@serfab/cadre-core 1.13.0 → 1.14.0

package/dist/cadre-node.js

@@ -6,7 +6,7 @@ import { createLibp2pNode } from '@optimystic/db-p2p';
 import { wrapStorageWithCache, disposeStorageCache } from '@serfab/quereus-plugin-sereus';
 import { multiaddr } from '@multiformats/multiaddr';
 import { controlClusterPolicy, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS, DEFAULT_CONNECTION_MONITOR } from './types.js';
-import { sign } from '@optimystic/quereus-plugin-crypto';
+import { generatePrivateKey, sign } from '@optimystic/quereus-plugin-crypto';
 import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64 } from './ed25519-key.js';
 import { strandTransportKey } from './strand-transport-key.js';
 import { assertScopeKeyCharset, assertStrandScopeKey, controlStorageScope, InvalidStrandIdError, isValidStrandScopeKey } from './storage-scope.js';
@@ -22,8 +22,9 @@ import { MemoryEnrolledMachineStore } from './enrolled-machine-store.js';
 import { JoinedStrandSession, KeyStoreJoinedStrandStore, MemoryJoinedStrandStore } from './joined-strand-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId } from './peer-addr-book.js';
 import { strandFretPeerAddrs } from './strand-fret-addrs.js';
-import { verifyCadrePeerVoucher } from './peer-authorization.js';
-import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
+import { verifyCadrePeerVoucher, verifyInvitationAdmission } from './peer-authorization.js';
+import { deriveOwnerAnchor } from './owner-anchor-sync.js';
+import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 import { signPeerRecord, verifyPeerRecordSignature, isPeerRecordFresh, orderSignalingFirst, isSignalingAddr, trailingPeerId, withTrailingPeerId, currentMemberTrustPolicy, DEFAULT_PEER_RECORD_MAX_AGE_MS, DEFAULT_PEER_RECORD_HEARTBEAT_MS } from './peer-record.js';
 import { signDeviceTokenRecord, verifyDeviceTokenSignature, isPushPlatform } from './device-token.js';
 import { StrandWatcher } from './strand-watcher.js';
@@ -32,17 +33,21 @@ import { PeerJoinBackfill } from './peer-join-backfill.js';
 import { deriveCohortMembers } from './strand-cohort.js';
 import { selectControlCohortDials, DEFAULT_CONTROL_COHORT_RECONCILE_MS, DEFAULT_CONTROL_COHORT_TARGET_DEGREE } from './control-cohort.js';
 import { dialPeerAddrs, SelfRelayOnlyError, CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS } from './peer-dial.js';
-import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayAdmissionReserveDeadlineMs, relayReservationBudgetMs, relayedDialBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
+import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayReservationBudgetMs, relayedDialBudgetMs, relayedRequestBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager } from './hibernation-manager.js';
-import { ControlDatabase, isPendingJoinConflict, isStrandIdConflict, pendingJoinId } from './control-database.js';
+import { ControlDatabase, generateStampId, isPendingJoinConflict, isStrandIdConflict, pendingJoinId } from './control-database.js';
+import { CadreInviteHandler, encodeCadreInvitation, redeemAtMembers, signRedeemRequest } from './cadre-invite-protocol.js';
 import { FormationPostApprovalError } from './strand-formation-rejection.js';
 import { PendingJoinRunner, membershipInvitesToStage, parseStoredDisclosure, requestedPendingJoin } from './pending-join-runner.js';
-import { SeedBootstrapService } from './seed-bootstrap.js';
+import { SeedBootstrapService, mergeSeedPeers, seedDigest } from './seed-bootstrap.js';
+import { claimSecretTrustPolicy } from './seed-trust-policy.js';
+import { ClaimRefusedError, claimProof, parseClaimSecret } from './claim-proof.js';
 import { StrandSolicitationService } from './strand-solicitation.js';
 import { ControlFormationUsageRecorder } from './control-formation-recorder.js';
 import { selectInvitationSiblingAddrs } from './invitation-bootstrap.js';
-import { createMembershipConnectionGater, DEFAULT_ENROLLMENT_WINDOW_MS, UnauthorizedReservationBudget } from './membership-connection-gater.js';
+import { createMembershipConnectionGater, UnauthorizedReservationBudget } from './membership-connection-gater.js';
+import { controlNetworkName, installControlProtocolGuard } from './control-protocol-guard.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs } from './strand-addr-protocol.js';
 import { DelegateAdmissionStore, extractCircuitRelayTargets, dueRelayAnnounces, prunePeerStrandKeys, peerStrandKey } from './delegate-admission.js';
@@ -77,6 +82,15 @@ export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
  * minute rather than one a tick.
  */
 export const STRAND_PEER_ADDR_RETRY_MS = 60 * 1000;
+/**
+ * Default lifetime of an UNTARGETED, OWNER-GRANTING cadre invitation
+ * ({@link CadreNode.createCadreInvitation}): whoever holds the bundle becomes an owner, so
+ * it is a bearer credential for admin rights and lives only long enough to be pasted or
+ * scanned by the device it was minted for.
+ */
+export const OWNER_INVITATION_DEFAULT_TTL_MS = 15 * 60 * 1000;
+/** Default lifetime of every other cadre invitation: targeted, or granting membership only. */
+export const CADRE_INVITATION_DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
 /**
  * A circuit relay as a strand-addr RPC target: dialed by peerId, with its
  * direct addr riding along as the fallback for a relay we hold no connection to.
@@ -116,11 +130,10 @@ function unionAddrs(primary, extra) {
     }
     return out;
 }
-/**
- * Build the signing callback the `ControlDatabase` writers expect: they hand it the
- * canonical row-bound message BYTES (see `buildAuthorizationMessage`), and it ed25519-signs
- * them directly (no pre-hash) with the owner private key, returning a base64url signature.
- */
+/** Whether a `CadrePeer` or `OwnerKey` row's proof is an invitation admission rather than an owner voucher (`types.ts` → `CadrePeerRow`, `OwnerKeyRow`). */
+function isInvitationAdmitted(row) {
+    return row.vouchSig === null && row.vouchUsage !== null;
+}
 function signMessageWith(privateKeyB64) {
     return (message) => sign(message, privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url');
 }
@@ -244,8 +257,22 @@ export class CadreNode {
          * start() cycle rebuilds it with a fresh caught-up-peer memo.
          */
         this.controlBackfill = null;
+        /**
+         * Devices whose invitation redemption this member has verified and is admitting right now,
+         * each with its count of overlapping redemptions. The control backfill's gate admits them
+         * as it admits a member, for that window only ({@link catchUpRedeemingDevice}).
+         */
+        this.admittingDevices = new Map();
         this.strandWatcher = null;
         this.seedBootstrapService = null;
+        /**
+         * The claim-secret trust policy of a node started with `config.claim`, built once by
+         * {@link initializeClaimPolicy} over {@link trustedOwnerStore} and handed to every
+         * seed service this node constructs ({@link inboundSeedTrustPolicy}). Kept across
+         * stop()→start() like the anchor it writes: its in-process latch and failure window
+         * are per node, not per seed service. Null when the node has no claim secret.
+         */
+        this.claimTrustPolicy = null;
         this.strandSolicitationService = null;
         /**
          * The service whose formation handler is registered on the control node. Trails
@@ -264,6 +291,13 @@ export class CadreNode {
          * stops conflating control addresses with strand seeding.
          */
         this.strandAddrService = null;
+        /**
+         * Cadre invitation redemption handler (`/sereus/cadre-invite/1.0.0`): a device holding an
+         * invitation dials this machine and proves possession; the handler seats the row and
+         * admits the device against this node's control database. Registered by {@link start}
+         * once that database is up, on every node.
+         */
+        this.cadreInviteHandler = null;
         /**
          * Server-side push-wake fan-out. Constructed by {@link start} only when
          * `config.push` (an injected `PushNotifier` + policy) is present — without it
@@ -359,24 +393,10 @@ export class CadreNode {
         /**
          * Most-recently pushed invite addresses (see {@link setInviteAddresses}).
          * When non-null these take priority over `libp2pNode.getMultiaddrs()` when
-         * minting invites — the host pushes NAT-resolved addresses here so the
-         * control-network node never needs to dial back to the manager.
+         * minting cadre invitations — the host pushes NAT-resolved addresses here so
+         * the control-network node never needs to dial back to the manager.
          */
         this.latestInviteAddresses = null;
-        /**
-         * Epoch ms until which the control-network inbound gate admits
-         * not-yet-authorized peers (see {@link admitInboundControlConnection} /
-         * {@link openEnrollmentWindow}). 0 = no window open. Opened automatically by
-         * {@link createInvite}; deliberately NOT reset on stop() — a stop/start cycle
-         * inside an outstanding invite's validity must not strand the invitee.
-         *
-         * NOTE: in-memory only, so a PROCESS restart mid-invite closes the door until
-         * the owner re-mints or the invitee is authorized. Fine while invites are
-         * short-lived and redeemed promptly; if long-lived invites or restart-prone
-         * hosts become normal, persist the window (or derive it from the issued-invite
-         * records `SeedBootstrapService` already keeps).
-         */
-        this.enrollmentWindowUntil = 0;
         /**
          * Lazily-parsed PeerIds of `controlNetwork.bootstrapNodes` (see
          * {@link getBootstrapPeerIds}) — infrastructure the inbound gate always admits.
@@ -525,7 +545,7 @@ export class CadreNode {
         this.pendingMembershipInvites = new Map();
         /**
          * Invite keys of the membership invitations this process has staged, by
-         * {@link adoptFormationMembershipInvite} or from a `joined` `PendingJoin` row
+         * {@link adoptFormationMembershipInvite} or from a `JoinSuccess` row
          * ({@link stageMembershipInvitesFromPendingJoins}), so one the reconciler has settled is not
          * staged again by the next pending-join pass. Same lifetime as
          * {@link pendingMembershipInvites}: a restarted process stages each live one once more, and the
@@ -870,11 +890,19 @@ export class CadreNode {
             // libp2p/network bring-up, so a misconfiguration or an access-denied secure
             // store fails closed before a node is created.
             await this.resolveIdentityKey();
+            // A conflicting `claim` is refused BEFORE the anchor is built: the store below
+            // writes the config pins, and on a persistent anchor a pin written ahead of
+            // this refusal would survive the failed start and mark the node claimed by it.
+            this.validateClaimConfig();
             // Bring up the node-local trusted-owner anchor (and seed config pins)
             // before any network bring-up: a mis-scoped injected store fails closed
             // here, and out-of-band pins are anchored before the first seed/peer
             // interaction could consult them.
             await this.initializeTrustedOwnerStore();
+            // A node started with a claim secret gets its trust policy here, over the anchor
+            // just built; a malformed secret fails closed before any network bring-up, like
+            // a mis-scoped anchor above.
+            this.initializeClaimPolicy();
             // Bring up the node-local cold-start bootstrap-peer store alongside the
             // anchor, and for the same two reasons: a mis-scoped injected store fails
             // closed before any network bring-up, and the retained dial targets are
@@ -915,6 +943,9 @@ export class CadreNode {
             this.controlNode = await this.createControlNode();
             timing('[start] createControlNode: %dms', Math.round(performance.now() - t0));
             log('Control node started with ID: %s', this.controlNode.peerId.toString());
+            // Before anything else can happen on the node: the quiet period above holds every
+            // connection off, so no stream can arrive ahead of the guard.
+            this.installControlProtocolGuard(this.controlNode);
             // Extract coordinatedRepo from the node (attached by createLibp2pNode)
             const coordinatedRepo = this.controlNode.coordinatedRepo;
             if (!coordinatedRepo) {
@@ -976,25 +1007,23 @@ export class CadreNode {
             // Start hibernation manager
             this.hibernationManager.start();
             // Register the control-network push-wake receiver: a same-cadre peer can
-            // signal us to bring a hibernating strand online. Gated on AUTHORIZED
-            // membership (not the addressable surface); the wake routes through the same
-            // path as a local wake.
