 
 /**
- * Did {@link ControlDatabase.insertPendingJoin} fail because the party already holds a
- * `PendingJoin` row for this invitation? The caller adopts the existing row instead.
+ * Did {@link ControlDatabase.insertJoinRequest} fail because the party already holds a
+ * `JoinRequest` row for this invitation? The caller adopts the existing request instead.
  * Text-matched, failing closed, like {@link isStrandIdConflict}.
  *
  * NOTE: the existing row may be one {@link ControlDatabase.queryPendingJoin} hides (its stamp
@@ -377,11 +522,11 @@ export function isStrandIdConflict(error: unknown, table: StrandIdTable): boolea
  * until the next reap pass.
  */
 export function isPendingJoinConflict(error: unknown): boolean {
-  return errorChainMatches(error, idConflictPattern('PendingJoin'));
+  return errorChainMatches(error, idConflictPattern('JoinRequest'));
 }
 
 /**
- * The `PendingJoin.Id` of an invitation: the base64url sha256 `digest` of its token. One row
+ * The `JoinRequest.Id` of an invitation: the base64url sha256 `digest` of its token. One row
  * per invitation, and the `Revocation` tombstone that names a removed row carries this, never
  * the bearer token itself.
  */
@@ -389,19 +534,23 @@ export function pendingJoinId(token: string): string {
   return digest([token], 'sha256', 'base64url') as string;
 }
 
+/** A `JoinRequest` row as written: every column but the stamp, which each write mints. */
+export type JoinRequestFields = Omit<JoinRequestRow, 'StampId'>;
+
+/** A pending join as re-written: its request fields and its outcome, under a stamp the write mints. */
+export type PendingJoinFields = Omit<PendingJoin, 'StampId'>;
+
 /**
- * {@link ControlDatabase.replacePendingJoin} found that the live `PendingJoin` row is not the
- * incarnation the caller read: another write replaced or removed it first (a sibling machine
- * recorded an outcome, or the user dismissed the join). Nothing was written; the caller
- * re-reads and decides again. `liveStampId` is null when the row is gone.
+ * A pending-join write found that the live join is not the one the caller read: another write
+ * recorded an outcome, asked again or dismissed it first. Nothing was written; the caller
+ * decides again from `live`, which is null when the request is gone.
  */
 export class PendingJoinChangedError extends Error {
   constructor(
     readonly id: string,
-    readonly expectedStampId: string,
-    readonly liveStampId: string | null,
+    readonly live: PendingJoin | null,
   ) {
-    super(`PendingJoin ${id} changed: expected stamp ${expectedStampId}, found ${liveStampId ?? 'no row'}`);
+    super(`Pending join ${id} changed: ${live === null ? 'no request' : `request ${live.StampId}, ${live.outcome?.kind ?? 'pending'}`}`);
     this.name = 'PendingJoinChangedError';
   }
 }
@@ -437,6 +586,56 @@ function errorChainMatches(error: unknown, pattern: RegExp): boolean {
   return error instanceof Error && chainMessages(error).some(message => pattern.test(message));
 }
 
+/**
+ * Project `CadrePeer` rows into the {@link SeedPeer} list a seed, or a cadre invitation
+ * redemption reply, carries.
+ *
+ * Owner identity is sourced from the `OwnerKey` table, not from the transport peer id. An
+ * Ed25519 libp2p peer id embeds its public key (identity multihash), so each peer's ed25519
+ * key is derivable from its `PeerId`; a peer is an owner iff that derived key is in
+ * `ownerKeys`. This makes any owner node markable — not just the local one. A non-Ed25519
+ * or unparsable id yields a non-owner rather than failing the whole projection.
+ *
+ * NOTE: this is the one owner lookup deliberately left on the REPLICATED table rather than
+ * the node-local anchor. `SeedPeer.isOwner` is a dial hint — the receiver dials owner-flagged
+ * peers first — not a trust decision, and the receiver re-derives real trust from its own
+ * anchor. So a polluted table costs at most a wasted dial, while anchoring here would
+ * silently drop legitimate co-owners this node never pinned. If `isOwner` ever gates
+ * anything the receiver TRUSTS, move it to the anchor.
+ */
+export function projectSeedPeers(rows: readonly CadrePeerRow[], ownerKeys: ReadonlySet<string>): SeedPeer[] {
+  return rows.map(({ peerId, multiaddr }) => {
+    const pubKeyB64 = ed25519PublicKeyB64FromPeerId(peerId);
+    const isOwner = pubKeyB64 !== null && ownerKeys.has(pubKeyB64);
+    return {
+      peerId,
+      multiaddrs: multiaddr ? multiaddr.split(',') : [],
+      isOwner,
+      ...(isOwner ? { publicKey: pubKeyB64 } : {}),
+    };
+  });
+}
+
+/**
+ * The conditions a cadre invitation must still meet to be redeemed, short of its use count:
+ * not withdrawn, unexpired (`expiresAt <= now` is expired, as the redemption refuses it),
+ * and issued by a current owner. Shared by {@link ControlDatabase.hasLiveCadreInvite},
+ * {@link ControlDatabase.isCadreInviteLive} and {@link ControlDatabase.listCadreInviteStatuses}
+ * so they cannot drift from each other, or from `CadreInviteUsage.Authorized`.
+ */
+function cadreInviteStillOpen(
+  row: { stampId: string; issuerKey: string; expiresAt: string | null },
+  withdrawn: ReadonlySet<string>,
+  owners: ReadonlySet<string>,
+  nowMs: number
+): boolean {
+  if (withdrawn.has(row.stampId) || !owners.has(row.issuerKey)) {
+    return false;
+  }
+  const expiresAtMs = parseNullableStoredDatetimeMs(row.expiresAt);
+  return expiresAtMs === null || expiresAtMs > nowMs;
+}
+
 /**
  * Guarded tables a node may reap locally once their tombstone has committed — the
  * tables whose `AuthorizedDelete` carries the REAP branch (see the constraint comment on
@@ -445,24 +644,60 @@ function errorChainMatches(error: unknown, pattern: RegExp): boolean {
  * secrets stored nowhere else (tickets/backlog/debt-strand-tombstone-reap.md owns any
  * future change). `JoinedStrand` also carries a `MemberPrivateKey` but IS reapable: that
  * secret is the joined strand's shared read key, which its founding party and every member
- * hold, so a reaped row is recoverable by re-forming. `PendingJoin` is reapable for the same
+ * hold, so a reaped row is recoverable by re-forming. `JoinRequest` is reapable for the same
  * reason: the inviting party and the user also hold its invitation. `OwnerKey` has no
  * production removal path and `MinOneOwner` makes an automated owner-key reap a
- * party-bricking hazard.
+ * party-bricking hazard. `CadreInvite` is never deleted at all (its tombstone is a
+ * withdrawal over a row that stays), so there is nothing to reap.
  */
-export const REAPABLE_TABLES = ['CadrePeer', 'DeviceToken', 'ValidationKey', 'JoinedStrand', 'PendingJoin'] as const satisfies readonly RevocableTable[];
+export const REAPABLE_TABLES = ['CadrePeer', 'DeviceToken', 'ValidationKey', 'JoinedStrand', 'JoinRequest'] as const satisfies readonly RevocableTable[];
 export type ReapableTable = (typeof REAPABLE_TABLES)[number];
 
 /**
  * Runtime membership test for {@link REAPABLE_TABLES}, narrowing a tombstone's
  * `TableName` to the subset {@link ControlDatabase.reapRevokedRow} accepts. A tombstone
- * naming an excluded table (`Strand`, `OwnerKey`) is skipped silently — `Strand`
- * tombstones are the common case in a party that has unpublished a strand, so a log line
- * per skip would be per-pass noise.
+ * naming an excluded table (`Strand`, `OwnerKey`, `CadreInvite`) is skipped silently —
+ * `Strand` tombstones are the common case in a party that has unpublished a strand, so a
+ * log line per skip would be per-pass noise.
  */
 const REAPABLE_TABLE_SET: ReadonlySet<RevocableTable> = new Set<RevocableTable>(REAPABLE_TABLES);
 const isReapableTable = (table: RevocableTable): table is ReapableTable => REAPABLE_TABLE_SET.has(table);
 
+/** Every `CadreInvite` column, in the order {@link cadreInviteRowOf} reads them; callers append their `where`. */
+const CADRE_INVITE_SELECT_SQL = 'select Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.CadreInvite';
+
+/**
+ * A stored `CadreInvite` row as a {@link CadreInviteRow}. `ExpiresAt` is kept as the
+ * engine-canonical string it reads back as — the form the `'add'` signature covers — never
+ * parsed to ms here; `GrantsOwner` is the schema's 0/1 integer.
+ */
+function cadreInviteRowOf(row: Record<string, SqlValue>): CadreInviteRow {
+  return {
+    key: row.Key as string,
+    peerId: (row.PeerId as string | null) ?? null,
+    grantsOwner: Number(row.GrantsOwner) === 1,
+    expiresAt: row.ExpiresAt == null ? null : String(row.ExpiresAt),
+    totalUses: (row.TotalUses as number | null) ?? null,
+    issuerKey: row.IssuerKey as string,
+    issuerSig: row.IssuerSig as string,
+    stampId: row.StampId as string,
+  };
+}
+
+/** A stored `CadreInviteUsage` row as a {@link CadreInviteUsageRow}. */
+function cadreInviteUsageRowOf(row: Record<string, SqlValue>): CadreInviteUsageRow {
+  return {
+    usageStampId: row.UsageStampId as string,
+    inviteKey: row.InviteKey as string,
+    peerId: row.PeerId as string,
+    peerKey: row.PeerKey as string,
+    peerStampId: row.PeerStampId as string,
+    ownerStampId: (row.OwnerStampId as string | null) ?? null,
+    inviteSig: row.InviteSig as string,
+    peerSig: row.PeerSig as string,
+  };
+}
+
 /** A `JoinedStrand` row as a {@link StrandRow}; the schema's `KnownType` check backs the `Type` cast. */
 function joinedStrandRow(row: Record<string, SqlValue>): StrandRow {
   return {
@@ -473,55 +708,103 @@ function joinedStrandRow(row: Record<string, SqlValue>): StrandRow {
   };
 }
 
-/** Every `PendingJoin` column, in the schema's order. */
-const PENDING_JOIN_COLUMNS = 'Id, Invitation, Disclosure, RequestedAt, ExpiresAt, Outcome, OutcomeAt, StrandId, MembershipInvite, FailureCode, FailureReason, StampId';
+const JOIN_REQUEST_INSERT_SQL = `
+  insert into CadreControl.JoinRequest (Id, Invitation, Disclosure, RequestedAt, ExpiresAt, StampId)
+    with context OwnerKey = ?, Signature = ?
+    values (?, ?, ?, ?, ?, ?)
+`;
+
+const JOIN_SUCCESS_INSERT_SQL = `
+  insert into CadreControl.JoinSuccess (RequestStampId, RecordedAt, StrandId, MembershipInvite)
+    with context OwnerKey = ?, Signature = ?
+    values (?, ?, ?, ?)
+`;
 
-const PENDING_JOIN_INSERT_SQL = `
-  insert into CadreControl.PendingJoin (${PENDING_JOIN_COLUMNS})
+const JOIN_FAILURE_INSERT_SQL = `
+  insert into CadreControl.JoinFailure (RequestStampId, RecordedAt, Code, Reason)
     with context OwnerKey = ?, Signature = ?
-    values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    values (?, ?, ?, ?)
 `;
 
-/** A `PendingJoin` row as read; the schema's `KnownOutcome` check backs the `Outcome` cast. */
-function pendingJoinRow(row: Record<string, SqlValue>): PendingJoinRow {
+/**
+ * A request with its outcome in one statement: the outcome tables are keyed by the request's
+ * stamp, so the join finds exactly this incarnation's outcome.
+ */
+const PENDING_JOIN_SELECT_SQL = `
+  select R.Id, R.Invitation, R.Disclosure, R.RequestedAt, R.ExpiresAt, R.StampId,
+         S.RecordedAt as JoinedAt, S.StrandId, S.MembershipInvite,
+         F.RecordedAt as FailedAt, F.Code, F.Reason
+    from CadreControl.JoinRequest R
+      left join CadreControl.JoinSuccess S on S.RequestStampId = R.StampId
+      left join CadreControl.JoinFailure F on F.RequestStampId = R.StampId
+`;
+
+/** A {@link PENDING_JOIN_SELECT_SQL} row as read. */
+function pendingJoinOf(row: Record<string, SqlValue>): PendingJoin {
   return {
     Id: row.Id as string,
     Invitation: row.Invitation as string,
     Disclosure: row.Disclosure as string,
     RequestedAt: row.RequestedAt as number,
     ExpiresAt: row.ExpiresAt as number,
-    Outcome: row.Outcome as PendingJoinRow['Outcome'],
-    OutcomeAt: row.OutcomeAt as number | null,
-    StrandId: row.StrandId as string | null,
-    MembershipInvite: row.MembershipInvite as string | null,
-    FailureCode: row.FailureCode as string | null,
-    FailureReason: row.FailureReason as string | null,
     StampId: row.StampId as string,
+    outcome: joinOutcomeOf(row),
   };
 }
 
-/**
- * The row fields `PendingJoin.AuthorizedInsert` signs, in the schema's order: a null column
- * signs as `''` and an integer as its text (`cast(... as text)` on the SQL side).
- */
-function pendingJoinAddFields(row: PendingJoinRow): string[] {
-  return [
-    row.Id, row.Invitation, row.Disclosure, String(row.RequestedAt), String(row.ExpiresAt),
-    row.Outcome ?? '', row.OutcomeAt === null ? '' : String(row.OutcomeAt), row.StrandId ?? '',
-    row.MembershipInvite ?? '', row.FailureCode ?? '', row.FailureReason ?? '', row.StampId,
-  ];
+/** The outcome half of a {@link PENDING_JOIN_SELECT_SQL} row; a request never has both (`JoinSuccess.NoFailure`, `JoinFailure.NotJoined`). */
+function joinOutcomeOf(row: Record<string, SqlValue>): JoinOutcome | null {
+  if (typeof row.JoinedAt === 'number') {
+    return { kind: 'joined', RecordedAt: row.JoinedAt, StrandId: row.StrandId as string, MembershipInvite: row.MembershipInvite as string | null };
+  }
+  if (typeof row.FailedAt === 'number') {
+    return { kind: 'failed', RecordedAt: row.FailedAt, Code: row.Code as string, Reason: row.Reason as string };
+  }
+  return null;
 }
 
-/** The values of {@link PENDING_JOIN_INSERT_SQL}'s columns, in {@link PENDING_JOIN_COLUMNS} order. */
-function pendingJoinValues(row: PendingJoinRow): SqlValue[] {
-  return [
-    row.Id, row.Invitation, row.Disclosure, row.RequestedAt, row.ExpiresAt, row.Outcome, row.OutcomeAt,
-    row.StrandId, row.MembershipInvite, row.FailureCode, row.FailureReason, row.StampId,
-  ];
+/** The fields `JoinRequest.AuthorizedInsert` signs, in the schema's order; integers sign as their text. */
+function joinRequestAddFields(row: JoinRequestRow): string[] {
+  return [row.Id, row.Invitation, row.Disclosure, String(row.RequestedAt), String(row.ExpiresAt), row.StampId];
+}
+
+/** A statement with its parameters, signed and ready to run. */
+interface SignedStatement {
+  readonly sql: string;
+  readonly params: SqlValue[];
 }
 
 /**
- * Notified after a `CadreControl.CadrePeer` row write has COMMITTED.
+ * The owner-signed insert of `outcome` for the request incarnation `requestStampId`: the
+ * `JoinSuccess` / `JoinFailure` row and the signature its `AuthorizedInsert` verifies, over the
+ * row's columns in the schema's order (a null column signs as `''`, an integer as its text).
+ */
+function signJoinOutcomeInsert(
+  partyId: string,
+  requestStampId: string,
+  outcome: JoinOutcome,
+  ownerKey: string,
+  signMessage: (message: Uint8Array) => string
+): SignedStatement {
+  const at = String(outcome.RecordedAt);
+  const { table, sql, fields, values } = outcome.kind === 'joined'
+    ? {
+        table: 'JoinSuccess' as const, sql: JOIN_SUCCESS_INSERT_SQL,
+        fields: [requestStampId, at, outcome.StrandId, outcome.MembershipInvite ?? ''],
+        values: [requestStampId, outcome.RecordedAt, outcome.StrandId, outcome.MembershipInvite],
+      }
+    : {
+        table: 'JoinFailure' as const, sql: JOIN_FAILURE_INSERT_SQL,
+        fields: [requestStampId, at, outcome.Code, outcome.Reason],
+        values: [requestStampId, outcome.RecordedAt, outcome.Code, outcome.Reason],
+      };
+  const signature = signMessage(buildAuthorizationMessage(`CadreControl.${table}`, 'add', partyId, fields));
+  return { sql, params: [ownerKey, signature, ...values] };
+}
+
+/**
+ * Notified after a membership write (a `CadreControl.CadrePeer` or `OwnerKey` row, see
+ * {@link ControlDatabase.mutateCadrePeer}) has COMMITTED.
  *
  * The one hook the party-membership snapshot a node admits control-DB traffic
  * against ({@link CadreNode.refreshMembershipGate}) hangs off, so that snapshot
@@ -532,20 +815,21 @@ function pendingJoinValues(row: PendingJoinRow): SqlValue[] {
 export type MembershipChangeListener = (reason: string) => Promise<void>;
 
 /**
- * Identity of the tombstone a committed guarded delete wrote — a
- * {@link RevocationRow} minus its `ReissuedAt` counter, which a fresh tombstone
- * always seats at 0 (`FreshTombstone`) and so carries no information.
+ * Identity of the tombstone a committed guarded delete wrote — the triple a
+ * {@link RevocationRow} is keyed and signed over. The counter is left out because a
+ * fresh tombstone always seats it at 0 (`FreshTombstone`), and the signer pair because
+ * the writer that files the row supplies it.
  */
-export type RevokedRowRef = Omit<RevocationRow, 'reissuedAt'>;
+export type RevokedRowRef = Pick<RevocationRow, 'tableName' | 'rowKey' | 'stampId'>;
 
 /**
  * Notified after a guarded-table delete — and the `CadreControl.Revocation`
  * tombstone it writes in the same transaction — has COMMITTED.
  *
  * The seam the write-while-alone re-replication queue hangs off
- * ({@link CadreNode.noteGuardedDelete}): one listener covers all four guarded
- * tables (`CadrePeer` / `DeviceToken` / `Strand` / `ValidationKey`) because every
- * owner delete funnels through {@link deleteGuardedRow}. Synchronous — the
+ * ({@link CadreNode.noteGuardedDelete}): one listener covers every guarded table
+ * because every owner delete funnels through {@link deleteGuardedRow} (or the
+ * two-table `deleteStrandAndPartyKey`). Synchronous — the
  * handler only records the tombstone's identity; it must not throw (the notifier
  * swallows and logs anyway — a committed delete never fails because bookkeeping did).
  */
@@ -566,7 +850,12 @@ export type GuardedDeleteListener = (revocation: RevokedRowRef) => void;
 export type ControlWriteAbandonedListener = (abandonment: ControlRetryAbandonment) => void;
 
 export interface ControlDatabaseConfig {
-  /** Party ID for the control network */
+  /**
+   * Party ID for the control network. Also the party every owner and peer signature over a
+   * control row binds ({@link buildAuthorizationMessage}), read on the SQL side through
+   * `party_id()` ({@link registerPartyIdFunction}). Must be non-empty: parties with an empty
+   * id would share approvals.
+   */
   partyId: string;
   /**
    * Optional path to the control schema file.
@@ -617,6 +906,9 @@ export class ControlDatabase {
   private controlReadRetryPacing: ControlReadRetryOptions = {};
 
   constructor(config: ControlDatabaseConfig) {
+    if (typeof config.partyId !== 'string' || config.partyId.length === 0) {
+      throw new Error('ControlDatabase requires a non-empty partyId: every control approval is bound to it');
+    }
     this.config = config;
   }
 
@@ -659,6 +951,9 @@ export class ControlDatabase {
     }
     timing('[controlDb] optimysticPlugin: %dms', Math.round(performance.now() - t0));
 
+    // Before hydrate: a warm restart parses the persisted CHECK text, which calls party_id().
+    registerPartyIdFunction(this.db, this.config.partyId);
+
     this.collectionFactory = pluginResult.collectionFactory;
 
     // Inject the libp2p node into the collection factory
@@ -1050,28 +1345,33 @@ export class ControlDatabase {
   }
 
   /**
-   * Every join this party asked for and has not dismissed (`CadreControl.PendingJoin`),
-   * pending or finished.
+   * Every join this party asked for and has not dismissed, pending or finished: each
+   * `CadreControl.JoinRequest` row with its `JoinSuccess` / `JoinFailure` row.
    *
-   * Rows whose `StampId` is retired in `Revocation` are dropped, as {@link queryCadrePeers}
-   * drops them: such a row is either a replaced or dismissed incarnation this node still
-   * holds until the reap sweep removes it, or one re-seated by a replayed approval on a node
-   * that had not yet seen the tombstone. Either way it must not bring a dismissed join back.
+   * A request whose `StampId` is retired in `Revocation` is dropped, as {@link queryCadrePeers}
+   * drops such rows: it is a re-asked or dismissed incarnation this node still holds until the
+   * reap sweep removes it, or one re-seated by a replayed approval on a node that had not yet
+   * seen the tombstone. Either way it must not bring a dismissed join back.
    */
-  async queryPendingJoins(): Promise<PendingJoinRow[]> {
+  async queryPendingJoins(): Promise<PendingJoin[]> {
     this.ensureInitialized();
-    const revoked = await this.queryRevokedStamps('PendingJoin');
-    const rows = await this.readRows(`select ${PENDING_JOIN_COLUMNS} from CadreControl.PendingJoin`, undefined, 'pending-joins');
-    return rows.map(pendingJoinRow).filter(row => !revoked.has(row.StampId));
+    const revoked = await this.queryRevokedStamps('JoinRequest');
+    const rows = await this.readRows(PENDING_JOIN_SELECT_SQL, undefined, 'pending-joins');
+    return rows.map(pendingJoinOf).filter(join => !revoked.has(join.StampId));
   }
 