+            // signal us to bring a hibernating strand online. The protocol guard admits
+            // only AUTHORIZED members (not the addressable surface); the wake routes
+            // through the same path as a local wake.
             this.strandWakeService = new StrandWakeService({
-                isMember: (peerId) => this.isAuthorizedMember(peerId),
                 getStrand: (strandId) => this.strandManager.getInstance(strandId),
                 wake: (strandId) => this.wakeStrand(strandId),
             });
             await this.strandWakeService.initialize(this.controlNode);
             // Register the control-network strand-address responder: a same-cadre peer
             // resolving a strand's bootstrap seed asks us for our live strand-network
-            // multiaddrs (its CadrePeer row only knows our *control* address). Gated on
-            // AUTHORIZED membership; answers only for strands we are actively meshing.
-            // The same RPC doubles as the delegate-announce channel: a member's request
-            // may carry the derived peerId its strand node runs as, and we record an
-            // admission grant so our connection gate (and thus our relay server, when
-            // enabled) admits it — see delegate-admission.ts.
+            // multiaddrs (its CadrePeer row only knows our *control* address). The
+            // protocol guard admits only AUTHORIZED members; answers only for strands we
+            // are actively meshing. The same RPC doubles as the delegate-announce channel:
+            // a member's request may carry the derived peerId its strand node runs as, and
+            // we record an admission grant so our connection gate (and thus our relay
+            // server, when enabled) admits it — see delegate-admission.ts.
             this.strandAddrService = new StrandAddrService({
-                isMember: (peerId) => this.isAuthorizedMember(peerId),
                 getStrandMultiaddrs: (strandId) => this.getStrandMultiaddrs(strandId),
                 onDelegateAnnounce: (announcer, strandId, delegate) => this.grantDelegateAdmission(announcer, strandId, delegate),
             });
@@ -1004,6 +1033,22 @@ export class CadreNode {
             // check a token for an inviter that is offline. After the control database is up,
             // so the responder never reads a database that cannot answer yet.
             await this.installDefaultFormationResponder();
+            // Answer cadre invitation redemptions from now on: a device holding an invitation
+            // dials any member machine, this one included, and proves possession in-protocol.
+            // After the control database is up, since the handler seats and redeems against it.
+            this.cadreInviteHandler = new CadreInviteHandler({
+                partyId: this.config.controlNetwork.partyId,
+                store: this.controlDatabase,
+                catchUpDevice: (peerId) => this.catchUpRedeemingDevice(peerId),
+            });
+            await this.cadreInviteHandler.register(this.controlNode);
+            // A node waiting to be claimed listens for its claim seed from the start: nobody
+            // else will turn the listener on, and a node no seed can reach cannot be claimed.
+            // Before `control:connected`, so an embedder that reports "awaiting claim" on that
+            // event is already reachable on `/sereus/seed/1.0.0`.
+            if (this.config.claim) {
+                await this.enableSeedListener();
+            }
             // Server-side push-wake fan-out: only when push is configured.
             if (this.config.push) {
                 this.pushFanoutService = this.buildPushFanout(this.config.push);
@@ -1158,15 +1203,22 @@ export class CadreNode {
     }
     /**
      * Construct (or adopt) the node-local trusted-owner anchor and seed the
-     * out-of-band pinned keys from `config.trustedOwners`. The store is NEVER
-     * sourced from the replicated control DB — its entries come only from
-     * genesis self-trust ({@link initializeSeedBootstrap}), config pins (here),
-     * or runtime enrollment pins ({@link trustOwnerKeys}).
+     * out-of-band pinned keys from `config.trustedOwners`. The anchor's BASE comes
+     * only from out of band — genesis self-trust ({@link initializeSeedBootstrap}),
+     * config pins (here), runtime enrollment pins ({@link trustOwnerKeys}) and a
+     * claim; everything else in it is derived from that base along verifiable
+     * chains through the replicated `OwnerKey` table ({@link syncOwnerAnchor}),
+     * never read from the table directly.
      *
      * Idempotent across stop()→start(): the store instance is kept, and
      * re-seeding config pins is a no-op ({@link TrustedOwnerStore.trust} is
      * idempotent). An injected store scoped to a different party is a
      * configuration error (fail closed before any network bring-up).
+     *
+     * NOTE: a config pin of a key the owners have since REMOVED is re-anchored here at
+     * every start and removed again by the first sync (`refreshMembershipGate('start')`,
+     * fired without await from {@link start}), so such a pin is honoured for at most one
+     * membership refresh per start; dropping the pin from the config ends that.
      */
     async initializeTrustedOwnerStore() {
         const { trustedOwners } = this.config;
@@ -1187,6 +1239,76 @@ export class CadreNode {
             await this.trustedOwnerStore.trust(key, trustedOwners?.pinnedSource ?? 'operator');
         }
     }
+    /**
+     * Refuse a `config.claim` that sits beside another cold-start trust source. A node
+     * has exactly ONE, so `claim` with a non-empty `trustedOwners.pinnedKeys` or a
+     * `seedTrustPolicy` is refused here rather than silently letting one of them win.
+     * Asserted at this seam, not by a type: the embedders build `CadreNodeConfig` as one
+     * object literal with every optional field present, which a discriminated union over
+     * the whole config would not express.
+     *
+     * Runs BEFORE {@link initializeTrustedOwnerStore}, which writes the config pins into
+     * the anchor: on a persistent anchor a pin written ahead of this refusal would outlive
+     * the failed start, and the node, restarted with the pin dropped from its config and
+     * `claim` kept, would read as claimed by that pin and never accept its claimant.
+     */
+    validateClaimConfig() {
+        if (!this.config.claim) {
+            return;
+        }
+        if ((this.config.trustedOwners?.pinnedKeys?.length ?? 0) > 0) {
+            throw new Error('CadreNodeConfig: `claim` and `trustedOwners.pinnedKeys` are both set — a node has one ' +
+                'cold-start trust source; a node waiting to be claimed anchors its claimant, not a pin');
+        }
+        if (this.config.seedTrustPolicy) {
+            throw new Error('CadreNodeConfig: `claim` and `seedTrustPolicy` are both set — a node has one cold-start ' +
+                'trust source; the claim secret supplies the seed trust policy itself');
+        }
+    }
+    /**
+     * Build {@link claimTrustPolicy} from `config.claim`, once per node (a restart keeps
+     * the policy, as {@link initializeTrustedOwnerStore} keeps the anchor it writes).
+     * Runs after the anchor exists and before any network bring-up, so a malformed secret
+     * fails `start()` closed with nothing to tear down; `parseClaimSecret` names the
+     * problem and never echoes the value. The conflicts with the other trust sources are
+     * {@link validateClaimConfig}'s, checked before the anchor is written.
+     */
+    initializeClaimPolicy() {
+        const { claim } = this.config;
+        if (!claim || this.claimTrustPolicy) {
+            return;
+        }
+        // Unreachable in practice: start() builds the store just above. Guarded so the
+        // policy can never be built over a missing anchor and silently claim into nothing.
+        if (!this.trustedOwnerStore) {
+            throw new Error('CadreNode: the trusted-owner anchor must exist before the claim policy is built');
+        }
+        this.claimTrustPolicy = claimSecretTrustPolicy({
+            secret: parseClaimSecret(claim.secret),
+            trustedOwners: this.trustedOwnerStore,
+            recordClaim: claim.record,
+            onClaimed: (accepted) => this.emit('claim:accepted', accepted),
+        });
+        log('Node starts awaiting a claim; start() enables the seed listener once the control node is up');
+    }
+    /**
+     * Is this node waiting to be claimed: started with `config.claim` and owned by nobody
+     * yet (empty anchor)? Read live from the anchor every time, as
+     * {@link admitControlPeerUnconditionally} reads it per stream: the anchor is the one
+     * source of truth for "claimed", and a cached flag would need its own invalidation
+     * from the policy's persist, the rollback and a restart. False on a node with no claim
+     * secret, on a claimed one (restarted with the secret still set or not), and before
+     * {@link start} has built the anchor.
+     *
+     * While true the node admits strangers' CONNECTIONS (the claim seed has to ride one)
+     * and refuses their control-database streams ({@link authorizeInboundControlStream})
+     * and relay reservations ({@link admitControlRelayReservation}): an unclaimed node has
+     * no siblings to replicate from and must not become a public relay while it waits.
+     * cadre-cli reports this on `/status`; `claim:accepted` is the event form.
+     */
+    isAwaitingClaim() {
+        return this.config.claim !== undefined && this.trustedOwnerStore?.all().size === 0;
+    }
     /**
      * Construct (or adopt) the node-local cold-start bootstrap-peer store (see
      * {@link bootstrapPeerStore}). Synchronous: an injected store has already
@@ -1321,15 +1443,16 @@ export class CadreNode {
     }
     /**
      * Persist out-of-band-established owner keys into the node-local anchor —
-     * the runtime enrollment seam: call with `CadreInvite.ownerKeys` when
-     * redeeming an invite (BEFORE the first `applySeed`, so the anchor already
-     * holds the pins when seed trust consults it), or with an operator-supplied
-     * pin. Idempotent. ('genesis' provenance is reserved for the node's own
-     * founding key, seeded internally by {@link initializeSeedBootstrap}.)
+     * the runtime enrollment seam: {@link redeemCadreInvitation} calls it with the
+     * cadre invitation's `ownerKeys` BEFORE dialing a member (so the anchor already
+     * holds the pins when the reply and the rows that follow are judged), and an
+     * embedder calls it with an operator-supplied pin. Idempotent. ('genesis'
+     * provenance is reserved for the node's own founding key, seeded internally by
+     * {@link initializeSeedBootstrap}; 'chain' is written only by {@link syncOwnerAnchor}.)
      *
      * Validates every key's shape before trusting any of them (all-or-nothing):
      * a malformed entry anywhere in `keys` rejects the whole call before a
-     * single key is anchored. For the invite route this means a `CadreInvite`
+     * single key is anchored. For the invitation route this means a bundle
      * carrying one malformed `ownerKeys` entry fails the redemption outright —
      * consistent with the anchor's existing whole-record-or-nothing policy for
      * a corrupt persisted entry (see `trusted-owner-store.ts`'s
@@ -1349,19 +1472,23 @@ export class CadreNode {
         return await createLibp2pNode(this.buildControlNodeOptions());
     }
     /**
-     * The control libp2p node's Optimystic network name — ONE binding for every
-     * derivation from it (`db-p2p` namespaces all of the node's protocol ids as
-     * `/optimystic/<networkName>/...`), so the node options and the block-transfer
-     * protocol prefix the control backfill dials can never drift apart.
-     *
-     * NOTE: the party id goes in UNENCODED here, unlike in `controlStorageScope`. Safe
-     * today because a party id is locally configured rather than replicated in, and both
-     * ends of a connection derive this string identically — an odd party id yields an odd
-     * but consistent protocol id, not a mismatch or an escaped name. If a party id ever
-     * arrives from the network, encode it here as the storage scope key already does.
+     * Refuse non-members on every members-only protocol of the control node, at one seam
+     * (`control-protocol-guard.ts`). Wake and strand-addr are judged by the live
+     * {@link isAuthorizedMember}, bounded by the asker's own attempt deadline at this
+     * node's declared link; everything a control-database read depends on is judged by
+     * the snapshot ({@link authorizeInboundControlStream}).
      */
+    installControlProtocolGuard(controlNode) {
+        installControlProtocolGuard(controlNode, {
+            partyId: this.config.controlNetwork.partyId,
+            isMemberLive: (peerId) => this.isAuthorizedMember(peerId),
+            isMemberSnapshot: (peerId, protocol) => this.authorizeInboundControlStream(peerId, protocol),
+            liveDecisionTimeoutMs: relayedRequestBudgetMs(this.config.network?.linkRoundTripMs),
+        });
+    }
+    /** This node's control network name ({@link controlNetworkName}, the one binding for it). */
     controlNetworkName() {
-        return `control-${this.config.controlNetwork.partyId}`;
+        return controlNetworkName(this.config.controlNetwork.partyId);
     }
     /**
      * Arm the CONTROL network's peer-join block catch-up: push every block in the
@@ -1388,6 +1515,8 @@ export class CadreNode {
      * reconnect re-runs identify), and — because the production join order is
      * connect-then-authorize — on every committed membership change via
      * {@link refreshAuthorizedControlPeers}'s `scheduleConnectedPeers()` call.