-  /** Single-row sibling of {@link queryPendingJoins}, with the same retired-stamp filter: the row with this id, or null. */
-  async queryPendingJoin(id: string): Promise<PendingJoinRow | null> {
+  /** Single-row sibling of {@link queryPendingJoins}, with the same retired-stamp filter: the join with this id, or null. */
+  async queryPendingJoin(id: string): Promise<PendingJoin | null> {
     this.ensureInitialized();
-    const revoked = await this.queryRevokedStamps('PendingJoin');
-    const rows = await this.readRows(`select ${PENDING_JOIN_COLUMNS} from CadreControl.PendingJoin where Id = ?`, [id], 'pending-join');
-    const row = rows.length === 0 ? null : pendingJoinRow(rows[0]!);
-    return row === null || revoked.has(row.StampId) ? null : row;
+    const revoked = await this.queryRevokedStamps('JoinRequest');
+    const join = await this.readPendingJoin(id, true);
+    return join === null || revoked.has(join.StampId) ? null : join;
+  }
+
+  /** The raw read behind {@link queryPendingJoin}, with no retired-stamp filter. `retry: false` inside a locked write body. */
+  private async readPendingJoin(id: string, retry: boolean): Promise<PendingJoin | null> {
+    const rows = await this.readRows(`${PENDING_JOIN_SELECT_SQL} where R.Id = ?`, [id], 'pending-join', retry);
+    return rows.length === 0 ? null : pendingJoinOf(rows[0]!);
   }
 
   /**
@@ -1107,6 +1407,9 @@ export class ControlDatabase {
   /**
    * Check whether any owner key exists in the control database.
    * Used to decide whether a fresh-party genesis insert is required.
+   *
+   * Deliberately RAW (no retired-stamp filter, unlike {@link getOwnerKeys}): the genesis
+   * insert is refused by the schema whenever any physical row exists, so this must see one.
    */
   async hasOwnerKey(): Promise<boolean> {
     this.ensureInitialized();
@@ -1139,14 +1442,66 @@ export class ControlDatabase {
    * trusted only if it is already enrolled here (see `SeedTrustPolicy`). It is
    * also the owner-identity source for `queryPeers`, decoupling owner
    * status from the libp2p transport peer ID.
+   *
+   * Rows whose `StampId` is retired in `CadreControl.Revocation` are excluded, as
+   * {@link queryCadrePeers} excludes them: `OwnerKey` is never reaped (`MinOneOwner` makes
+   * an automated reap able to empty the table), so a node that received the tombstone
+   * without the delete (a removal committed while the remover was alone, re-issued on growth)
+   * keeps the removed owner's physical row next to it. Without the filter a removed owner
+   * would still count as an owner in every membership snapshot and seed-trust read, still
+   * read as the issuer of a live invitation and still be preferred as a dial target. The
+   * write side filters for itself: every owner lookup in the schema disqualifies a row whose
+   * stamp is retired (`schemas/control.qsql` header), so a removed owner cannot sign here
+   * once its tombstone has arrived, row or no row.
+   *
+   * `retry: false` from a caller that reads under the write lock, for the reason on
+   * {@link queryCadrePeers}.
    */
-  async getOwnerKeys(): Promise<Set<string>> {
+  async getOwnerKeys(retry = true): Promise<Set<string>> {
+    return new Set((await this.queryOwnerKeyRows(retry)).map(row => row.key));
+  }
+
+  /**
+   * Every live `OwnerKey` row with its persisted proof ({@link OwnerKeyRow}) — what the
+   * trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`). Rows whose
+   * `StampId` is retired in `CadreControl.Revocation` are excluded here, as
+   * {@link queryCadrePeers} excludes them and for the reason on {@link getOwnerKeys}, which
+   * reads through this. A row with no stamp (the schema permits it; no writer produces one)
+   * is dropped too: no proof can bind to it, so no reader could ever derive it.
+   *
+   * `retry: false` from the membership-gate refresh, which runs as the control database's
+   * membership listener with that database's write lock held — the reason on
+   * {@link queryCadrePeers}; both reads here take the flag.
+   *
+   * @param retired - the retired `OwnerKey` stamps, when the caller has already read the
+   *   tombstones (`CadreNode.syncOwnerAnchor` reads {@link queryRevocations} for their
+   *   signers); omitted, they are read here. Before the ledger marker is filed every
+   *   `Revocation` read is a cohort consult, so the sync passing its own set keeps the
+   *   membership refresh at one such read for the anchor.
+   */
+  async queryOwnerKeyRows(retry = true, retired?: ReadonlySet<string>): Promise<OwnerKeyRow[]> {
     this.ensureInitialized();
-    const keys = new Set<string>();
-    for (const row of await this.readRows('select Key from CadreControl.OwnerKey', undefined, 'owner-keys')) {
-      keys.add(row.Key as string);
+    const revoked = retired ?? await this.queryRevokedStamps('OwnerKey', retry);
+    const rows: OwnerKeyRow[] = [];
+    const sql = 'select Key, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.OwnerKey';
+    for (const row of await this.readRows(sql, undefined, 'owner-keys', retry)) {
+      const stampId = (row.StampId as string | null) ?? null;
+      if (stampId === null) {
+        log('queryOwnerKeyRows: dropping OwnerKey row %s with no StampId', row.Key);
+        continue;
+      }
+      if (revoked.has(stampId)) {
+        continue;
+      }
+      rows.push({
+        key: row.Key as string,
+        stampId,
+        vouchOwner: (row.VouchOwner as string | null) ?? null,
+        vouchSig: (row.VouchSig as string | null) ?? null,
+        vouchUsage: (row.VouchUsage as string | null) ?? null,
+      });
     }
-    return keys;
+    return rows;
   }
 
   /**
@@ -1189,7 +1544,7 @@ export class ControlDatabase {
     this.ensureInitialized();
     const revoked = await this.queryRevokedStamps('CadrePeer', retry);
     const rows: CadrePeerRow[] = [];
-    for (const row of await this.readRows('select PeerId, Multiaddr, StampId, VouchOwner, VouchSig from CadreControl.CadrePeer', undefined, 'cadre-peers', retry)) {
+    for (const row of await this.readRows('select PeerId, Multiaddr, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.CadrePeer', undefined, 'cadre-peers', retry)) {
       const stampId = (row.StampId as string | null) ?? null;
       if (stampId !== null && revoked.has(stampId)) {
         continue;
@@ -1200,11 +1555,26 @@ export class ControlDatabase {
         stampId,
         vouchOwner: (row.VouchOwner as string | null) ?? null,
         vouchSig: (row.VouchSig as string | null) ?? null,
+        vouchUsage: (row.VouchUsage as string | null) ?? null,
       });
     }
     return rows;
   }
 
+  /**
+   * The cadre's peers as a seed or a redemption reply carries them: every live `CadrePeer`
+   * row with its addresses, each flagged `isOwner` when the key behind its peer id is in
+   * the replicated `OwnerKey` table ({@link projectSeedPeers}).
+   *
+   * Read through {@link queryCadrePeers}, never a raw `CadrePeer` select, so a removed
+   * member's addresses are never packed into a seed or handed to a redeeming device as a
+   * dial hint: a revoked peer is off the addressable surface everywhere, and this is one of
+   * its exits.
+   */
+  async querySeedPeers(): Promise<SeedPeer[]> {
+    return projectSeedPeers(await this.queryCadrePeers(), await this.getOwnerKeys());
+  }
+
   /**
    * Every approver public key currently enrolled in `CadreControl.ValidationKey` — the
    * set a `ValidationUrl` redemption's approval signature must be signed by (see
@@ -1402,22 +1772,26 @@ export class ControlDatabase {
   }
 
   /**
-   * Every locally-held `CadreControl.Revocation` tombstone — identity triple plus its
-   * `ReissuedAt` counter. Consumed by the cohort-growth re-issue sweep, which
-   * enumerates what this node holds before {@link reissueRevocations} re-broadcasts
-   * it, and by the reap sweep ({@link reapRevokedRows}). Plain scan with no `where`, so
-   * the composite-primary-key point-lookup hazard (see the statement comment in
+   * Every locally-held `CadreControl.Revocation` tombstone — identity triple, its
+   * `ReissuedAt` counter and the stored signer pair. Consumed by the cohort-growth re-issue
+   * sweep, which enumerates what this node holds before {@link reissueRevocations}
+   * re-broadcasts it, and by the reap sweep ({@link reapRevokedRows}). Plain scan with no
+   * `where`, so the composite-primary-key point-lookup hazard (see the statement comment in
    * {@link reissueRevocations}) does not arise. Unlocked, like every other read.
    *
    * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}): it retires nothing, so
    * neither sweep may reap or re-sign it, and skipping it keeps `RevocationRow.tableName`
    * a {@link RevocableTable}. Filtered on `TableName` alone, in TypeScript: `RowIsGone`
    * admits no other row under `'Revocation'`.
+   *
+   * `retry: false` from a caller that reads under the write lock, for the reason on
+   * {@link queryCadrePeers}.
    */
-  async queryRevocations(): Promise<RevocationRow[]> {
+  async queryRevocations(retry = true): Promise<RevocationRow[]> {
     this.ensureInitialized();
     const rows: RevocationRow[] = [];
-    for (const row of await this.readRows('select TableName, RowKey, StampId, ReissuedAt from CadreControl.Revocation', undefined, 'revocations')) {
+    const sql = 'select TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig from CadreControl.Revocation';
+    for (const row of await this.readRows(sql, undefined, 'revocations', retry)) {
       if (row.TableName === REVOCATION_LEDGER_MARKER.tableName) {
         continue;
       }
@@ -1426,6 +1800,8 @@ export class ControlDatabase {
         rowKey: row.RowKey as string,
         stampId: row.StampId as string,
         reissuedAt: (row.ReissuedAt as number | null) ?? 0,
+        signerKey: row.SignerKey as string,
+        signerSig: row.SignerSig as string,
       });
     }
     return rows;
@@ -1571,12 +1947,12 @@ export class ControlDatabase {
 
     // Bootstrap is authorized by the schema's genesis branch — `(select count(1) from
     // committed.OwnerKey) = 0`, i.e. the party had no owner before this transaction — so no
-    // signature is needed. Every other branch of `OwnerKey.Authorized` requires a signature
-    // from a PRE-EXISTING owner, so this method only ever succeeds on a fresh party; seating
-    // a second owner (or removing one) has no writer here and must sign the digests
-    // documented on the schema's `Authorized` constraint. We still persist a fresh, unique
-    // StampId in the row's own column to satisfy the not-null/unique anti-replay constraint —
-    // the StampId is a real column value, not the optimystic `StampId()` SQL function.
+    // signature is needed. Every other branch of `OwnerKey.Authorized` requires a PRE-EXISTING,
+    // unretired owner, so this method only ever succeeds on a fresh party; a second
+    // owner is seated by {@link insertOwnerKeyVouched} and removed by {@link deleteOwnerKey}.
+    // We still persist a fresh, unique StampId in the row's own column to satisfy the
+    // not-null/unique anti-replay constraint — the StampId is a real column value, not the
+    // optimystic `StampId()` SQL function.
     const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
     await this.execWrite(`
       insert into CadreControl.OwnerKey (Key, StampId)
@@ -1586,6 +1962,100 @@ export class ControlDatabase {
     log('Owner key inserted');
   }
 