+     * The one non-member the gate admits is a device whose invitation
+     * redemption this member is admitting ({@link catchUpRedeemingDevice}).
      *
      * No-ops (logged) when the embedder configured no control storage or the
      * node exposes no key network — the backfill would have nothing to read or
@@ -1417,7 +1546,7 @@ export class CadreNode {
             // under — derived from the same networkName binding the node options
             // used, never re-spelled here.
             protocolPrefix: `/optimystic/${networkName}`,
-            authorizePeer: (peerId) => this.isAuthorizedMember(peerId)
+            authorizePeer: async (peerId) => this.admittingDevices.has(peerId) || await this.isAuthorizedMember(peerId)
         }, {
             // A shorter settle window than the strand default (1000 ms): the control
             // store is small (a party's membership — dozens of blocks), a re-push is
@@ -1443,6 +1572,39 @@ export class CadreNode {
         });
         this.controlBackfill.start();
     }
+    /**
+     * Push this member's control store to a device whose invitation redemption has verified,
+     * and wait for the push, before the redemption seats the invitation's row and writes the
+     * device's rows (the handler's `catchUpDevice`; `CadreInviteHandler.catchUpDeviceIfLive`
+     * says why those writes need it).
+     * The device is admitted at the backfill's gate for the length of the push only.
+     *
+     * Through {@link PeerJoinBackfill.forceCatchUpPeer}, not `catchUpPeer`: the device's own
+     * `peer:identify` scheduled a run a moment earlier, which was denied if it passed the gate
+     * before the device was added here, and `catchUpPeer` would answer that run's in-flight
+     * status with an empty result.
+     */
+    async catchUpRedeemingDevice(peerId) {
+        const backfill = this.controlBackfill;
+        if (!backfill) {
+            log('No control backfill on this node; device %s is not caught up before its admission', peerId);
+            return;
+        }
+        this.admittingDevices.set(peerId, (this.admittingDevices.get(peerId) ?? 0) + 1);
+        try {
+            const result = await backfill.forceCatchUpPeer(peerIdFromString(peerId));
+            log('Device %s caught up before its admission: offered=%d accepted=%d rejected=%d', peerId, result.offered, result.accepted, result.rejected.length);
+        }
+        finally {
+            const remaining = (this.admittingDevices.get(peerId) ?? 1) - 1;
+            if (remaining > 0) {
+                this.admittingDevices.set(peerId, remaining);
+            }
+            else {
+                this.admittingDevices.delete(peerId);
+            }
+        }
+    }
     /**
      * The control database's cache-wrapped raw storage, resolved from
      * `config.storage.provider` on first use and then held in {@link controlStorage}
@@ -1615,20 +1777,25 @@ export class CadreNode {
             // `announceAddrs` replaces the advertised set (see warnIfAnnounceAddrsDiscardRelay).
             ...resolveAnnounceAddrs(network),
             // The CONTROL node composes the membership admission gate onto any
-            // caller-supplied gater (deny from either wins on the inbound-encrypted
-            // and relay-reservation hooks; all other hooks pass through). Strand
-            // cohort nodes keep the raw configured gater (see
+            // caller-supplied gater (a deny from the caller's wins on every composed
+            // hook; the membership policy refuses reservations, never connections,
+            // and puts an unplaced peer's connection on the provisional deadline,
+            // derived from THIS node's declared link because this node decides).
+            // Strand cohort nodes keep the raw configured gater (see
             // strand-instance-manager.ts) — their peers are legitimately
             // cross-party, so cadre membership must not gate them.
             connectionGater: createMembershipConnectionGater({
                 admitInbound: (remotePeerId) => this.admitInboundControlConnection(remotePeerId),
                 admitRelayReservation: (remotePeerId) => this.admitControlRelayReservation(remotePeerId),
                 bringUpInFlight: () => this.controlBringUpInFlight
-            }, network?.connectionGater, ADMISSION_DECISION_TIMEOUT_MS, relayAdmissionReserveDeadlineMs(network?.linkRoundTripMs)),
+            }, network?.connectionGater, ADMISSION_DECISION_TIMEOUT_MS, relayedRequestBudgetMs(network?.linkRoundTripMs)),
             // Fail-closed per-stream authorization for the four Optimystic control-DB
             // protocols — the members-only layer the connection gater's stranger
             // carve-outs cannot express (see authorizeInboundControlStream). Control
-            // node only: strand cohort nodes serve cross-party peers.
+            // node only: strand cohort nodes serve cross-party peers. The protocol guard
+            // (installControlProtocolGuard) checks these four with this same predicate
+            // first; Optimystic's own check is kept because it is a working, supported
+            // upstream defence, not a second policy.
             authorizeInboundStream: (remotePeerId, protocol) => this.authorizeInboundControlStream(remotePeerId, protocol)
         };
         return nodeOptions;
@@ -1647,86 +1814,85 @@ export class CadreNode {
         log('Relay server on: applyDefaultLimit=%s maxReservations=%d reservationTtl=%dms unauthorizedCap=%d', applyDefaultLimit, maxReservations, reservationTtl, this.unauthorizedRelayReservations.cap);
     }
     /**
-     * Decide whether an inbound CONTROL-network connection from `remotePeerId`
-     * should be admitted — the policy behind the connection gater wired in
-     * {@link createControlNode}. Deny only on a positive "unauthorized outsider
-     * while no stranger path is open" determination; everything ambiguous admits
-     * and defers to the fail-closed per-stream gates (see
+     * Decide how an inbound CONTROL-network connection from `remotePeerId` is
+     * admitted — the policy behind the connection gater wired in
+     * {@link createControlNode}. Every connection is admitted; the answer decides
+     * only whether it carries the provisional deadline (see
      * `membership-connection-gater.ts` for the layer's rationale and the
-     * stranger-open protocol allowlist).
+     * stranger-open protocol allowlist). Asked once when the connection arrives
+     * and again at a provisional connection's deadline.
      *
-     * Returns `'admit'` when ANY of:
+     * Returns `'admit'` (no deadline) when ANY of:
      *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
      *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
      *     configured bootstrap/relay infrastructure);
-     *  2. an enrollment window is open ({@link openEnrollmentWindow}, opened by
-     *     {@link createInvite}) — the invitee dials in before it is authorized;
-     *  3. the peer holds a live DELEGATE ADMISSION GRANT — an authorized member
+     *  2. the peer holds a live DELEGATE ADMISSION GRANT — an authorized member
      *     announced it (over the strand-addr RPC) as the transport peerId of its
      *     own strand node, so a NAT'd member's strand node can hold a
      *     circuit-relay reservation here (see `delegate-admission.ts`).
      *     Connection only: the per-stream gate below never honors a grant;
-     *  4. the authorized-member set is empty — cold start: the rows that would
+     *  3. the authorized-member set is empty — cold start: the rows that would
      *     authorize anyone arrive by replication over these very connections;
-     *  5. the peer IS an authorized member; or
-     *  6. an open invitation is OUTSTANDING — at least one unexpired,
+     *  4. the peer IS an authorized member; or
+     *  5. an open invitation is OUTSTANDING — at least one unexpired,
      *     not-fully-consumed invitation this node minted or persisted (see
      *     `StrandSolicitationService.hasOutstandingInvitation`). A formation
      *     initiator is another party's peer by design and its token is only
      *     checkable inside the protocol, so the gate asks the coarser question
      *     "does this node expect a stranger at all?". REGISTERING the responder
-     *     does not suspend stranger denial: every node registers one at
-     *     {@link start}, and registering mints no invitation.
+     *     does not count: every node registers one at {@link start}, and
+     *     registering mints no invitation; or
+     *  6. a LIVE cadre invitation exists — a `CadreInvite` row this node holds
+     *     that is not withdrawn, unexpired, has uses left and whose issuer is
+     *     still an owner (`ControlDatabase.hasLiveCadreInvite`). The device that
+     *     redeems it is a stranger until the redemption writes its row, and its
+     *     proof of possession is only checkable inside `/sereus/cadre-invite/1.0.0`;
+     *     same reasoning as check 5, and the same expectation-of-a-stranger key.
      *
      * Ordering is semantically free (the checks are OR'd) but decides who pays:
-     * checks 1-3 are in-memory, 4/5 share one control-DB read, and only a peer
-     * already on the deny path reaches check 6's invitation lookup.
+     * checks 1-2 are in-memory, 3/4 share one control-DB read, and only a peer
+     * that is otherwise headed for a provisional admission reaches check 5's and
+     * 6's invitation lookups.
      *
-     * Caveats of check 6, both self-healing:
+     * Caveats of check 5:
      *  - the in-memory mint registry dies with the process, so after a restart
      *    only invitations persisted as `FormationInvite` rows still hold the
-     *    exemption open (re-mint otherwise — same story as the enrollment window);
+     *    window open (re-mint otherwise);
      *  - a peer holding a token whose `FormationInvite` row has not replicated to
-     *    this node yet is denied even though the formation handler would have
-     *    accepted it, exactly like the unreplicated-membership-row case below.
-     *
-     * When every check falls through, the verdict depends on whether this node
-     * runs the circuit-relay server ({@link relayServer}): without one,
-     * `'deny'`; with one, `'admit-for-relay'` — a circuit-relay reservation is
-     * established by the reserving peer DIALING the relay, so a connection deny
-     * here kills the reservation, and that deny is NOT self-healing: an outbound
-     * reconcile re-dial re-establishes a data link, but no outbound dial can
-     * grant the remote peer a reservation, and a relay-only peer has no address
-     * of its own to dial back — the reservation IS its address. The gater admits
-     * such a connection, decides the reservation via
-     * {@link admitControlRelayReservation}, and drops the connection if no
-     * reservation is admitted in time (see `membership-connection-gater.ts` →
-     * "The relay-reservation seam").
-     *
-     * NOTE: check 4/5 runs a control-DB read per inbound connection
+     *    this node yet is admitted only provisionally, so its connection is closed
+     *    at the deadline unless the row has landed by then.
+     *
+     * When every check falls through: `'admit-provisionally'`, on every node,
+     * relay server or not. The gate sees only a peer id, so it cannot tell an
+     * outsider from a device whose invitation row this node has not received yet
+     * (it redeems here by seating the row from its bundle, after which check 6
+     * admits) or from a sibling whose membership row is still replicating (check 4
+     * admits once it lands; if it has not landed by the deadline, the connection
+     * is closed and either side's next reconcile dial re-forms it, since outbound
+     * dials are never gated). The protocol guard refuses all of them every
+     * members-only protocol meanwhile. A circuit-relay reservation admitted by
+     * {@link admitControlRelayReservation} disarms the deadline (see
+     * `membership-connection-gater.ts` → "The relay-reservation seam").
+     *
+     * NOTE: check 3/4 runs a control-DB read per inbound connection
      * (`listAuthorizedMembers`); connections are rare and cadres small, and this
      * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
      * read is safe here — unlike the per-stream gate, which must consult the
      * materialized {@link authorizedControlPeers} snapshot instead.
-     * NOTE: check 6 adds a second control read (`hasOutstandingFormationInvite`) for a
-     * stranger with no locally minted invitation in play, on every node now that every
-     * node runs the responder — a relay-enabled storage node included. If stranger
-     * connections to such a node ever arrive fast enough for that read to show, cache
-     * the answer for a few seconds.
-     * NOTE: on a relay-DISABLED node, a sibling whose membership row has not yet
-     * replicated here is denied until the row converges (typically via the
-     * owner); either side's next outbound reconcile dial (outbound is never
-     * gated) re-establishes the DATA link — self-healing for data, visible as a
-     * transient deny. That self-healing story never covered a reservation, which
-     * is exactly why the relay-enabled path above exists.
+     * NOTE: checks 5 and 6 add two more control reads (`hasOutstandingFormationInvite`,
+     * `hasLiveCadreInvite`) for a stranger with no locally minted invitation in play, on
+     * every node, and a provisional connection's deadline runs the whole decision once
+     * more. If stranger connections ever arrive fast enough for those reads — on arrival
+     * or at the deadline — to show, cache the answers for a few seconds.