+  /**
+   * Owner-signed INSERT of a further `OwnerKey` row, notifying the membership listener once
+   * it has committed. The signed-add branch of `OwnerKey.Authorized`: the signer must be an
+   * owner in the pre-transaction snapshot, its signature covers the `'add'` digest over
+   * (Key, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a reader
+   * can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
+   *
+   * Through {@link mutateCadrePeer}, the membership hub. The liveness read, the stamp and the
+   * signature all sit inside the locked body: a {@link lockedWithRetry} re-run starts over a
+   * rolled-back attempt with a fresh stamp, as {@link redeemCadreInvite} does.
+   *
+   * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
+   * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
+   * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
+   * would collide on the primary key. Re-add from the machine that removed the key, or any
+   * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
+   * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
+   *
+   * @returns `true` when this call seated the row, `false` when `key` is already a live owner
+   *   here (nothing written).
+   * @throws when this node holds `key`'s row under a retired stamp (above), or when the
+   *   schema refuses the signer.
+   */
+  async insertOwnerKeyVouched(
+    key: string,
+    ownerKey: string,
+    signMessage: (message: Uint8Array) => string
+  ): Promise<boolean> {
+    this.ensureInitialized();
+    return await this.mutateCadrePeer('owner-key-add', async () => {
+      // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
+      const heldStamp = await this.queryStampId('OwnerKey', key, false);
+      if (heldStamp !== null) {
+        if (!(await this.queryRevokedStamps('OwnerKey', false)).has(heldStamp)) {
+          log('insertOwnerKeyVouched: %s is already an owner; nothing written', key);
+          return false;
+        }
+        throw new Error(
+          `Cannot re-add owner key ${key} here: this node still holds the row it was removed under ` +
+          '(OwnerKey rows are not reaped); re-add it from the machine that removed it'
+        );
+      }
+      const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
+      const signature = signMessage(ownerKeyAddMessage(this.config.partyId, key, stampId));
+      // Bare `exec`: already inside the write lock, which is NOT re-entrant.
+      await this.db!.exec(`
+        insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?, ?)
+      `, [ownerKey, signature, key, stampId, ownerKey, signature]);
+      log('Owner key %s added (vouched by %s)', key, ownerKey);
+      return true;
+    });
+  }
+
+  /**
+   * Owner-signed removal of one `OwnerKey` row plus the `Revocation` tombstone retiring its
+   * stamp, notifying the membership listener once it has committed. The remove branch of
+   * `OwnerKey.Authorized` requires a signer other than the removed key, and `MinOneOwner`
+   * keeps the table from emptying; both are refused by name here first, read from this
+   * node's live owners ({@link getOwnerKeys}), so a caller gets a clear error rather than a
+   * constraint failure. The schema stays the authority: a concurrent removal elsewhere can
+   * make the local count wrong in either direction, and then `MinOneOwner` or the tombstone's
+   * primary key decides (see the NOTE on {@link deleteGuardedRow}).
+   *
+   * Through {@link mutateCadrePeer}, the membership hub, which notifies whenever the body
+   * resolves, the absent-key answer included.
+   *
+   * @returns `true` when the row was removed, `false` when `key` is not a live owner here
+   *   (nothing written, no tombstone).
+   * @throws when `key` is `ownerKey`, or is the only live owner.
+   */
+  async deleteOwnerKey(
+    key: string,
+    ownerKey: string,
+    signMessage: (message: Uint8Array) => string
+  ): Promise<boolean> {
+    if (key === ownerKey) {
+      throw new Error(`Cannot remove owner key ${key}: an owner cannot remove itself`);
+    }
+    return await this.mutateCadrePeer('owner-key-remove', async () => {
+      // retry: false — inside the locked write body (see queryStampId's NOTE).
+      const owners = await this.getOwnerKeys(false);
+      if (!owners.has(key)) {
+        log('deleteOwnerKey: %s is not a live owner here (already absent)', key);
+        return false;
+      }
+      if (owners.size <= 1) {
+        throw new Error(`Cannot remove owner key ${key}: cannot remove the last owner`);
+      }
+      return await this.deleteGuardedRow('OwnerKey', key, ownerKey, signMessage);
+    });
+  }
+
   /**
    * Insert a strand into the control database using an owner signature.
    *
@@ -1623,7 +2093,7 @@ export class ControlDatabase {
     // Id, Type, MemberPrivateKey ('' when null), StampId. FounderOwnerKey is
     // deliberately NOT in the digest — the schema binds it by equality to the
     // verified context.OwnerKey instead (see the constraint's comment).
-    const message = buildAuthorizationMessage('CadreControl.Strand', 'add', [strandId, type, memberPrivateKey ?? '', stampId]);
+    const message = buildAuthorizationMessage('CadreControl.Strand', 'add', this.config.partyId, [strandId, type, memberPrivateKey ?? '', stampId]);
     const signature = signMessage(message);
 
     // StampId is a real, unique column (single-use anti-replay), no longer a context value.
@@ -1698,10 +2168,10 @@ export class ControlDatabase {
     }
     const partyKeyStamp = await this.queryStampId('StrandPartyKey', strandId, false);
 
-    const strandRemoval = signGuardedRemoval('Strand', strandId, strandStamp, signMessage);
+    const strandRemoval = signGuardedRemoval(this.config.partyId, 'Strand', strandId, strandStamp, signMessage);
     const partyKeyRemoval = partyKeyStamp === null
       ? null
-      : signGuardedRemoval('StrandPartyKey', strandId, partyKeyStamp, signMessage);
+      : signGuardedRemoval(this.config.partyId, 'StrandPartyKey', strandId, partyKeyStamp, signMessage);
 
     await this.inTransaction('delete Strand', async () => {
       await this.execGuardedRemoval(strandRemoval, ownerKey);
@@ -1749,7 +2219,7 @@ export class ControlDatabase {
 
     // Field order MUST match the schema's StrandPartyKey `AuthorizedInsert` verify:
     // Id, PrivateKey, StampId.
-    const message = buildAuthorizationMessage('CadreControl.StrandPartyKey', 'add', [strandId, privateKey, stampId]);
+    const message = buildAuthorizationMessage('CadreControl.StrandPartyKey', 'add', this.config.partyId, [strandId, privateKey, stampId]);
     const signature = signMessage(message);
 
     await this.execWrite(`
@@ -1805,7 +2275,7 @@ export class ControlDatabase {
 
     // Field order MUST match the schema's JoinedStrand `AuthorizedInsert` verify:
     // Id, Type, MemberPrivateKey ('' when null), StampId.
-    const message = buildAuthorizationMessage('CadreControl.JoinedStrand', 'add', [row.Id, row.Type, row.MemberPrivateKey ?? '', stampId]);
+    const message = buildAuthorizationMessage('CadreControl.JoinedStrand', 'add', this.config.partyId, [row.Id, row.Type, row.MemberPrivateKey ?? '', stampId]);
     const signature = signMessage(message);
 
     await this.execWrite(`
@@ -1832,97 +2302,155 @@ export class ControlDatabase {
   }
 
   /**
-   * Record, party-wide, a join this party asked for (`PendingJoin` row), using an owner
-   * signature over every column of the row (see {@link pendingJoinAddFields}). Returns the
-   * row as written, with the fresh `StampId` a later {@link replacePendingJoin} names.
+   * Record, party-wide, a join this party asked for: a `JoinRequest` row under a fresh stamp,
+   * owner-signed over every column. Returns the pending join as written.
    *
-   * Fails with a `PendingJoin.Id` uniqueness violation when the party already holds a row for
-   * this invitation; {@link isPendingJoinConflict} identifies that case.
+   * Fails with a `JoinRequest.Id` uniqueness violation when the party already holds a request
+   * for this invitation; {@link isPendingJoinConflict} identifies that case.
    */
-  async insertPendingJoin(
-    row: Omit<PendingJoinRow, 'StampId'>,
+  async insertJoinRequest(
+    request: JoinRequestFields,
     ownerKey: string,
     signMessage: (message: Uint8Array) => string
-  ): Promise<PendingJoinRow> {
+  ): Promise<PendingJoin> {
     this.ensureInitialized();
-    log('Inserting pending join: %s (outcome: %s)', row.Id, row.Outcome);
-    const { written, params } = this.signPendingJoinInsert(row, ownerKey, signMessage);
-    await this.execWrite(PENDING_JOIN_INSERT_SQL, params, 'pending-join-insert');
-    log('Pending join inserted: %s', row.Id);
-    return written;
+    const { written, insert } = this.signJoinRequestInsert(request, ownerKey, signMessage);
+    await this.execWrite(insert.sql, insert.params, 'join-request-insert');
+    log('Join request inserted: %s', request.Id);
+    return { ...written, outcome: null };
   }
 