      */
     async admitInboundControlConnection(remotePeerId) {
+        // NOTE: a node waiting to be claimed (isAwaitingClaim) lands on this empty-anchor
+        // admission too, so a stranger can hold an idle, mute connection to it for as long
+        // as it waits on a public address; if that ever shows up as a resource problem, put
+        // unclaimed-node admissions on the provisional deadline too.
         if (this.admitControlPeerUnconditionally(remotePeerId)) {
             return 'admit';
         }
-        if (Date.now() < this.enrollmentWindowUntil) {
-            return 'admit';
-        }
         if (this.delegateAdmission.has(remotePeerId)) {
             return 'admit';
         }
@@ -1741,17 +1907,16 @@ export class CadreNode {
             if (await this.strandSolicitationService?.hasOutstandingInvitation()) {
                 return 'admit';
             }
+            if (await this.controlDatabase?.hasLiveCadreInvite()) {
+                return 'admit';
+            }
         }
         catch (error) {
             log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
             return 'admit';
         }
-        if (this.relayServer.enabled) {
-            log('admitInboundControlConnection: admitting %s FOR RELAY ONLY — not an authorized member and no enrollment path open; the gater drops the connection unless a reservation is admitted', remotePeerId);
-            return 'admit-for-relay';
-        }
-        log('admitInboundControlConnection: DENYING inbound from %s — not an authorized member and no enrollment path open', remotePeerId);
-        return 'deny';
+        log('admitInboundControlConnection: %s is not an authorized member and no stranger window is open — admitting provisionally', remotePeerId);
+        return 'admit-provisionally';
     }
     /**
      * Should `remotePeerId` be granted a circuit-relay reservation slot on this
@@ -1760,7 +1925,13 @@ export class CadreNode {
      * "The relay-reservation seam"); the circuit-relay server consults it per
      * RESERVE request, so it is never called on a node whose relay server is off.
      *
-     * Admits when ANY of:
+     * Refuses everyone, ahead of every admission below, while this node is waiting to be
+     * claimed ({@link isAwaitingClaim}): a storage-profile node runs the relay server by
+     * default, and an unclaimed node on a public address must not become anyone's relay.
+     * The empty-anchor admission in check 1 exists for a node that will be enrolled by
+     * its siblings, which an unclaimed node has none of.
+     *
+     * Otherwise admits when ANY of:
      *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
      *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
      *     configured bootstrap/relay infrastructure);
@@ -1780,14 +1951,18 @@ export class CadreNode {
      * that boots, reserves, and only then has its row replicate here would
      * otherwise keep that slot spent for the rest of the entry's TTL.
      *
-     * The connection gate's stranger carve-outs (an open enrollment window, an
-     * outstanding formation invitation) deliberately do NOT extend here: they
-     * exist so a stranger's SEED or FORMATION stream can ride a connection, and
-     * neither needs relay capacity. A genuine invitee that does need a relay slot
-     * takes one from the budget like any other unplaced peer, so an open window
-     * never becomes an unbounded grant of this node's forwarding capacity.
+     * The connection gate's stranger carve-outs (an outstanding formation
+     * invitation, a live cadre invitation) deliberately do NOT extend here: they
+     * exist so a stranger's FORMATION or CADRE-INVITE stream can ride a connection,
+     * and neither needs relay capacity. A genuine invitee that does need a relay
+     * slot takes one from the budget like any other unplaced peer, so a live
+     * invitation never becomes an unbounded grant of this node's forwarding capacity.
      */
     async admitControlRelayReservation(remotePeerId) {
+        if (this.isAwaitingClaim()) {
+            log('admitControlRelayReservation: REFUSING %s — this node is unclaimed and relays for nobody until it is', remotePeerId);
+            return false;
+        }
         if (this.admitControlPeerUnconditionally(remotePeerId)) {
             return this.admitReservationUncounted(remotePeerId);
         }
@@ -1807,24 +1982,13 @@ export class CadreNode {
         this.unauthorizedRelayReservations.release(remotePeerId);
         return true;
     }
-    /**
-     * Hold the control-network inbound gate open for not-yet-authorized peers
-     * until `untilEpochMs` (extends, never shrinks, an already-open window).
-     * {@link createInvite} calls this automatically; a host running an
-     * out-of-band enrollment flow (e.g. accepting a phone whose invite this node
-     * never minted) can open it explicitly before the stranger dials in.
-     */
-    openEnrollmentWindow(untilEpochMs) {
-        this.enrollmentWindowUntil = Math.max(this.enrollmentWindowUntil, untilEpochMs);
-        log('Enrollment window open until %d', this.enrollmentWindowUntil);
-    }
     /**
      * Record (or refresh) a delegate admission grant: `delegatePeerId` is the
      * transport peerId of `announcerPeerId`'s strand-`strandId` node, admitted
      * at the CONNECTION and RESERVATION levels (all a circuit-relay reservation
      * needs, without spending the unauthorized-reservation budget) for
-     * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder after its
-     * authorized-membership gate has passed; public so tests can drive the
+     * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder, which the
+     * protocol guard admits only authorized members to; public so tests can drive the
      * admission policy without a full strand launch. A re-announce for the same
      * (announcer, strand) REPLACES the previous delegate rather than
      * accumulating. Never honored by {@link authorizeInboundControlStream}.
@@ -1863,25 +2027,35 @@ export class CadreNode {
         return this.getBootstrapPeerIds().has(remotePeerId);
     }
     /**
-     * Per-stream authorization for the four Optimystic control-DB protocols
-     * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`),
-     * wired as `authorizeInboundStream` in {@link createControlNode} — the
-     * fail-closed layer behind the fail-open connection gater. Control node
-     * ONLY: strand cohort nodes legitimately serve cross-party peers.
+     * Per-stream authorization for the protocol guard's `members-snapshot` class
+     * (`control-protocol-guard.ts`): the four Optimystic control-DB protocols
+     * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`), FRET's
+     * five, and any protocol nobody classed. Also wired as Optimystic's
+     * `authorizeInboundStream` in {@link createControlNode} for the four DB
+     * protocols. The fail-closed layer behind the fail-open connection gater.
+     * Control node ONLY: strand cohort nodes legitimately serve cross-party peers.
      *
      * The STRICT SUBSET of {@link admitInboundControlConnection}: the same
      * "no basis to judge" admissions (shared via
      * {@link admitControlPeerUnconditionally}), minus the stranger carve-outs
-     * (enrollment window, outstanding open invitation, delegate admission
-     * grant). The first two exist so a stranger can reach `/sereus/seed/1.0.0`
-     * and `/sereus/formation/1.0.0` — neither is gated here, and admitting a
-     * stranger to `repo` during an enrollment window is exactly the hole this
+     * (outstanding open invitation, live cadre invitation, delegate admission
+     * grant). The first two exist so a stranger can reach `/sereus/formation/1.0.0`
+     * and `/sereus/cadre-invite/1.0.0` — neither is gated here, and admitting a
+     * stranger to `repo` while an invitation is live is exactly the hole this
      * gate closes. A DELEGATE-admitted connection (a member's strand node
      * holding a circuit-relay reservation, see `delegate-admission.ts`) is
      * likewise exactly a case this gate must still refuse: the delegate gets
      * the connection and never the control DB.
      *
-     * Admits when ANY of:
+     * Refuses everyone, ahead of every admission below, while this node is waiting to be
+     * claimed ({@link isAwaitingClaim}). The empty-anchor and empty-snapshot admissions
+     * exist so a brand-new node can take replication from the siblings that will
+     * authorize it; an unclaimed node has no siblings yet, and the rows that will
+     * authorize anyone arrive only after the claim, over the owner's streams that the
+     * same two admissions then let in. Configured bootstrap infra is refused too: a
+     * relay opens no control-database stream.
+     *
+     * Otherwise admits when ANY of:
      *  1. a shared-baseline check admits (not running / no DB, empty anchor,
      *     configured bootstrap infra);
      *  2. the materialized authorized set is empty — cold start, before the
@@ -1904,6 +2078,10 @@ export class CadreNode {
      * ever becomes a supported deployment, this gate needs a key-based admission.
      */
     authorizeInboundControlStream(remotePeerId, protocol) {
+        if (this.isAwaitingClaim()) {
+            log('authorizeInboundControlStream: DENYING %s on %s — this node is unclaimed and replicates with nobody until it is', remotePeerId, protocol);
+            return false;
+        }
         if (this.admitControlPeerUnconditionally(remotePeerId)) {
             return true;
         }
@@ -1931,13 +2109,19 @@ export class CadreNode {
      * read here would sleep its backoff holding the lock and stall every other local
      * writer. Nothing is lost — this refresh already keeps the previous snapshot on
      * failure and is re-driven by the next membership write and by the timed reconcile.
+     *
+     * The trusted-owner anchor sync ({@link syncOwnerAnchor}) runs FIRST, so the snapshot
+     * built here judges `CadrePeer` rows against the anchor as the `OwnerKey` table now
+     * has it. The invitation chain both reads may need is loaded at most once per refresh.
      */
     async refreshAuthorizedControlPeers(reason) {
         if (!this._running || !this.controlDatabase) {
             return;
         }
         try {
-            const members = await this.listAuthorizedMembers(false);
+            const loadChain = this.invitationChainSource(this.controlDatabase, false);
+            await this.syncOwnerAnchor(reason, false, loadChain);
+            const members = await this.collectAuthorizedMembers(this.controlDatabase, false, loadChain);
             this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
             log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
             // Remember the party's size for the NEXT launch's control-node repair yardstick
@@ -2159,6 +2343,11 @@ export class CadreNode {
                 }
                 catch (error) {
                     // Background task — a failed publish must not crash the node.
+                    // NOTE: a restarted machine whose own CadrePeer row replicates in while this update
+                    // runs fails here with ConcurrentModificationError (seen on the owner's restart in
+                    // every traced run of cadre-invite-any-member), leaving its record unrefreshed until
+                    // the next heartbeat. If a restarted machine's changed addresses must publish sooner,
+                    // retry once here.
                     log('Self-registration failed: %o', error);
                 }
                 // Wire the ongoing refresh + control-cohort reconcile cadence, then run
@@ -2227,7 +2416,9 @@ export class CadreNode {
         const addrs = await this.collectSelfAddrs();
         const existing = await this.controlDatabase.queryPeerRecord(peerId);
         if (!existing) {
-            if (!this.seedBootstrapService) {
+            // A listener-only service (`enableSeedListener`, a claim node's) holds no owner key and
+            // cannot sign the insert, so it is "no owner service" here too.
+            if (!this.seedBootstrapService?.canAuthorize()) {
                 // "No row" also covers "revoked": queryPeerRecord reads a row whose StampId is
                 // retired in Revocation as absent, so a removed node lands here every heartbeat
                 // and stops refreshing its own record — correct, but say so, or the message reads
@@ -2362,7 +2553,7 @@ export class CadreNode {
      */
     signSelfRecord(peerId, signingKey, addrs, existing) {
         const updatedAt = Math.max(Date.now(), (existing?.updatedAt ?? 0) + 1);
-        return signPeerRecord({ peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt }, signingKey.privateKeyB64);
+        return signPeerRecord(this.partyId, { peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt }, signingKey.privateKeyB64);
     }
     /**
      * The ed25519 keypair (base64url) the node signs its own record with — the key
@@ -2437,6 +2628,27 @@ export class CadreNode {
         }
         return ed25519KeyPairFromLibp2p(this.identityKey);
     }
+    /**
+     * Publish this node's own address record from the reconcile pass, for a CLAIMED node that
+     * has not published one this session. Its owner writes its `CadrePeer` row only after the
+     * claim is accepted (`claimNode`), so the row reaches this node by replication, after the
+     * boot-time publish and the first-growth drain have both found nothing to publish; without
+     * this the record would wait for the heartbeat ({@link startRecordRefresh}), and the cadre
+     * could not resolve the node's addresses until then. The reconcile pass is where replicated
+     * membership is picked up, so each pass tries until the first publish lands. A try before
+     * the row has arrived is a `skipped` publish: one `CadrePeer` read. A claimed node later
+     * removed from its cadre never publishes again, so it pays that read on every pass.