   /**
-   * Replace the live `PendingJoin` row `next.Id` with `next`, under a fresh stamp — the only way
-   * an outcome is written, since the table refuses updates. Returns the row as written.
-   *
-   * One locked transaction deletes the row (owner-signed `'remove'` digest, with its
-   * `Revocation` tombstone) and inserts its successor, so no reader ever sees the id missing in
-   * between. The live row must still be the incarnation the caller read: when its `StampId` is
-   * not `expectedStampId`, or the row is gone, this throws {@link PendingJoinChangedError} and
-   * writes nothing. That check is local; a sibling machine's replacement or removal that lands
-   * between it and the commit fails the transaction instead (its tombstone for the same stamp,
-   * or its successor row, collides on a primary key), and the caller re-reads either way.
+   * Record the outcome of the pending join `expected`: its owner-signed `JoinSuccess` /
+   * `JoinFailure` row, keyed by the request's stamp. A join recorded over a failure deletes the
+   * failure row in the same transaction (the schema authorizes that delete by the join, and
+   * leaves the one-outcome rule in that direction to this writer). Returns the pending join as
+   * written.
+   *
+   * The live join must still be what the caller read: the same request incarnation with the
+   * same outcome kind. Otherwise this throws {@link PendingJoinChangedError} and writes nothing.
+   * That check is local; a sibling machine's write landing between it and the commit fails the
+   * transaction instead (its outcome row collides on the primary key, or its tombstone retires
+   * the stamp), and the caller re-reads either way.
+   */
+  async recordJoinOutcome(
+    expected: PendingJoin,
+    outcome: JoinOutcome,
+    ownerKey: string,
+    signMessage: (message: Uint8Array) => string
+  ): Promise<PendingJoin> {
+    this.ensureInitialized();
+    const insert = signJoinOutcomeInsert(this.config.partyId, expected.StampId, outcome, ownerKey, signMessage);
+    return this.lockedWithRetry(async () => {
+      const live = await this.readPendingJoin(expected.Id, false);
+      if (live === null || live.StampId !== expected.StampId || live.outcome?.kind !== expected.outcome?.kind) {
+        throw new PendingJoinChangedError(expected.Id, live);
+      }
+      await this.inTransaction('record join outcome', async () => {
+        if (live.outcome?.kind === 'failed') {
+          await this.deleteJoinOutcome('JoinFailure', expected.StampId);
+        }
+        await this.db!.exec(insert.sql, insert.params);
+      });
+      log('Join outcome recorded: %s (%s)', expected.Id, outcome.kind);
+      return { ...live, outcome };
+    }, {}, 'join-outcome-record');
+  }
+
+  /**
+   * Re-write the pending join `next` (request and outcome) under a fresh stamp, retiring the
+   * live request incarnation `expectedStampId`: how a finished request is asked for again, and
+   * how a join written while this machine was alone is re-broadcast. One locked transaction
+   * deletes the outcome row and the request (owner-signed `'remove'` digest, with its
+   * `Revocation` tombstone) and inserts the successors, so no reader ever sees the id missing in
+   * between. Throws {@link PendingJoinChangedError} and writes nothing when the live request is
+   * not `expectedStampId`.
    *
    * Signatures and the new stamp are minted before the lock, so a retried attempt re-presents
    * the same signed messages (the contract on {@link withWriteLock}). A retry after an attempt
-   * that committed but reported failure throws {@link PendingJoinChangedError} whose
-   * `liveStampId` is the returned row's own stamp, so a caller that re-reads finds its write.
+   * that committed but reported failure throws {@link PendingJoinChangedError} whose live join
+   * carries the returned stamp, so a caller that re-reads finds its write.
    */
-  async replacePendingJoin(
+  async rewritePendingJoin(
     expectedStampId: string,
-    next: Omit<PendingJoinRow, 'StampId'>,
+    next: PendingJoinFields,
     ownerKey: string,
     signMessage: (message: Uint8Array) => string
-  ): Promise<PendingJoinRow> {
+  ): Promise<PendingJoin> {
     this.ensureInitialized();
-    const id = next.Id;
-    const removal = signGuardedRemoval('PendingJoin', id, expectedStampId, signMessage);
-    const { written, params } = this.signPendingJoinInsert(next, ownerKey, signMessage);
+    const { outcome, ...request } = next;
+    const removal = signGuardedRemoval(this.config.partyId, 'JoinRequest', next.Id, expectedStampId, signMessage);
+    const { written, insert } = this.signJoinRequestInsert(request, ownerKey, signMessage);
+    const outcomeInsert = outcome === null ? null : signJoinOutcomeInsert(this.config.partyId, written.StampId, outcome, ownerKey, signMessage);
 
     return this.lockedWithRetry(async () => {
       // retry: false — this runs inside the locked write body (see queryStampId's NOTE).
-      const liveStampId = await this.queryStampId('PendingJoin', id, false);
+      const liveStampId = await this.queryStampId('JoinRequest', next.Id, false);
       if (liveStampId !== expectedStampId) {
-        throw new PendingJoinChangedError(id, expectedStampId, liveStampId);
+        throw new PendingJoinChangedError(next.Id, await this.readPendingJoin(next.Id, false));
       }
-      await this.inTransaction('replace PendingJoin', async () => {
+      await this.inTransaction('rewrite pending join', async () => {
+        await this.deleteJoinOutcomes(expectedStampId);
         await this.execGuardedRemoval(removal, ownerKey);
-        await this.db!.exec(PENDING_JOIN_INSERT_SQL, params);
+        await this.db!.exec(insert.sql, insert.params);
+        if (outcomeInsert !== null) {
+          await this.db!.exec(outcomeInsert.sql, outcomeInsert.params);
+        }
       });
-      log('Pending join replaced: %s (outcome: %s; stamp retired)', id, next.Outcome);
+      log('Pending join rewritten: %s (%s; stamp retired)', next.Id, outcome?.kind ?? 'pending');
       this.notifyGuardedDelete(removal.ref);
-      return written;
-    }, {}, 'pending-join-replace');
+      return { ...written, outcome };
+    }, {}, 'pending-join-rewrite');
   }
 
   /**
-   * Owner-signed removal of one `PendingJoin` row, as {@link deleteJoinedStrand} removes its
-   * row: `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same
-   * transaction. A no-op (no throw, no tombstone) when the row does not exist — `false` then,
-   * `true` when a row was actually removed.
+   * Owner-signed removal of one pending join, as {@link deleteJoinedStrand} removes its row:
+   * `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same transaction,
+   * and the request's outcome row with it. A no-op (no throw, no tombstone) when there is no
+   * request — `false` then, `true` when one was actually removed.
    */
   deletePendingJoin(
     id: string,
     ownerKey: string,
     signMessage: (message: Uint8Array) => string
   ): Promise<boolean> {
-    return this.lockedWithRetry(() => this.deleteGuardedRow('PendingJoin', id, ownerKey, signMessage), {}, 'pending-join-delete');
+    return this.lockedWithRetry(
+      () => this.deleteGuardedRow('JoinRequest', id, ownerKey, signMessage, (stampId) => this.deleteJoinOutcomes(stampId)),
+      {}, 'pending-join-delete');
   }
 
   /**
-   * Mint a fresh stamp for `row` and the owner signature `PendingJoin.AuthorizedInsert`
-   * verifies, returning the row as it will be written and the parameters of
-   * {@link PENDING_JOIN_INSERT_SQL}.
+   * Mint a fresh stamp for `request` and the owner signature `JoinRequest.AuthorizedInsert`
+   * verifies, returning the row as it will be written and its insert.
    */
-  private signPendingJoinInsert(
-    row: Omit<PendingJoinRow, 'StampId'>,
+  private signJoinRequestInsert(
+    request: JoinRequestFields,
     ownerKey: string,
     signMessage: (message: Uint8Array) => string
-  ): { written: PendingJoinRow; params: SqlValue[] } {
-    const written: PendingJoinRow = { ...row, StampId: generateStampId(this.config.libp2pNode.peerId.toString()) };
-    const signature = signMessage(buildAuthorizationMessage('CadreControl.PendingJoin', 'add', pendingJoinAddFields(written)));
-    return { written, params: [ownerKey, signature, ...pendingJoinValues(written)] };
+  ): { written: JoinRequestRow; insert: SignedStatement } {
+    const written: JoinRequestRow = { ...request, StampId: generateStampId(this.config.libp2pNode.peerId.toString()) };
+    const signature = signMessage(buildAuthorizationMessage('CadreControl.JoinRequest', 'add', this.config.partyId, joinRequestAddFields(written)));
+    const params = [ownerKey, signature, written.Id, written.Invitation, written.Disclosure, written.RequestedAt, written.ExpiresAt, written.StampId];
+    return { written, insert: { sql: JOIN_REQUEST_INSERT_SQL, params } };
+  }
+
+  /**
+   * Remove the outcome row of the request incarnation `requestStampId`, whichever table holds
+   * it. Unsigned: the schema authorizes the delete by the tombstone retiring that stamp, filed
+   * in the same transaction or already committed (a reap).
+   */
+  private async deleteJoinOutcomes(requestStampId: string): Promise<void> {
+    await this.deleteJoinOutcome('JoinSuccess', requestStampId);
+    await this.deleteJoinOutcome('JoinFailure', requestStampId);
+  }
+
+  /** One unsigned outcome delete (see {@link deleteJoinOutcomes}; a failure's is also authorized by the join superseding it). */
+  private async deleteJoinOutcome(table: 'JoinSuccess' | 'JoinFailure', requestStampId: string): Promise<void> {
+    await this.db!.exec(`
+      delete from CadreControl.${table}
+        with context OwnerKey = null, Signature = null
+        where RequestStampId = ?
+    `, [requestStampId]);
   }
 
   /**
@@ -1950,7 +2478,7 @@ export class ControlDatabase {
     const stampId = generateStampId(peerId);
 
     // Field order MUST match the schema's ValidationKey `AuthorizedInsert` verify: Key, StampId.
-    const message = buildAuthorizationMessage('CadreControl.ValidationKey', 'add', [key, stampId]);
+    const message = buildAuthorizationMessage('CadreControl.ValidationKey', 'add', this.config.partyId, [key, stampId]);
     const signature = signMessage(message);
 
     await this.execWrite(`
@@ -2039,7 +2567,7 @@ export class ControlDatabase {
     // row it vouches.
     const stampId = generateStampId(row.peerId);
     const signature = signMessage(
-      buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', [row.peerId, stampId])
+      buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [row.peerId, stampId])
     );
     return await this.mutateCadrePeer('peer-insert', async () => {
       // retry: false — this guard runs inside the locked write body (see queryStampId's NOTE).
@@ -2094,6 +2622,11 @@ export class ControlDatabase {
    * change the member set. Keeping the rule uniform ("every CadrePeer mutator notifies")
    * beats a per-method exception the next reader has to relearn.
    *
+   * Also clears `VouchUsage`: a row carries exactly one proof (the owner branch of
+   * `AuthorizedUpdate` requires it null), so re-vouching an invitation-admitted row moves it
+   * onto the signature and its invitation is no longer consulted for it — the way an owner
+   * retires a device's dependency on an invitation it may later withdraw.
+   *
    * NOTE: this rebinds VouchOwner to the CALLING owner's key, and the authorized-membership
    * predicate (`CadreNode.listAuthorizedMembers`) now judges rows by that column against each
    * reader's node-local anchor. Benign today because the only caller — the write-while-alone
@@ -2123,14 +2656,14 @@ export class ControlDatabase {
       return false;
     }
     const signature = signMessage(
-      buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', [peerId, stampId])
+      buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, stampId])
     );
     await this.mutateCadrePeer('peer-reauthorize', async () => {
       // Bare `exec` — inside the non-re-entrant write lock (see insertCadrePeer).
       await this.db!.exec(`
         update CadreControl.CadrePeer
           with context OwnerKey = ?, Signature = ?
-          set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?
+          set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?, VouchUsage = null
           where PeerId = ?
       `, [ownerKey, signature, updatedAt, ownerKey, signature, peerId]);
     });
@@ -2191,15 +2724,9 @@ export class ControlDatabase {
    * Owner-signed delete of one guarded row plus the `Revocation` tombstone retiring its
    * stamp, in ONE transaction. The single body behind EVERY guarded delete —
    * {@link deleteStrand}, {@link deleteValidationKey}, {@link deleteCadrePeer},
-   * {@link deleteDeviceToken}; see any of them for the per-table security rationale. Each
-   * of those is a thin named wrapper, so callers never pass a table name and this
-   * generic shape stays off the public surface.
-   *
-   * `OwnerKey` is excluded from `table` only because no owner-key removal path exists in
-   * production yet — the schema has the `'remove'` branch (`OwnerKey.Authorized`, which
-   * requires a DIFFERENT owner as signer) and `control-revocation-replay.spec.ts` drives
-   * it with hand-rolled SQL. Widen this and add a wrapper when that path lands; the body
-   * needs no change.
+   * {@link deleteDeviceToken}, {@link deleteOwnerKey}; see any of them for the per-table
+   * security rationale. Each of those is a thin named wrapper, so callers never pass a
+   * table name and this generic shape stays off the public surface.
    *
    * The row's CURRENT stamp is read first and signed over, so the remove digest binds to
    * this exact row instance. A no-op (no throw, no tombstone) when the row is absent —
@@ -2207,6 +2734,9 @@ export class ControlDatabase {
    * second read (e.g. {@link CadreNode.unpublishStrand}'s committed-while-alone warning,
    * which must not fire for a no-op).
    *
+   * `alongside`, when given, runs inside the transaction before the removal, for a table whose
+   * row has dependants the schema requires removed with it ({@link deletePendingJoin}).
+   *
    * NOTE: the stamp read is outside the transaction. A concurrent writer that removes
    * the row in between makes the signature bind a stamp that is no longer live; the
    * delete then matches nothing and the tombstone insert collides with the other
@@ -2221,7 +2751,8 @@ export class ControlDatabase {
     table: RemovableTable,
     keyValue: string,
     ownerKey: string,
-    signMessage: (message: Uint8Array) => string
+    signMessage: (message: Uint8Array) => string,
+    alongside?: (stampId: string) => Promise<void>
   ): Promise<boolean> {
     this.ensureInitialized();
     // retry: false — this runs inside the locked write body (see queryStampId's NOTE).
@@ -2231,8 +2762,11 @@ export class ControlDatabase {
       return false;
     }
 