+     */
+    async publishSelfRecordOnceClaimed() {
+        if (!this.config.claim || this.isAwaitingClaim() || this.lastSelfRecordPublishAt !== null) {
+            return;
+        }
+        const outcome = await this.registerSelf().catch((error) => {
+            log('reconcileControlCohort: claimed-node self-record publish failed (continuing): %o', error);
+            return 'skipped';
+        });
+        log('reconcileControlCohort: claimed node self-record publish: %s', outcome);
+    }
     /**
      * Collect this node's current dialable addresses for publication, signaling
      * (`/p2p-circuit`) first. Prefers the best invite/NAT-resolved set and folds
@@ -2489,12 +2701,14 @@ export class CadreNode {
         // `/p2p-circuit` address the boot-time publish could not carry). Harmless
         // where a late-authorized node's addresses keep churning (NAT/relay rotation
         // fire the event anyway), and invisible while parties authorize members before
-        // they boot. If late enrollment becomes the normal path — an invited phone is
-        // exactly that — republish on the membership-change seam that already exists
-        // (`ControlDatabase.setMembershipChangeListener`) rather than lengthening this
-        // list of triggers. Measured while writing
-        // `relay-only-control-addr.integration.ts` case 4, which drives `registerSelf()`
-        // explicitly because neither trigger is dependable there.
+        // they boot. A claimed node is always authorized after it boots, and the reconcile
+        // pass publishes for it ({@link publishSelfRecordOnceClaimed}). If late enrollment
+        // becomes the normal path for other nodes too — an invited phone is exactly that —
+        // drop that method's claim condition rather than lengthening this list of triggers:
+        // the membership-change seam (`ControlDatabase.setMembershipChangeListener`) fires
+        // on LOCAL commits only, and the row a late-authorized node waits for is written
+        // elsewhere. Measured while writing `relay-only-control-addr.integration.ts` case 4,
+        // which drives `registerSelf()` explicitly because neither trigger is dependable there.
         this.recordRefreshTimer = setInterval(() => republish('heartbeat'), DEFAULT_PEER_RECORD_HEARTBEAT_MS);
         this.recordRefreshTimer?.unref?.();
         const reconcileMs = this.config.network?.controlCohort?.reconcileMs ?? DEFAULT_CONTROL_COHORT_RECONCILE_MS;
@@ -2596,7 +2810,7 @@ export class CadreNode {
             return null;
         }
         // Self-signature over (peerId, addrs, updatedAt).
-        if (!verifyPeerRecordSignature(record)) {
+        if (!verifyPeerRecordSignature(this.partyId, record)) {
             // Field detail distinguishes "holding the owner-vouch revision (Sig null,
             // no addrs — a not-yet-self-published row)" from a genuinely corrupt or
             // mixed-revision row. Sig/addrs are public replicated data.
@@ -2781,6 +2995,10 @@ export class CadreNode {
         if (!this._running || !this.controlNode || !this.controlDatabase) {
             return { dialed: [] };
         }
+        await this.publishSelfRecordOnceClaimed();
+        if (!this._running || !this.controlNode || !this.controlDatabase) {
+            return { dialed: [] };
+        }
         // Refresh relay delegate grants BEFORE the sibling enumeration below: a
         // solo cadre with a party relay has no siblings to dial but must still keep
         // its running strands' grants alive (a dropped relay connection re-dials
@@ -3064,8 +3282,7 @@ export class CadreNode {
      * addresses ({@link dialPeerAddrs}): the reconcile pass's steady-state sibling
      * ({@link dialControlSibling}) and cold-start bootstrap peer
      * ({@link dialBootstrapPeer}) dials, and — handed to every
-     * {@link SeedBootstrapService} this node builds — `applySeed`'s owner dials and
-     * `dialInvite`.
+     * {@link SeedBootstrapService} this node builds — `applySeed`'s owner dials.
      *
      * See `peer-dial.ts`'s `DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS` for why a peer's dial is
      * bounded as a whole, and `DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS` for why each
@@ -3472,7 +3689,7 @@ export class CadreNode {
             return;
         }
         this.pendingRevocations.set(revocation.stampId, revocation);
-        log('%s delete of %s committed while alone (0 control connections); Revocation tombstone ' +
+        log('%s tombstone for %s committed while alone (0 control connections); Revocation tombstone ' +
             '(stamp %s) queued for re-issue on cohort growth', revocation.tableName, revocation.rowKey, revocation.stampId);
     }
     /**
@@ -3539,7 +3756,7 @@ export class CadreNode {
         }
         // 4. In-session pending owner authorize writes.
         await this.drainPendingPeerWrites();
-        // 5. `PendingJoin` rows this process wrote while alone. Their tombstones went out in step 1.
+        // 5. Pending joins this process wrote while alone. Their tombstones went out in step 1.
         await this.pendingJoinRunner?.reissueWritesMadeAlone();
     }
     /**
@@ -3625,6 +3842,12 @@ export class CadreNode {
             }
         }
         catch (error) {
+            // NOTE: a device whose owner key has been removed keeps running this drain (and the
+            // membership re-touches of reissuePendingPeerWrites / reissueAuthoredMembershipRows)
+            // on every growth edge, and once its own tombstone has reached it every attempt
+            // fails the schema's live-owner clause and lands here. Noise, not harm; a node that
+            // learns it has been revoked shutting itself down belongs to the device-removal plan
+            // ticket (remove-a-device-or-app-from-a-cadre).
             log('drain: revocation re-issue failed; leaving queued for next growth: %o', error);
         }
     }
@@ -3847,7 +4070,7 @@ export class CadreNode {
         const existing = await this.controlDatabase.queryDeviceToken(peerId);
         // Strictly increase UpdatedAt even on a same-millisecond re-publish (rotation).
         const updatedAt = Math.max(Date.now(), (existing?.updatedAt ?? 0) + 1);
-        const record = signDeviceTokenRecord({ peerId, platform, token, updatedAt }, signingKey.privateKeyB64);
+        const record = signDeviceTokenRecord(this.partyId, { peerId, platform, token, updatedAt }, signingKey.privateKeyB64);
         if (existing) {
             await this.controlDatabase.updateSelfDeviceToken(record);
             if (this.committedAlone())
@@ -3935,7 +4158,7 @@ export class CadreNode {
         }
         // Self-signature over (peerId, platform, token, updatedAt), verified against the
         // CadrePeer.PublicKey bound to this peerId.
-        if (!verifyDeviceTokenSignature(record, peerRecord.publicKey)) {
+        if (!verifyDeviceTokenSignature(this.partyId, record, peerRecord.publicKey)) {
             log('resolveDeviceToken: signature verification failed for %s', peerId);
             return null;
         }
@@ -4177,6 +4400,11 @@ export class CadreNode {
             await this.strandAddrService.shutdown();
             this.strandAddrService = null;
         }
+        // Unregister the cadre invitation redemption handler, for the same reason.
+        if (this.cadreInviteHandler && this.controlNode) {
+            await this.cadreInviteHandler.unregister(this.controlNode);
+        }
+        this.cadreInviteHandler = null;
         // Tear down the push-wake fan-out (releases the notifier's APNs HTTP/2 session).
         if (this.pushFanoutService) {
             await this.pushFanoutService.close().catch((err) => log('Push fan-out close failed: %o', err));
@@ -6551,6 +6779,12 @@ export class CadreNode {
         if (!this.controlNode || !this.controlDatabase) {
             throw new Error('CadreNode must be started before initializing seed bootstrap');
         }
+        // A hosted node waiting to be claimed never holds an owner key: the claim is its
+        // one trust source, and genesis-anchoring a key here would mark it claimed by
+        // itself. Refused here rather than in start() because this call comes after it.
+        if (this.config.claim) {
+            throw new Error('CadreNode: a node started with `claim` is owned by its claimant and cannot initialize seed bootstrap with an owner key');
+        }
         // A node wiring seed-bootstrap with an owner PRIVATE key is declaring that
         // key an authority of its own party (founder genesis / self-signing owner)
         // — anchor it in the node-local store. The in-memory set updates
@@ -6559,13 +6793,15 @@ export class CadreNode {
         // NOTE: non-founder members that also wire seed-bootstrap with their own
         // derived key (e.g. the phone joiner path in runOwnerGenesis, which needs
         // it to self-publish its CadrePeer row) self-anchor a key that is not a
-        // party authority. Harmless while such a node never mints an invite: the
-        // store does not replicate, so a node trusting itself grants nothing to
-        // others. But `createInvite` now hands out the anchor's contents as the
-        // invitee's pins, so the moment a non-founder member mints an invite it
-        // exports its own non-authority key as a cadre owner key. If that becomes
-        // reachable (today only cadre-cli/cadre-host owners mint invites), gate this
-        // self-anchor on the actual OwnerKey genesis insert instead.
+        // party authority. The anchor sync (`syncOwnerAnchor`) does not correct this:
+        // a `genesis` entry is base, kept whether or not a live `OwnerKey` row vouches
+        // it. Harmless while such a node never mints an invite: the store does not
+        // replicate, so a node trusting itself grants nothing to others. But
+        // `createCadreInvitation` hands out the anchor's contents as the device's pins,
+        // so the moment a non-founder member mints an invitation it exports its own
+        // non-authority key as a cadre owner key. If that becomes reachable (today only
+        // cadre-cli/cadre-host owners mint invitations), gate this self-anchor on the
+        // actual OwnerKey genesis insert instead.
         if (this.trustedOwnerStore) {
             void this.trustedOwnerStore
                 .trust(ed25519PublicKeyFromPrivate(ownerPrivateKey), 'genesis')
@@ -6574,9 +6810,8 @@ export class CadreNode {
         await this.installSeedBootstrapService(new SeedBootstrapService({
             partyId: this.config.controlNetwork.partyId,
             ownerPrivateKey,
-            inviteAddressResolver: () => this.resolveInviteAddresses(),
             ...this.seedServiceBudgets(),
-            trustPolicy: this.config.seedTrustPolicy,
+            trustPolicy: this.inboundSeedTrustPolicy(),
             // Seed trust anchors on the node-local store (seeded just above with this
             // node's own genesis key), never on the replicated OwnerKey table.
             ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
@@ -6689,14 +6924,21 @@ export class CadreNode {
      *  1. it is not this node itself — a node publishes its own `CadrePeer` address
      *     row so its dialable address rides in seeds, but "self" is not a peer this
      *     node authorized;
-     *  2. its `CadrePeer` row carries a complete voucher (`StampId`, `VouchOwner`,
-     *     `VouchSig` all non-null);
+     *  2. its `CadrePeer` row carries a complete proof: EITHER an owner voucher
+     *     (`StampId`, `VouchOwner`, `VouchSig` all non-null) OR an invitation admission
+     *     (`VouchSig` null, `VouchUsage` naming a `CadreInviteUsage` row);
      *  3. `VouchOwner` is in the NODE-LOCAL trusted-owner anchor
-     *     ({@link getTrustedOwnerStore}) — never the replicated `OwnerKey` table,
-     *     which any stranger can genesis-pollute; and
-     *  4. `VouchSig` verifies as that owner's signature over the row's voucher
-     *     digest ({@link verifyCadrePeerVoucher}), so the anchored owner really
-     *     vouched THIS peer id under THIS row's nonce; and
+     *     ({@link getTrustedOwnerStore}), which follows the replicated `OwnerKey` table
+     *     only along chains that verify from this node's out-of-band keys
+     *     ({@link syncOwnerAnchor}) — never the table itself, which any stranger can
+     *     genesis-pollute; and
+     *  4. the proof verifies: for a voucher, `VouchSig` is that owner's signature over
+     *     the row's voucher digest ({@link verifyCadrePeerVoucher}), so the anchored
+     *     owner really vouched THIS peer id under THIS row's nonce; for an admission,
+     *     the chain row → usage → invitation → anchored issuer verifies link by link
+     *     ({@link verifyInvitationAdmission} — the issuer is `VouchOwner`, the invitation's
+     *     own owner signature, the holder's and the device's signatures, and the stored
+     *     peer key really is the key behind the peer id); and
      *  5. the row's `StampId` is NOT retired in `CadreControl.Revocation` — enforced
      *     upstream in {@link ControlDatabase.queryCadrePeers}, which drops retired rows
      *     before ANY reader (this predicate included) sees them, so a row resurrected
@@ -6705,18 +6947,26 @@ export class CadreNode {
      *     local rows) is still inert to every reader that has the tombstone.
      *
      * Fail-closed at every step: a missing anchor (pre-start), an empty anchor (a
-     * not-yet-enrolled node authorizes no one), a null/partial voucher, an
-     * unanchored `VouchOwner`, or a bad signature all yield "not authorized" —
-     * having an address row is NOT membership. The control-network wake and
-     * strand-address gates consult this set, NOT the addressable one.
+     * not-yet-enrolled node authorizes no one), a null/partial proof, an
+     * unanchored `VouchOwner`, a bad signature, or a usage or invitation row this node
+     * does not hold all yield "not authorized" — having an address row is NOT
+     * membership. The protocol guard admits wake and strand-address requests by this set,
+     * NOT the addressable one.
+     *
+     * The usage and invitation tables are read only when at least one row needs them,
+     * so a cadre with no invitation-admitted member stays at one read per call.
      *
      * NOTE (rotation): if a party owner rotates keys and only the NEW key is pinned
      * in the anchor, rows the OLD key vouched fail check 3 until re-vouched — a
      * legit member goes un-authorized on readers that only pin the new key. Full
      * rotation handling (re-vouch on rotate) is the
-     * `flip-strand-membership-rotation-known-gap` work, not this predicate's.
+     * `flip-strand-membership-rotation-known-gap` work, not this predicate's. The
+     * `OwnerKey` table differs: an owner the rotated-out (or removed) key vouched keeps
+     * its place in every anchor that had derived it ({@link syncOwnerAnchor}: a derived
+     * entry stays while its own row is live), and is only out of reach for a machine that
+     * never held it until a remaining owner re-adds it or an invitation pins it.
      *
-     * @param retry - Whether the underlying membership read may retry a transient cluster
+     * @param retry - Whether the underlying membership reads may retry a transient cluster
      *   failure. Only {@link refreshAuthorizedControlPeers} passes `false`, because it runs
      *   as the control database's membership listener with that database's write lock held;
      *   see its comment.
@@ -6725,10 +6975,18 @@ export class CadreNode {
         if (!this.controlDatabase) {
             throw new Error('CadreNode must be started before listing members');
         }
+        return await this.collectAuthorizedMembers(this.controlDatabase, retry, this.invitationChainSource(this.controlDatabase, retry));
+    }
+    /**
+     * The body of {@link listAuthorizedMembers}, with the invitation chain supplied as a
+     * source so the membership refresh can share one load with {@link syncOwnerAnchor}.
+     */
+    async collectAuthorizedMembers(controlDatabase, retry, loadChain) {
         const selfPeerId = this.peerId?.toString();
-        const rows = await this.controlDatabase.queryCadrePeers(retry);
+        const rows = await controlDatabase.queryCadrePeers(retry);
+        const chain = rows.some(isInvitationAdmitted) ? await loadChain() : null;
         const authorized = rows
-            .filter(row => row.peerId !== selfPeerId && this.hasAnchoredVoucher(row))
+            .filter(row => row.peerId !== selfPeerId && this.hasAnchoredProof(row, chain))
             .map(({ peerId, multiaddr }) => ({ peerId, multiaddr }));
         // A node whose anchor was never seeded (no invite pin, no operator pin, not a
         // founder) refuses every wake and strand-addr request, which from the outside
@@ -6741,9 +6999,151 @@ export class CadreNode {
     }
     /**
      * Checks 2–4 of the authorized-membership predicate (see
-     * {@link listAuthorizedMembers}) for one `CadrePeer` row: complete voucher,
-     * `VouchOwner` in the node-local anchor, signature valid over the row's
-     * (PeerId, StampId) voucher digest.
+     * {@link listAuthorizedMembers}) for one `CadrePeer` row, by the kind of proof it
+     * carries: an owner voucher ({@link hasAnchoredVoucher}) or an invitation admission
+     * ({@link verifyInvitationAdmission} over the usage and invitation rows in `chain`,
+     * loaded only when some row needs them). A row with a `VouchSig` is judged as a
+     * voucher even if it also names a usage — the signature is the stronger proof and the
+     * one an owner re-vouch leaves behind.
+     */
+    hasAnchoredProof(row, chain) {
+        if (!isInvitationAdmitted(row)) {
+            return this.hasAnchoredVoucher(row);
+        }
+        const usage = chain?.usages.get(row.vouchUsage);
+        const invite = usage === undefined ? undefined : chain?.invites.get(usage.inviteKey);
+        if (usage === undefined || invite === undefined) {
+            return false;
+        }
+        return verifyInvitationAdmission(this.partyId, row, usage, invite, key => this.trustedOwnerStore?.has(key) ?? false);
+    }
+    /**
+     * Recompute the node-local trusted-owner anchor from the replicated `OwnerKey` table along
+     * verifiable chains (`owner-anchor-sync.ts` → {@link deriveOwnerAnchor}), as the first step
+     * of every membership refresh ({@link refreshAuthorizedControlPeers}) so the snapshot built
+     * in the same pass judges `CadrePeer` rows against the updated anchor. A key whose live
+     * row's stored proof verifies against a key already anchored enters under `chain` and
+     * stays while its row is live; a key an anchored owner's verifiable tombstone names
+     * leaves, base pins included — which is how a config pin of a removed key, re-anchored at
+     * every start ({@link initializeTrustedOwnerStore}), is removed again. The derivation
+     * refuses removals that would empty the anchor; they are logged here.
+     *
+     * With an EMPTY anchor the sync does nothing: there is no key to derive from, and a node
+     * waiting to be claimed ({@link isAwaitingClaim}: claim secret set, anchor empty) must
+     * stay empty until the claim anchors its claimant — the replicated table must never seat
+     * the first key. The early return below is the seam that rests on.
+     *
+     * Any read failure skips the whole pass and leaves the anchor as it was; the refresh then
+     * builds its snapshot against that anchor, which is also what its previous snapshot was
+     * judged against. Caught here rather than failing the refresh, because the membership read
+     * tolerates an unreachable `Revocation` block on an isolated node
+     * (`ControlDatabase.readRevokedStampRows`) and `queryRevocations` does not: failing the
+     * whole refresh on that would freeze such a node's gate snapshot.
+     * NOTE: on such a node the sync is skipped at every refresh until the block is held; if an
+     * isolated node ever has to derive owner additions while cut off, give `queryRevocations`
+     * the same cohort-unreachable fallback.
+     *
+     * NOTE: cost per membership refresh is one `OwnerKey` read and one `Revocation` read (the
+     * tombstone list, whose `OwnerKey` stamps are handed to `queryOwnerKeyRows` so it does not
+     * read the retired set again), plus the invitation chain when some owner row is
+     * invitation-admitted — shared with the membership read through `loadChain`; the memo
+     * suggestion on {@link loadInvitationChain} covers that part. Before the Revocation ledger
+     * marker is filed that one read is a cohort consult per refresh, which
+     * `control-founding-consult-budget.spec.ts` pins.
+     *
+     * @param retry - forwarded to every read; `false` on the refresh path, for the reason on
+     *   {@link refreshAuthorizedControlPeers}.
+     */
+    async syncOwnerAnchor(reason, retry, loadChain) {
+        const store = this.trustedOwnerStore;
+        const controlDatabase = this.controlDatabase;
+        if (!store || !controlDatabase) {
+            return;
+        }
+        const before = store.sources();
+        if (before.size === 0) {
+            return;
+        }
+        let target;
+        try {
+            const tombstones = await controlDatabase.queryRevocations(retry);
+            const retired = new Set(tombstones.filter(tombstone => tombstone.tableName === 'OwnerKey').map(tombstone => tombstone.stampId));
+            const rows = await controlDatabase.queryOwnerKeyRows(retry, retired);
+            const chain = rows.some(isInvitationAdmitted) ? await loadChain() : null;
+            const derivation = deriveOwnerAnchor({ partyId: this.partyId, anchor: before, rows, tombstones, chain });
+            if (derivation.refusedRemovals.length > 0) {
+                log('syncOwnerAnchor(%s): refused %d owner removal(s) that would empty the anchor: %o', reason, derivation.refusedRemovals.length, derivation.refusedRemovals);
+            }
+            target = derivation.target;
+        }
+        catch (error) {
+            log('syncOwnerAnchor(%s): read failed — anchor left as it was: %o', reason, error);
+            return;
+        }
+        await this.applyOwnerAnchor(store, before, target, reason);
+    }
+    /**
+     * Apply one pass's result: `chain` entries for the keys it newly derived, removal of the keys
+     * it started with that are outside `target` — base keys a verifiable tombstone named, and
+     * `chain` entries whose row is gone.
+     *
+     * Diffed against `before`, the snapshot the derivation was computed from, NOT the live store:
+     * the anchor is written out of band while the pass's reads are in flight (an invitation pin,
+     * the genesis anchor, a claim, a seed), and such a key is outside `target` only because the
+     * pass never saw it — judging the live store would remove it. Likewise a key removed
+     * meanwhile (a claim rollback) must not come back as `chain`. Both are judged by the next
+     * pass. Each change lands in memory synchronously (`TrustedOwnerStore.trust` / `remove`); a
+     * failed PERSIST is logged and does not stop the pass or fail the refresh, as
+     * `SeedBootstrapService.anchorAcceptedSigner` treats the same failure.
+     */
+    async applyOwnerAnchor(store, before, target, reason) {
+        for (const key of target) {
+            if (!before.has(key) && !store.has(key)) {
+                log('syncOwnerAnchor(%s): owner %s derived from the OwnerKey table', reason, key);
+                await store.trust(key, 'chain').catch(error => log('syncOwnerAnchor(%s): anchor persist failed for %s: %o', reason, key, error));
+            }
+        }
+        for (const key of before.keys()) {
+            if (!target.has(key) && store.has(key)) {
+                log('syncOwnerAnchor(%s): owner %s removed from the anchor', reason, key);
+                await store.remove(key).catch(error => log('syncOwnerAnchor(%s): anchor persist failed for %s: %o', reason, key, error));
+            }
+        }
+    }
+    /**
+     * A per-refresh {@link InvitationChainSource}: the first call loads the chain through
+     * {@link loadInvitationChain}, every later call shares that load.
+     */
+    invitationChainSource(controlDatabase, retry) {
+        let loading = null;
+        return () => (loading ?? (loading = this.loadInvitationChain(controlDatabase, retry)));
+    }
+    /**
+     * The usage and invitation rows {@link hasAnchoredProof} and {@link syncOwnerAnchor}
+     * resolve an invitation-admitted row through, keyed for lookup. Both reads honour `retry`
+     * for {@link listAuthorizedMembers}' reason.
+     *
+     * NOTE: once invitations are the only admission route (ticket
+     * `cadre-invitations-redeemable-by-any-member`), every cadre with a member not yet
+     * re-vouched pays these two whole-table reads and three ed25519 verifies per row on every
+     * membership refresh. Both tables are append-only and a verified chain never changes (expiry,
+     * use count and withdrawal are not re-checked), so if the gate's admission deadline ever
+     * shows this, memoise verified (row stamp → usage stamp) pairs per node and skip the reads
+     * when every admitted row is already memoised.
+     */
+    async loadInvitationChain(controlDatabase, retry) {
+        const [usages, invites] = await Promise.all([
+            controlDatabase.queryCadreInviteUsages(retry),
+            controlDatabase.queryCadreInvites(retry),
+        ]);
+        return {
+            usages: new Map(usages.map(usage => [usage.usageStampId, usage])),
+            invites: new Map(invites.map(invite => [invite.key, invite])),
+        };
+    }
+    /**
+     * The owner-voucher half of {@link hasAnchoredProof}: complete voucher, `VouchOwner` in
+     * the node-local anchor, signature valid over the row's (PeerId, StampId) voucher digest.