-    const removal = signGuardedRemoval(table, keyValue, stampId, signMessage);
-    await this.inTransaction(`delete ${table}`, () => this.execGuardedRemoval(removal, ownerKey));
+    const removal = signGuardedRemoval(this.config.partyId, table, keyValue, stampId, signMessage);
+    await this.inTransaction(`delete ${table}`, async () => {
+      await alongside?.(stampId);
+      await this.execGuardedRemoval(removal, ownerKey);
+    });
 
     log('%s deleted: %s (stamp retired)', table, keyValue);
     this.notifyGuardedDelete(removal.ref);
@@ -2242,7 +2776,7 @@ export class ControlDatabase {
   /**
    * Delete the row incarnation `removal` names and file its tombstone — the statement pair
    * every owner removal of a guarded row runs ({@link deleteGuardedRow},
-   * {@link deleteStrandAndPartyKey}, {@link replacePendingJoin}). The caller supplies the
+   * {@link deleteStrandAndPartyKey}, {@link rewritePendingJoin}). The caller supplies the
    * transaction: the schema's `RevocationRecorded` check refuses the delete unless the
    * tombstone commits with it.
    *
@@ -2259,14 +2793,33 @@ export class ControlDatabase {
         with context OwnerKey = ?, Signature = ?
         where ${GUARDED_KEY_COLUMN[tableName]} = ? and StampId = ?
     `, [ownerKey, removal.signature, rowKey, stampId]);
-    // ReissuedAt named explicitly at 0 (the only value FreshTombstone accepts) rather
-    // than leaning on the column default — the seat-at-zero rule is load-bearing for
-    // reissueRevocations' monotonic bump, so state it at the write site.
+    await this.execTombstone(removal.ref, removal.revocationSignature, ownerKey);
+  }
+
+  /**
+   * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
+   * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of a
+   * `CadreInvite` withdrawal ({@link withdrawCadreInvite}), whose row stays — or the ledger
+   * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
+   * lock and, where one is needed, the transaction.
+   *
+   * `ReissuedAt` is named explicitly at 0 (the only value `FreshTombstone` accepts) rather
+   * than leaning on the column default — the seat-at-zero rule is load-bearing for
+   * {@link reissueRevocations}' monotonic bump, so state it at the write site.
+   *
+   * `SignerKey` / `SignerSig` store the context pair (`Revocation.Authorized` pins them
+   * equal), so a node that receives the row by replication can tell which owner filed it.
+   */
+  private async execTombstone(
+    ref: RevokedRowRef | typeof REVOCATION_LEDGER_MARKER,
+    revocationSignature: string,
+    ownerKey: string
+  ): Promise<void> {
     await this.db!.exec(`
-      insert into CadreControl.Revocation (TableName, RowKey, StampId, ReissuedAt)
+      insert into CadreControl.Revocation (TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig)
         with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, 0)
-    `, [ownerKey, removal.revocationSignature, tableName, rowKey, stampId]);
+        values (?, ?, ?, 0, ?, ?)
+    `, [ownerKey, revocationSignature, ref.tableName, ref.rowKey, ref.stampId, ownerKey, revocationSignature]);
   }
 
   /**
@@ -2367,6 +2920,15 @@ export class ControlDatabase {
       // 0 on its first connected tick and holds there. If a party ever reaps many rows
       // in one pass, hoist the notify to one refresh after the sweep instead.
       await this.mutateCadrePeer('peer-reap', () => this.db!.exec(sql, [rowKey, stampId]));
+    } else if (table === 'JoinRequest') {
+      // The request's outcome row goes with it; the committed tombstone authorizes that delete
+      // too. An outcome row held for a request this node never received (the request was
+      // written alone and its outcome connected, before the growth-edge re-issue) is left: it
+      // is unreadable, since every reader starts from the request.
+      await this.lockedWithRetry(() => this.inTransaction('reap JoinRequest', async () => {
+        await this.deleteJoinOutcomes(stampId);
+        await this.db!.exec(sql, [rowKey, stampId]);
+      }), {}, 'reap-JoinRequest');
     } else {
       await this.execWrite(sql, [rowKey, stampId], `reap-${table}`);
     }
@@ -2406,7 +2968,7 @@ export class ControlDatabase {
    *   reads from this node (every other node already filters it by tombstone). A revoked
    *   node therefore keeps its own copy of its own row; "a node that learns it has been
    *   revoked should shut itself down" is a distinct behaviour and its own ticket.
-   *   `ValidationKey`, `JoinedStrand` and `PendingJoin` have no self notion and are not
+   *   `ValidationKey`, `JoinedStrand` and `JoinRequest` have no self notion and are not
    *   special-cased.
    *
    * A per-row failure is logged and skipped rather than aborting the sweep: an abort would
@@ -2502,7 +3064,7 @@ export class ControlDatabase {
     const signed = rows.map((row) => ({
       row,
       signature: signMessage(buildAuthorizationMessage(
-        'CadreControl.Revocation', 'reissue',
+        'CadreControl.Revocation', 'reissue', this.config.partyId,
         [row.tableName, row.rowKey, row.stampId, String(reissuedAt)]
       )),
     }));
@@ -2574,21 +3136,14 @@ export class ControlDatabase {
     signMessage: (message: Uint8Array) => string
   ): Promise<RevocationLedgerOpenResult> {
     this.ensureInitialized();
-    const { tableName, rowKey, stampId } = REVOCATION_LEDGER_MARKER;
-    const signature = signMessage(buildAuthorizationMessage(
-      'CadreControl.Revocation', 'remove', [tableName, rowKey, stampId]
-    ));
+    const signature = signMessage(revocationTombstoneMessage(this.config.partyId, REVOCATION_LEDGER_MARKER));
     try {
       return await this.lockedWithRetry<RevocationLedgerOpenResult>(async () => {
         if (await this.revocationLedgerFiled()) {
           return 'already-open';
         }
-        // Bare `exec`: already inside the write lock, which is NOT re-entrant.
-        await this.db!.exec(`
-          insert into CadreControl.Revocation (TableName, RowKey, StampId)
-            with context OwnerKey = ?, Signature = ?
-            values (?, ?, ?)
-        `, [ownerKey, signature, tableName, rowKey, stampId]);
+        // execTombstone is a bare `exec`: already inside the write lock, which is NOT re-entrant.
+        await this.execTombstone(REVOCATION_LEDGER_MARKER, signature, ownerKey);
         log('Revocation ledger marker filed');
         return 'opened';
       }, {}, 'revocation-ledger-open');
@@ -2693,15 +3248,18 @@ export class ControlDatabase {
   }
 
   /**
-   * Run a `CadrePeer` row mutation and notify the membership listener once it has
+   * Run a membership-relevant mutation and notify the membership listener once it has
    * COMMITTED.
    *
-   * EVERY `CadrePeer` writer goes through here, with one documented exception
-   * ({@link updateSelfPeerRecord}, which cannot change the snapshot) — that is what makes
-   * the party-membership snapshot refresh automatic rather than a caller obligation. A
+   * Covers every write that can change who is a member or an owner: EVERY `CadrePeer`
+   * writer, with one documented exception ({@link updateSelfPeerRecord}, which cannot
+   * change the snapshot), the `OwnerKey` writers ({@link insertOwnerKeyVouched},
+   * {@link deleteOwnerKey}) and the invitation redemption ({@link redeemCadreInvite}),
+   * which seats both. That is what makes the party-membership snapshot refresh automatic
+   * rather than a caller obligation. The name predates the `OwnerKey` writers. A
    * writer necessarily holds the target node's ControlDatabase (the `SeedBootstrapService`'s
-   * event callbacks are NOT a viable seam: the temp services `CadreNode.applySeed`/
-   * `dialInvite` build, and services constructed outside `CadreNode` entirely, never get
+   * event callbacks are NOT a viable seam: the temp service `CadreNode.applySeed`
+   * builds, and services constructed outside `CadreNode` entirely, never get
    * callbacks wired), so this is the one point on the write path that cannot be bypassed.
    *
    * `body` owns its own transaction if it needs one and must COMMIT before returning, so
@@ -2890,7 +3448,7 @@ export class ControlDatabase {
     }
     throw new Error(
       `mutateCadrePeer(${reason}): a transaction is open ${where} the mutation body — a ` +
-      'CadrePeer write must commit before the membership listener runs; move the ' +
+      'membership write must commit before the membership listener runs; move the ' +
       'mutateCadrePeer wrapper out to enclose the commit'
     );
   }
@@ -2980,7 +3538,7 @@ export class ControlDatabase {
 
     // Field order MUST match the schema's FormationInvite `AuthorizedInsert` verify:
     // Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId.
-    const message = buildAuthorizationMessage('CadreControl.FormationInvite', 'add', [
+    const message = buildAuthorizationMessage('CadreControl.FormationInvite', 'add', this.config.partyId, [
       token, sAppId, expiresAtField, totalUsesField, validationUrlField, strandIdField, stampId,
     ]);
     const signature = signMessage(message);
@@ -3417,6 +3975,446 @@ export class ControlDatabase {
     return false;
   }
 
+  // ── Cadre invitations (CadreInvite / CadreInviteUsage) ─────────────────────────────────
+
+  /**
+   * Mint and insert an owner-signed `CadreInvite`: an invitation to join THIS cadre that any
+   * member machine can later redeem on the owner's behalf ({@link redeemCadreInvite}).
+   *
+   * The owner signs the whole row ({@link cadreInviteAddMessage}) — `ExpiresAt` through
+   * {@link canonicalDatetime} so the signed segment byte-matches the stored `datetime`, as
+   * {@link insertFormationInvite} does — and the stored `IssuerKey`/`IssuerSig` are pinned to
+   * that signer by `CadreInvite.AuthorizedInsert`. The signature is part of the row because
+   * the row travels: the returned {@link CadreInviteRow} is what the invitation bundle
+   * carries to the holder, and {@link seatCadreInvite} re-inserts it verbatim on a member
+   * that has not received it by replication.
+   *
+   * `key` is the invitation's ed25519 PUBLIC key; the caller minted the pair and hands the
+   * private half to the invitee out of band. It is never stored here (`Strand.Invite` has the
+   * same shape).
+   *
+   * @param invite.key - the invitation public key (base64url ed25519), the row's primary key
+   * @param invite.peerId - the device the invitation is for, or null for whoever redeems first
+   * @param invite.grantsOwner - whether redemption also seats an `OwnerKey` row for the device
+   * @param invite.expiresAtMs - epoch ms after which it cannot be redeemed; omit for never
+   * @param invite.totalUses - how many redemptions it allows; omit for unlimited
+   * @returns the row as stored, `expiresAt` in its canonical form
+   */
+  async insertCadreInvite(
+    invite: {
+      key: string;
+      peerId?: string | null;
+      grantsOwner: boolean;
+      expiresAtMs?: number | null;
+      totalUses?: number | null;
+    },
+    ownerKey: string,
+    signMessage: (message: Uint8Array) => string
+  ): Promise<CadreInviteRow> {
+    this.ensureInitialized();
+    const key = requireEd25519PublicKeyB64(invite.key, 'cadre invitation key');
+    const signed: CadreInviteSignedFields = {
+      key,
+      peerId: invite.peerId ?? null,
+      grantsOwner: invite.grantsOwner,
+      expiresAt: invite.expiresAtMs == null ? null : await canonicalDatetime(this.db!, invite.expiresAtMs),
+      totalUses: invite.totalUses ?? null,
+      stampId: generateStampId(this.config.libp2pNode.peerId.toString()),
+    };
+    const row: CadreInviteRow = {
+      ...signed,
+      issuerKey: ownerKey,
+      issuerSig: signMessage(cadreInviteAddMessage(this.config.partyId, signed)),
+    };
+    await this.lockedWithRetry(() => this.execCadreInviteInsert(row), {}, 'cadre-invite-insert');
+    log('Cadre invitation inserted: %s (peer=%s owner=%s)', key, row.peerId ?? 'any', row.grantsOwner);
+    return row;
+  }
+
+  /**
+   * Seat an owner-signed `CadreInvite` row received inside an invitation bundle, under its own
+   * stored `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, so a member that
+   * already holds the row (by replication, or from an earlier redemption attempt) is a no-op.
+   *
+   * @returns `true` when this call inserted the row, `false` when it was already present.
+   * @throws {CadreInviteIssuerUnknownError} when `CadreInvite.AuthorizedInsert` refuses it: the
+   *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
+   *   not verify. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+   */
+  async seatCadreInvite(row: CadreInviteRow): Promise<boolean> {
+    this.ensureInitialized();
+    try {
+      return await this.lockedWithRetry(async () => {
+        // retry: false — inside the locked write body (see queryStampId's NOTE).
+        if (await this.queryStampId('CadreInvite', row.key, false) !== null) {
+          log('CadreInvite %s already seated; seat skipped', row.key);
+          return false;
+        }
+        await this.execCadreInviteInsert(row);
+        log('Cadre invitation seated from its bundle: %s', row.key);
+        return true;
+      }, {}, 'cadre-invite-seat');
+    } catch (error) {
+      if (errorChainMatches(error, CADRE_INVITE_UNAUTHORIZED)) {
+        throw new CadreInviteIssuerUnknownError(row.key, row.issuerKey, { cause: error });
+      }
+      throw error;
+    }
+  }
+
+  /** Bare `CadreInvite` insert shared by {@link insertCadreInvite} and {@link seatCadreInvite}; the caller holds the lock. */
+  private async execCadreInviteInsert(row: CadreInviteRow): Promise<void> {
+    await this.db!.exec(`
+      insert into CadreControl.CadreInvite (Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?, ?, ?, ?)
+    `, [
+      row.issuerKey, row.issuerSig,
+      row.key, row.peerId, row.grantsOwner ? 1 : 0, row.expiresAt, row.totalUses,
+      row.issuerKey, row.issuerSig, row.stampId,
+    ]);
+  }
+
+  /**
+   * Read one `CadreInvite` row by key, or null when absent. Withdrawn rows are returned too —
+   * the row is the holder's proof and never goes away; liveness is {@link hasLiveCadreInvite}'s
+   * question, and `CadreInviteUsage.Authorized`'s at redemption.
+   *
+   * `retry: false` is passed by {@link redeemCadreInvite}, which reads INSIDE its locked write
+   * body — the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
+   */
+  async queryCadreInvite(key: string, retry = true): Promise<CadreInviteRow | null> {
+    this.ensureInitialized();
+    for (const row of await this.readRows(`${CADRE_INVITE_SELECT_SQL} where Key = ?`, [key], 'cadre-invite', retry)) {
+      return cadreInviteRowOf(row);
+    }
+    return null;
+  }
+
+  /**
+   * Every `CadreInvite` row this node holds, withdrawn and expired ones included (see
+   * {@link queryCadreInvite}). Read by the membership predicate when at least one `CadrePeer`
+   * row is invitation-admitted; `retry: false` is forwarded from
+   * {@link CadreNode.listAuthorizedMembers} on the membership-gate refresh path for
+   * {@link queryCadrePeers}' reason.
+   */
+  async queryCadreInvites(retry = true): Promise<CadreInviteRow[]> {
+    this.ensureInitialized();
+    const rows = await this.readRows(CADRE_INVITE_SELECT_SQL, undefined, 'cadre-invites', retry);
+    return rows.map(cadreInviteRowOf);
+  }
+
+  /**
+   * Every `CadreInviteUsage` row this node holds — the redemption records the membership
+   * predicate verifies invitation-admitted rows against. Same `retry` contract as
+   * {@link queryCadreInvites}.
+   */
+  async queryCadreInviteUsages(retry = true): Promise<CadreInviteUsageRow[]> {
+    this.ensureInitialized();
+    const rows = await this.readRows(
+      'select UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig from CadreControl.CadreInviteUsage',
+      undefined, 'cadre-invite-usages', retry
+    );
+    return rows.map(cadreInviteUsageRowOf);
+  }
+
+  /**
+   * How many times a cadre invitation has been redeemed (its `CadreInviteUsage` rows), served
+   * through the `CadreInviteUsageByInvite` index. As {@link countFormationUsage}: a permissive
+   * PRE-check, not the cap — the cap is `CadreInviteUsage.Authorized`'s own committed count.
+   *
+   * `retry: false` is passed by {@link assertCadreInviteSeatRemains}, inside the locked body.
+   */
+  async countCadreInviteUsage(key: string, retry = true): Promise<number> {
+    this.ensureInitialized();
+    const sql = 'select count(1) as Count from CadreControl.CadreInviteUsage where InviteKey = ?';
+    for (const row of await this.readRows(sql, [key], 'cadre-invite-usage-count', retry)) {
+      return (row.Count as number) ?? 0;
+    }
+    return 0;
+  }
+
+  /**
+   * Is any cadre invitation still redeemable — not withdrawn, unexpired, with uses below its
+   * `TotalUses`, and issued by a current owner? The conditions `CadreInviteUsage.Authorized`
+   * applies, read ahead of time so the control-network connection gate can answer "does this
+   * node expect a stranger?" with no key to ask about, exactly as
+   * {@link hasOutstandingFormationInvite} answers it for strand formation. The expiry
+   * comparison is `expiresAtMs <= now`, so an invitation the redemption would refuse never
+   * holds the gate open.
+   *
+   * Withdrawal is read through {@link queryRevokedStamps}, the per-table retired-stamp seam
+   * every other revocation-aware reader uses (and the one an isolated node can still answer).
+   */
+  async hasLiveCadreInvite(nowMs: number = Date.now()): Promise<boolean> {
+    this.ensureInitialized();
+    // NOTE: getOwnerKeys reads the retired OwnerKey stamps first, so this gate path scans
+    // Revocation twice (once per table, the two in parallel). If the stranger path's decision
+    // ever nears the admission gate's 2 s deadline, read the retired stamps once for both.
+    const [withdrawn, owners] = await Promise.all([this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()]);
+    // NOTE: scans every CadreInvite row (expired and withdrawn ones included, since rows are
+    // never deleted) on the stranger path of an inbound connection. Cadre-scale invitation
+    // counts make that free today; if a long-lived cadre accumulates thousands and inbound
+    // upgrades slow down, add an expiry-ordered index or prune withdrawn/expired rows (which
+    // first needs every device they admitted re-vouched, so the chain no longer needs them).
+    const metered: Array<{ key: string; totalUses: number }> = [];
+    let unlimitedLive = false;
+    for (const row of await this.readRows(
+      'select Key, ExpiresAt, TotalUses, IssuerKey, StampId from CadreControl.CadreInvite',
+      undefined,
+      'live-cadre-invites'
+    )) {
+      const open = cadreInviteStillOpen(
+        { stampId: row.StampId as string, issuerKey: row.IssuerKey as string, expiresAt: (row.ExpiresAt as string | null) ?? null },
+        withdrawn, owners, nowMs
+      );
+      if (!open) {
+        continue;
+      }
+      const totalUses = (row.TotalUses as number | null) ?? null;
+      if (totalUses === null) {
+        unlimitedLive = true;
+      } else {
+        metered.push({ key: row.Key as string, totalUses });
+      }
+    }
+    if (unlimitedLive) {
+      return true;
+    }
+    // NOTE: one retried read per metered invitation, each with its own read budget, on a path
+    // the admission gate awaits under a 2 s fail-open deadline — the same shape and the same
+    // revisit condition as hasOutstandingFormationInvite's loop.
+    for (const invite of metered) {
+      if (await this.countCadreInviteUsage(invite.key) < invite.totalUses) {
+        return true;
+      }
+    }
+    return false;
+  }
+
+  /**
+   * Is this one cadre invitation still redeemable here — the conditions
+   * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is the one this node
+   * holds under `invite.key`; when it holds none, `invite` itself (a bundle's copy, not seated
+   * yet), but only if its issuer signature verifies, because an unsigned copy would otherwise be
+   * judged by whichever owner it names as issuer. A permissive pre-check like
+   * {@link countCadreInviteUsage}: {@link seatCadreInvite} and the redemption's own write are
+   * what enforce every condition.
+   */
+  async isCadreInviteLive(invite: CadreInviteRow, nowMs: number = Date.now()): Promise<boolean> {
+    this.ensureInitialized();
+    const row = await this.queryCadreInvite(invite.key) ?? (verifyCadreInviteRow(this.config.partyId, invite) ? invite : null);
+    if (row === null) {
+      return false;