      *
      * NOTE: verifies the ed25519 signature on every call (no memo of already-
      * verified (peerId, stampId, vouchSig) triples). Cadres are a handful of
@@ -6758,12 +7158,12 @@ export class CadreNode {
         if (!this.trustedOwnerStore?.has(row.vouchOwner)) {
             return false;
         }
-        return verifyCadrePeerVoucher(row.peerId, row.stampId, row.vouchOwner, row.vouchSig);
+        return verifyCadrePeerVoucher(this.partyId, row.peerId, row.stampId, row.vouchOwner, row.vouchSig);
     }
     /**
      * Probe whether a given peer is an AUTHORIZED party member (see
-     * {@link listAuthorizedMembers}) — the gate the control-network wake and
-     * strand-address responders consult, NOT {@link isMember} (the addressable
+     * {@link listAuthorizedMembers}) — the check the protocol guard runs ahead of the
+     * control-network wake and strand-address handlers, NOT {@link isMember} (the addressable
      * surface). Deliberately scans the full membership (one `CadrePeer` query)
      * rather than adding a single-row read path: cadres are small, and one code
      * path keeps the predicate impossible to drift from the list.
@@ -6779,14 +7179,16 @@ export class CadreNode {
      * record (via {@link resolvePeerAddrs}, signaling/relay first — so a NAT'd peer
      * is reachable through its circuit-relay address), dials `WAKE_PROTOCOL`, sends
      * the {@link WakeRequest}, and returns the peer's {@link WakeAck}. The receiver
-     * gates the request on cadre membership and only resumes a strand it already
-     * participates in; it acks once it has decided, before the strand is up. The
-     * dial deadlines derive from this node's `network.linkRoundTripMs`.
+     * only resumes a strand it already participates in; it acks once it has decided,
+     * before the strand is up. The dial deadlines derive from this node's
+     * `network.linkRoundTripMs`.
      *
      * @param targetPeerId - The hibernating cadre peer to wake.
      * @param strandId - The strand the caller knows has pending activity.
      * @param reason - Optional cause hint, e.g. `"activity"` or `"manual"`.
-     * @throws if the node is not started or the target has no dialable address.
+     * @throws if the node is not started, the target has no dialable address, or no
+     *   attempt got an ack — including when the receiver does not count this node as an
+     *   authorized member, since its protocol guard resets the stream without a reply.
      */
     async pushWake(targetPeerId, strandId, reason) {
         if (!this.controlNode) {
@@ -6802,7 +7204,8 @@ export class CadreNode {
     /**
      * Enable the seed listener for receiving seeds via the /sereus/seed/1.0.0 protocol.
      * This is for drone nodes that need to receive seeds without being an owner.
-     * Does not require an owner key.
+     * Does not require an owner key. Idempotent; a node started with `config.claim`
+     * calls it itself inside {@link start}, so an embedder's own call is a no-op.
      */
     async enableSeedListener() {
         if (!this.controlNode || !this.controlDatabase) {
@@ -6816,9 +7219,8 @@ export class CadreNode {
         await this.installSeedBootstrapService(new SeedBootstrapService({
             partyId: this.config.controlNetwork.partyId,
             // No owner key - this node only receives seeds
-            inviteAddressResolver: () => this.resolveInviteAddresses(),
             ...this.seedServiceBudgets(),
-            trustPolicy: this.config.seedTrustPolicy,
+            trustPolicy: this.inboundSeedTrustPolicy(),
             // A listener-only node accepts a wire-delivered seed solely against this
             // anchor (there is no per-call override on the inbound handler): with no
             // genesis/invite/operator pin it authorizes nobody, which is the point.
@@ -6881,6 +7283,17 @@ export class CadreNode {
             onSeedError: (partyId, error) => this.emit('seed:error', { partyId, error }),
         };
     }
+    /**
+     * The node-wide default trust policy for INBOUND seeds, the one value every
+     * {@link SeedBootstrapService} this node constructs is given — the owner service,
+     * the listener, and `applySeed`'s temp service — so the three cannot drift. The
+     * claim policy when the node was started with `config.claim` (the two are refused
+     * together at start, so there is nothing to merge), otherwise the configured
+     * `seedTrustPolicy`, and `undefined` for the service's anchored default.
+     */
+    inboundSeedTrustPolicy() {
+        return this.claimTrustPolicy ?? this.config.seedTrustPolicy;
+    }
     /**
      * Re-materialize the authorized-peer snapshot that the fail-closed per-stream
      * control-DB gate ({@link authorizeInboundControlStream}) judges against.
@@ -7035,6 +7448,46 @@ export class CadreNode {
             log('removePeer: persisting the removal of dial target %s failed (forgotten in memory): %o', peerId, error);
         });
     }
+    /**
+     * Seat another owner key, signed by this node's owner key (the signed-add branch of
+     * `OwnerKey.Authorized`; the row stores the vouching pair). The write notifies the
+     * membership hub, so the refresh it triggers has run by the time this resolves.
+     *
+     * @param ownerPublicKeyB64 - the new owner's ed25519 public key (base64url).
+     * @returns `true` when the row was seated, `false` when the key is already a live owner.
+     */
+    async addOwner(ownerPublicKeyB64) {
+        if (!this.seedBootstrapService) {
+            throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+        }
+        const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
+        const added = await this.seedBootstrapService.addOwner(key);
+        // NOTE: an OwnerKey add committed alone is local-only and nothing re-issues it (no
+        // update branch to re-touch, unlike CadrePeer), so it is only logged;
+        // tickets/backlog/debt-owner-key-add-while-alone-has-no-reissue.md owns the fix.
+        if (added && this.committedAlone()) {
+            log('addOwner(%s) committed while ALONE (0 control connections): the new owner row is ' +
+                'local-only and is not re-issued on cohort growth, so other machines may never see it.', key);
+        }
+        return added;
+    }
+    /**
+     * Remove an owner key, signed by this node's owner key (which must be a different owner):
+     * the delete and its `Revocation` tombstone commit together. Refused by name when the key
+     * is this node's own or the only live owner. The write notifies the membership hub; the
+     * tombstone rides the committed-delete seam ({@link noteGuardedDelete}), so one committed
+     * while alone is re-issued on cohort growth like every other removal.
+     *
+     * @param ownerPublicKeyB64 - the owner's ed25519 public key (base64url).
+     * @returns `true` when the row was removed, `false` when the key is not a live owner here.
+     */
+    async removeOwner(ownerPublicKeyB64) {
+        if (!this.seedBootstrapService) {
+            throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+        }
+        const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
+        return await this.seedBootstrapService.removeOwner(key);
+    }
     /**
      * Create a seed from the current control network state.
      * The seed contains peer information and is signed by an owner.
@@ -7049,10 +7502,12 @@ export class CadreNode {
      * Apply a seed to populate the peer cache and enable connections.
      *
      * Validates the seed signature, then evaluates a trust anchor for the signer
-     * key (see `SeedTrustPolicy`). An enrollment caller can pass a per-seed
-     * `trustPolicy` override — e.g. a `pinnedKeyTrustPolicy` built from a
-     * `CadreInvite.ownerKeys` — so a cold-start node can accept its first
-     * seed without reconfiguring the service.
+     * key (see `SeedTrustPolicy`). An operator-driven caller can pass a per-seed
+     * `trustPolicy` override — e.g. a `pinnedKeyTrustPolicy` built from a pinned
+     * owner key — so a cold-start node can accept its first seed without
+     * reconfiguring the service. The override wins on a node started with
+     * `config.claim` as well: the claim secret is the node's default inbound policy,
+     * not a lock on its local operator, who already controls the process.
      */
     async applySeed(seed, options) {
         if (!this.seedBootstrapService) {
@@ -7063,13 +7518,13 @@ export class CadreNode {
             //
             // This temp service is discarded after the call, so it must NOT own the shared
             // node's inbound seed handler: pass { registerHandler: false }. That keeps
-            // repeated service-less applySeed/dialInvite idempotent (no handler leak, no
+            // repeated service-less applySeed idempotent (no handler leak, no
             // DuplicateProtocolHandlerError). The temp service still applies this seed; a
             // node that wants to RECEIVE inbound seeds needs a persistent service
             // (enableSeedListener / initializeSeedBootstrap) to own the handler.
             const tempService = new SeedBootstrapService({
                 partyId: seed.partyId,
-                trustPolicy: this.config.seedTrustPolicy,
+                trustPolicy: this.inboundSeedTrustPolicy(),
                 ...this.seedServiceBudgets(),
                 // The anchor is node-scoped, not service-scoped: a throwaway service
                 // must consult (and persist an accepted signer into) the SAME store the
@@ -7109,12 +7564,19 @@ export class CadreNode {
     }
     /**
      * Deliver a seed directly to a peer via the /sereus/seed/1.0.0 protocol.
+     *
+     * `target` is a multiaddr string, or a peer id with its addresses (the form a phone
+     * uses for a node it scanned), which are dialed one at a time before the request
+     * (`SeedBootstrapService.deliverSeed`). `options.claimProof` rides beside the seed when
+     * the target is a brand-new node being claimed (`claim-proof.ts`).
+     *
+     * @throws {PeerUnreachableError} for a peer id with addresses, when no connection to it formed.
      */
-    async deliverSeed(targetMultiaddr, seed) {
+    async deliverSeed(target, seed, options) {
         if (!this.seedBootstrapService) {
             throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
-        return await this.seedBootstrapService.deliverSeed(targetMultiaddr, seed);
+        return await this.seedBootstrapService.deliverSeed(target, seed, options);
     }
     /**
      * Encode a seed for out-of-band delivery (e.g., QR code, copy/paste).
@@ -7180,31 +7642,61 @@ export class CadreNode {
         return result;
     }
     /**
-     * Create an invite for a phone to join the cadre.
-     * Use when a server wants to invite a NAT'd phone.
-     */
-    async createInvite(token, expiresIn) {
+     * Claim a node that was started with a claim secret (`CadreNodeConfig.claim`), from
+     * the peer id, addresses and secret its host showed (the QR code): mint a seed, prove
+     * possession of the secret beside it (`claim-proof.ts`), deliver it, and on acceptance
+     * vouch the node into this cadre and keep its addresses as a dial target. The owner
+     * side of the claim-secret entry in the Seed Delivery Protocol (`docs/architecture.md`).
+     *
+     * Requires the seed service with an owner key ({@link initializeSeedBootstrap}), as
+     * {@link addDrone} does. The order is the REVERSE of `addDrone`'s: seed first, row
+     * second. A refused claim or a failed delivery therefore leaves no `CadrePeer` row and
+     * no retained dial target behind on this node — a phone that typed the wrong secret,
+     * or scanned a node someone else already owns, has nothing to clean up.
+     *
+     * A failure is one of three kinds a caller can tell apart:
+     *
+     * - `ClaimRefusedError` — the node was reached and refused, with its refusal code when
+     *   its policy gave one.
+     * - `PeerUnreachableError` — no connection to the node formed from any of its addresses,
+     *   so nothing was sent. Each address is dialed in turn on its own limit, so this can
+     *   take up to the per-peer dial limit plus the seed request's (114.5 s at the default
+     *   declared link) when none answers.
+     * - anything else — the node was reached and the exchange failed, or a local step failed
+     *   (a malformed secret or address among them). Repeating the claim with the same secret
+     *   is safe (see below).
+     *
+     * Idempotent for the same owner: a second call after a dropped response is accepted
+     * by the node (its anchored branch), the row insert is a no-op on an existing row
+     * (`ControlDatabase.insertCadrePeer`), and the dial target is replaced, not duplicated.
+     *
+     * The first dial is kicked (not awaited) so it happens now rather than on the next
+     * timed reconcile pass; a caller that wants to wait for the connection awaits
+     * {@link reconcileControlCohort} itself, with `addDrone`'s caveat that a pass already
+     * in flight is joined rather than restarted. The claimed node dials this one back too,
+     * from the seed's owner list, when this node has a listen or relay address; a phone
+     * with neither is reached by its own reconcile pass alone.
+     *
+     * @throws {ClaimRefusedError} when the node was reached and refused the claim.
+     * @throws {PeerUnreachableError} when the node was never reached.
+     */
+    async claimNode(target) {
         if (!this.seedBootstrapService) {
             throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
-        const result = await this.seedBootstrapService.createInvite(token, expiresIn);
-        // The invitee dials this node BEFORE it is authorized (dialInvite →
-        // acceptPhone), so hold the inbound connection gate open for strangers for
-        // the invite's validity (or a bounded default when it never expires).
-        this.openEnrollmentWindow(result.invite.expiresAt ?? Date.now() + DEFAULT_ENROLLMENT_WINDOW_MS);
-        return result;
-    }
-    /**
-     * Accept a phone connection using an invite.