+    }
+    const [withdrawn, owners] = await Promise.all([this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()]);
+    if (!cadreInviteStillOpen(row, withdrawn, owners, nowMs)) {
+      return false;
+    }
+    return row.totalUses === null || await this.countCadreInviteUsage(row.key) < row.totalUses;
+  }
+
+  /**
+   * Every `CadreInvite` row this node holds with its standing: how many redemptions are
+   * recorded, whether it is withdrawn, and whether it is still redeemable — the same
+   * conditions {@link hasLiveCadreInvite} applies, answered per row for an owner's listing
+   * rather than short-circuited. One usage count per row, so this is the owner's
+   * occasional read, not a gate's.
+   */
+  async listCadreInviteStatuses(nowMs: number = Date.now()): Promise<CadreInviteStatus[]> {
+    this.ensureInitialized();
+    const [invites, withdrawnStamps, owners] = await Promise.all([
+      this.queryCadreInvites(), this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()
+    ]);
+    const statuses: CadreInviteStatus[] = [];
+    // NOTE: one retried count read per invitation, withdrawn and expired rows included, since
+    // rows are never deleted; if a long-lived cadre's listing ever shows as slow, group the
+    // usage counts in one statement or skip the count for rows that are no longer open.
+    for (const invite of invites) {
+      const usesRecorded = await this.countCadreInviteUsage(invite.key);
+      const withdrawn = withdrawnStamps.has(invite.stampId);
+      const live = cadreInviteStillOpen(invite, withdrawnStamps, owners, nowMs)
+        && (invite.totalUses === null || usesRecorded < invite.totalUses);
+      statuses.push({ invite, live, withdrawn, usesRecorded });
+    }
+    return statuses;
+  }
+
+  /**
+   * Owner-signed WITHDRAWAL of a cadre invitation: file the `Revocation` tombstone retiring its
+   * stamp, with the row kept. The row stays because every device the invitation admitted
+   * proves its membership through it (`CadrePeer.AuthorizedInsert`'s consent branch,
+   * `verifyInvitationAdmission`); `CadreInvite.NoDelete` refuses a delete, and
+   * `Revocation.RowIsGone` admits a `'CadreInvite'` tombstone while the row lives. Afterwards
+   * `CadreInviteUsage.Authorized` refuses every further redemption, and `CadreInvite.NotRevoked`
+   * refuses re-seating the row from the holder's signed copy on any node holding the
+   * tombstone.
+   *
+   * Idempotent: a no-op (no throw, nothing written) when the row is absent locally or already
+   * withdrawn — `false` then, `true` when this call filed the tombstone. The owner must hold the
+   * row to withdraw it, since the tombstone names the row's stamp.
+   *
+   * Fires the guarded-delete listener like a removal does, so a withdrawal committed while the
+   * node was alone is queued for re-issue on cohort growth ({@link CadreNode.noteGuardedDelete}).
+   */
+  async withdrawCadreInvite(
+    key: string,
+    ownerKey: string,
+    signMessage: (message: Uint8Array) => string
+  ): Promise<boolean> {
+    this.ensureInitialized();
+    const filed = await this.lockedWithRetry(async (): Promise<RevokedRowRef | null> => {
+      // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
+      const stampId = await this.queryStampId('CadreInvite', key, false);
+      if (stampId === null) {
+        log('withdrawCadreInvite: no CadreInvite row for %s (nothing to withdraw)', key);
+        return null;
+      }
+      if ((await this.queryRevokedStamps('CadreInvite', false)).has(stampId)) {
+        log('withdrawCadreInvite: %s already withdrawn (stamp %s retired)', key, stampId);
+        return null;
+      }
+      const ref: RevokedRowRef = { tableName: 'CadreInvite', rowKey: key, stampId };
+      await this.execTombstone(ref, signMessage(revocationTombstoneMessage(this.config.partyId, ref)), ownerKey);
+      return ref;
+    }, {}, 'cadre-invite-withdraw');
+    if (filed === null) {
+      return false;
+    }
+    log('Cadre invitation withdrawn: %s (stamp %s retired, row kept)', key, filed.stampId);
+    this.notifyGuardedDelete(filed);
+    return true;
+  }
+
+  /**
+   * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member and,
+   * when the invitation grants ownership, as an owner — with NO owner signature. One
+   * transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`), the
+   * `OwnerKey` row when granted (consent branch of `Authorized`), and last the
+   * `CadreInviteUsage` row that authorizes both; the usage row's own checks (`PeerExists`,
+   * `OwnerExists`) read the rows back, so the three are mutually bound to this exact
+   * redemption and none can be held in reserve. The invitation must already be committed
+   * ({@link seatCadreInvite}): every consent branch reads `committed.CadreInvite`.
+   *
+   * The two signatures are the holder's and the device's, minted on the device over
+   * {@link cadreInviteRedeemMessage} / {@link cadreInviteConsentMessage}; this machine only
+   * verifies them (by writing the row). `peerId` must be the identity multihash of `peerKey`:
+   * the schema cannot derive it, so a writer asserts the pair and every reader re-derives it
+   * (`verifyInvitationAdmission`) — a mismatched pair is written and then never trusted.
+   *
+   * Idempotent for a retry after a dropped reply: when the device's row is already present
+   * (and its `OwnerKey` row too, when granted) nothing is written and no seat is spent —
+   * `alreadyMember: true`. A present row whose `OwnerKey` row is missing under an
+   * owner-granting invitation is completed: the usage row then names the existing peer stamp.
+   * The seat check ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a
+   * single-use redemption is answered `alreadyMember` rather than refused as exhausted.
+   *
+   * Through {@link mutateCadrePeer}, so the membership hub is notified; inside the locked body
+   * every read passes `retry: false` and every stamp is minted per attempt, so a
+   * {@link lockedWithRetry} re-run starts clean.
+   *
+   * @throws {InvitationExhaustedError} when the invitation's seats are all spent (by name,
+   *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains}).
+   */
+  async redeemCadreInvite(params: {
+    inviteKey: string;
+    peerId: string;
+    /** The device's ed25519 public key (base64url); `peerId` is its identity multihash. */
+    peerKey: string;
+    /** The device's dialable addresses, if known; stored comma-joined as `authorizePeer` does. */
+    multiaddrs?: string[];
+    /** Single-use nonce minted by the device; both signatures cover it. */
+    usageStampId: string;
+    /** The holder's signature with the invitation private key over the `'redeem'` digest. */
+    inviteSig: string;
+    /** The device's signature with its own key over the `'consent'` digest. */
+    peerSig: string;
+    nowMs?: number;
+  }): Promise<CadreInviteRedemptionResult> {
+    this.ensureInitialized();
+    const { inviteKey, peerId, peerKey, usageStampId, inviteSig, peerSig } = params;
+    const nowMs = params.nowMs ?? Date.now();
+    const multiaddr = params.multiaddrs?.length ? params.multiaddrs.join(',') : '';
+    log('Redeeming cadre invitation %s for %s', inviteKey, peerId);
+
+    return this.mutateCadrePeer('cadre-invite-redeem', async () => {
+      const invite = await this.queryCadreInvite(inviteKey, false);
+      if (invite === null) {
+        throw new Error(`Cannot redeem cadre invitation ${inviteKey}: no CadreInvite row is seated on this node (seatCadreInvite first)`);
+      }
+      const seated = await this.readSeatedAdmission(peerId, peerKey, invite.grantsOwner);
+      if (seated.peerStampId !== null && (!invite.grantsOwner || seated.ownerStampId !== null)) {
+        log('redeemCadreInvite: %s already admitted; nothing written', peerId);
+        return { alreadyMember: true, peerStampId: seated.peerStampId, ownerStampId: seated.ownerStampId };
+      }
+      await this.assertCadreInviteSeatRemains(invite);
+
+      // Stamps minted from the ADMITTED device's id, as insertCadrePeer does: the nonce names
+      // the row it seats. Minted inside the body, so a re-run mints afresh over a rolled-back
+      // attempt rather than re-presenting a stamp the usage row may already name.
+      const peerStampId = seated.peerStampId ?? generateStampId(peerId);
+      const ownerStampId = invite.grantsOwner ? (seated.ownerStampId ?? generateStampId(peerId)) : null;
+      const nowCanonical = await canonicalDatetime(this.db!, nowMs);
+      await this.inTransaction('cadre-invite-redeem', async () => {
+        if (seated.peerStampId === null) {
+          await this.db!.exec(`
+            insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig, VouchUsage)
+              with context OwnerKey = null, Signature = null
+              values (?, ?, ?, ?, null, ?, ?, null, ?)
+          `, [peerId, peerKey, multiaddr, nowMs, peerStampId, invite.issuerKey, usageStampId]);
+        }
+        if (ownerStampId !== null && seated.ownerStampId === null) {
+          await this.db!.exec(`
+            insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig, VouchUsage)
+              with context OwnerKey = null, Signature = null
+              values (?, ?, ?, null, ?)
+          `, [peerKey, ownerStampId, invite.issuerKey, usageStampId]);
+        }
+        await this.db!.exec(`
+          insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig)
+            with context Now = ?
+            values (?, ?, ?, ?, ?, ?, ?, ?)
+        `, [nowCanonical, usageStampId, inviteKey, peerId, peerKey, peerStampId, ownerStampId, inviteSig, peerSig]);
+      });
+      log('Redeemed cadre invitation %s: %s admitted (owner=%s, usage %s)', inviteKey, peerId, ownerStampId !== null, usageStampId);
+      return { alreadyMember: false, peerStampId, ownerStampId };
+    });
+  }
+
+  /**
+   * The rows a redemption would seat that are already present: the device's `CadrePeer`
+   * stamp, and — only when the invitation grants ownership — its `OwnerKey` stamp. Raw stamp
+   * reads ({@link queryStampId}), so a physically present row counts; inside the locked
+   * body, so never retried.
+   */
+  private async readSeatedAdmission(
+    peerId: string,
+    peerKey: string,
+    grantsOwner: boolean
+  ): Promise<{ peerStampId: string | null; ownerStampId: string | null }> {
+    return {
+      peerStampId: await this.queryStampId('CadrePeer', peerId, false),
+      ownerStampId: grantsOwner ? await this.queryStampId('OwnerKey', peerKey, false) : null,
+    };
+  }
+
+  /**
+   * Refuse a redemption that would consume a seat the cadre invitation does not have, by
+   * name ({@link InvitationExhaustedError}) — the cadre-invitation twin of
+   * {@link assertSeatRemains}, for the same reason: the schema's cap clause refuses as a
+   * generic `Authorized` failure a caller would otherwise report as retryable. Reads the
+   * committed count inside the locked body, so on a same-node race the loser is refused here.
+   */
+  private async assertCadreInviteSeatRemains(invite: CadreInviteRow): Promise<void> {
+    if (invite.totalUses === null) {
+      return;
+    }
+    const used = await this.countCadreInviteUsage(invite.key, false);
+    if (used >= invite.totalUses) {
+      throw new InvitationExhaustedError(invite.key, used, invite.totalUses);
+    }
+  }
+
   /**
    * Close the database and cleanup resources.
    *