-     * Call this when a phone dials in with an invite token.
-     */
-    async acceptPhone(options, issuedInvite) {
-        if (!this.seedBootstrapService) {
-            throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+        const secret = parseClaimSecret(target.secret);
+        const seed = await this.seedBootstrapService.createSeed();
+        const proof = claimProof(secret, target.peerId, seed.signerKey, seedDigest(seed));
+        const ack = await this.seedBootstrapService.deliverSeed({ peerId: target.peerId, multiaddrs: target.multiaddrs }, seed, { claimProof: proof });
+        if (!ack.accepted) {
+            throw new ClaimRefusedError(target.peerId, ack.reason ?? 'no reason given', ack.code);
         }
-        // The just-accepted phone opens control-DB streams next; its `CadrePeer` insert
-        // notifies the membership hub, so it is already admitted when this resolves.
-        await this.seedBootstrapService.acceptPhone(options, issuedInvite);
+        log('claimNode: %s accepted the claim; vouching it into the cadre', target.peerId);
+        // The wrapper queues the write for re-replication: a phone claiming its first
+        // always-on node has no control connection yet, so the insert commits local-only.
+        await this.authorizePeer(target.peerId, target.multiaddrs);
+        this.retainDialTarget(target.peerId, target.multiaddrs, 'claimNode');
+        void this.reconcileControlCohort().catch((error) => log('claimNode: reconcile kick after claiming %s failed: %o', target.peerId, error));
     }
     /**
      * Add a phone to the cadre with relay support.
@@ -7220,45 +7712,175 @@ export class CadreNode {
         // own control-DB schema load may have died denied.
         return await this.seedBootstrapService.addPhoneWithRelay(phonePeerId);
     }
+    // ============================================================================
+    // Cadre Invitation API (redeemable at any member, `/sereus/cadre-invite/1.0.0`)
+    // ============================================================================
     /**
-     * Encode an invite for out-of-band delivery (QR, link, etc.).
-     */
-    encodeInvite(invite) {
-        const json = JSON.stringify(invite);
-        return uint8ArrayToString(new TextEncoder().encode(json), 'base64url');
+     * Mint an owner-signed cadre invitation that a device can redeem at ANY member machine of
+     * this party, the owner offline included ({@link redeemCadreInvitation}). Requires the
+     * owner key ({@link initializeSeedBootstrap}).
+     *
+     * The invitation is an ed25519 keypair: the public half is the `CadreInvite` row's key,
+     * the private half rides in the returned bundle as the proof of possession. Whoever holds
+     * the bundle can redeem it, so an UNTARGETED, OWNER-GRANTING invitation — a bearer
+     * credential for admin rights — defaults to a 15-minute lifetime; every other kind to 24
+     * hours. One use unless `uses` says otherwise. The bundle carries the signed row (so a
+     * member that has not received it by replication seats it from the bundle), this node's
+     * anchored owner keys — every current owner this node has verified, the out-of-band ones
+     * and those derived along verifiable chains ({@link syncOwnerAnchor}) — (the device pins
+     * them and checks the member's reply against them; sourced from the node-local anchor
+     * only, never the raw replicated `OwnerKey` table, because the device anchors whatever
+     * arrives and a stranger's genesis-inserted key must not ride an invitation into a fresh
+     * node's anchor; an empty anchor is refused because a reply could not be checked), and
+     * the addresses of this machine first
+     * ({@link resolveInviteAddresses}, which honours pushed NAT addresses) then up to three
+     * other members ({@link siblingInvitationAddrs}).
+     *
+     * The row commits locally and replicates like any other control write; minted while
+     * alone (a phone with no connection), it reaches the other members through the
+     * peer-join block catch-up on the next connection. The device can redeem at any member it
+     * reaches meanwhile: a member that does not hold the row yet admits the device's connection
+     * provisionally ({@link admitInboundControlConnection}) and seats the row from the bundle.
+     *
+     * @throws when no owner key is wired, the anchor is empty, `uses` is not a positive
+     *   integer, or neither this machine nor any other member has an address.
+     */
+    async createCadreInvitation(options) {
+        const service = this.seedBootstrapService;
+        if (!service?.canAuthorize()) {
+            throw new Error('Seed bootstrap service not initialized with an owner key. Call initializeSeedBootstrap() first.');
+        }
+        const ownerKeys = Array.from(this.trustedOwnerStore?.all() ?? []);
+        if (ownerKeys.length === 0) {
+            throw new Error('createCadreInvitation: this node anchors no owner key, and an invitation without owner keys cannot be verified by the device that redeems it');
+        }
+        const uses = options.uses ?? 1;
+        if (!Number.isInteger(uses) || uses < 1) {
+            throw new Error(`createCadreInvitation: uses must be a positive integer (received ${String(options.uses)})`);
+        }
+        const members = [...await this.resolveInviteAddresses(), ...await this.siblingInvitationAddrs()];
+        if (members.length === 0) {
+            throw new Error('createCadreInvitation: neither this machine nor any other machine of the party has an address a device could dial');
+        }
+        const expiresInMs = options.expiresInMs
+            ?? (options.grantsOwner && !options.peerId ? OWNER_INVITATION_DEFAULT_TTL_MS : CADRE_INVITATION_DEFAULT_TTL_MS);
+        const invitePrivateKey = generatePrivateKey('ed25519', 'base64url');
+        const row = await service.insertCadreInvite({
+            key: ed25519PublicKeyFromPrivate(invitePrivateKey),
+            peerId: options.peerId ?? null,
+            grantsOwner: options.grantsOwner,
+            expiresAtMs: Date.now() + expiresInMs,
+            totalUses: uses,
+        });
+        const invitation = {
+            v: 1,
+            partyId: this.config.controlNetwork.partyId,
+            invitePrivateKey,
+            invite: row,
+            ownerKeys,
+            members,
+        };
+        log('Cadre invitation minted: %s (peer=%s owner=%s uses=%d, %d member address(es))', row.key, row.peerId ?? 'any', row.grantsOwner, uses, members.length);
+        return { invitation, encoded: encodeCadreInvitation(invitation) };
     }
     /**
-     * Decode an invite from base64url encoding.
+     * Every cadre invitation this node holds — minted here or replicated in — with its
+     * standing ({@link CadreInviteStatus}: live, withdrawn, redemptions recorded).
      */
-    decodeInvite(encoded) {
-        const bytes = uint8ArrayFromString(encoded, 'base64url');
-        const json = new TextDecoder().decode(bytes);
-        return JSON.parse(json);
+    async listCadreInvitations() {
+        if (!this.controlDatabase) {
+            throw new Error('CadreNode must be started before listing cadre invitations');
+        }
+        return await this.controlDatabase.listCadreInviteStatuses();
     }
     /**
-     * Dial an owner from an invite (for phone joining via invite).
+     * Withdraw a cadre invitation: an owner-signed `Revocation` tombstone over its row, which
+     * stays as the proof of membership for every device it admitted. No further redemption
+     * succeeds anywhere the tombstone reaches, and a member holding it refuses the bundle's
+     * copy of the row. A withdrawal committed while alone is re-issued on cohort growth like
+     * any other tombstone.
+     *
+     * @returns `true` when this call filed the tombstone, `false` when the row is not held
+     *   here or was already withdrawn.
      */
-    async dialInvite(invite) {
+    async withdrawCadreInvitation(key) {
         if (!this.seedBootstrapService) {
-            // Create a temporary service that only dials the invite. It is discarded after
-            // the call, so it does NOT own the shared node's inbound seed handler:
-            // initialize with { registerHandler: false }. This temp dialInvite never
-            // applies a seed itself — a node that wants to RECEIVE an inbound seed back
-            // must have a persistent service (enableSeedListener / initializeSeedBootstrap)
-            // own the /sereus/seed/1.0.0 handler. trustPolicy is therefore effectively dead
-            // on this dial-only path; it is kept for symmetry with the applySeed temp site.
-            const tempService = new SeedBootstrapService({
-                partyId: invite.partyId,
-                trustPolicy: this.config.seedTrustPolicy,
-                ...this.seedServiceBudgets(),
-            });
-            if (this.controlNode && this.controlDatabase) {
-                await tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
-            }
-            await tempService.dialInvite(invite);
-            return;
+            throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
         }
-        await this.seedBootstrapService.dialInvite(invite);
+        return await this.seedBootstrapService.withdrawCadreInvite(key);
+    }
+    /**
+     * Join the cadre an invitation names by redeeming it at one of the member machines it
+     * lists, the owner that minted it offline or not. Needs a started node with a stable
+     * identity (`keyStore` or `privateKey`): the redemption is signed with the key behind
+     * this node's peer id, and the member checks that the two match.
+     *
+     * Steps: refuse an invitation for another party; pin its `ownerKeys` into the node-local
+     * anchor (`'invite'` provenance — the pin sticks even if the redemption then fails, as it
+     * does for a seed invite, so a later attempt or seed from the same owner is anchored);
+     * sign the request; dial the listed members in order ({@link redeemAtMembers}); on
+     * acceptance verify the reply against the pinned keys, merge its dial hints into the peer
+     * store, retain the answering member as a cold-start dial target, refresh the membership
+     * gate and start a cohort reconcile pass. This node then syncs the control database over
+     * the connection it already holds, the same unified behaviour as after a seed.
+     *
+     * A device that is already a member (a restart with the invitation still configured) is
+     * answered as accepted by the member's idempotent redemption, with no second usage row.
+     *
+     * When the invitation grants ownership, the member seats this node's key as an `OwnerKey`
+     * row by consent. The caller still has to wire that key for signing afterwards —
+     * `initializeSeedBootstrap(ownKey)`, which anchors it; never `ensureOwnerKey`, the row is
+     * already there. Other machines derive this node's key into their anchors from the row's
+     * stored proof on their next membership refresh ({@link syncOwnerAnchor}).
+     *
+     * Limit: the reply check ({@link verifyRedeemReply}) does not authenticate the member. A
+     * forged bundle, or a legitimate one whose addresses were swapped, dials a machine that
+     * can echo the owner-signed row it was just sent; that is what pasting an attacker's
+     * invitation means. What protects this node afterwards is its anchor: every row it then
+     * syncs is judged against the pinned owner keys, so a machine that is not a member of the
+     * cadre the invitation names can admit nobody this node will trust.
+     *
+     * @throws `CadreInviteRejectedError` on a final refusal, `CadreInviteReplyInvalidError` on
+     *   an acceptance that fails the reply check, `CadreInviteUnreachableError` when every
+     *   listed address was tried without an acceptance, and a plain `Error` for the
+     *   preconditions above.
+     */
+    async redeemCadreInvitation(invitation) {
+        const controlNode = this.controlNode;
+        if (!controlNode || !this.controlDatabase || !this._running) {
+            throw new Error('CadreNode must be started before redeeming a cadre invitation');
+        }
+        if (invitation.partyId !== this.config.controlNetwork.partyId) {
+            throw new Error(`Cadre invitation is for party ${invitation.partyId}; this node serves ${this.config.controlNetwork.partyId}`);
+        }
+        const signer = this.getSelfSigningKey();
+        if (!signer) {
+            throw new Error('redeemCadreInvitation: this node runs on an ephemeral identity; configure `keyStore` or `privateKey` so its key can sign the redemption');
+        }
+        await this.trustOwnerKeys(invitation.ownerKeys, 'invite');
+        const pinned = new Set(invitation.ownerKeys);
+        const request = signRedeemRequest(invitation, { peerKey: signer.publicKeyB64, peerPrivateKey: signer.privateKeyB64 }, generateStampId(controlNode.peerId.toString()), await this.resolveInviteAddresses());
+        const { reply, memberPeerId, memberAddr } = await redeemAtMembers(controlNode, {
+            invitation,
+            request,
+            isTrustedIssuer: (ownerKey) => pinned.has(ownerKey),
+            linkRoundTripMs: this.config.network?.linkRoundTripMs,
+        });
+        log('Cadre invitation %s redeemed at %s (owner=%s)', invitation.invite.key, memberAddr, reply.invite.grantsOwner);
+        const selfPeerId = controlNode.peerId.toString();
+        await mergeSeedPeers(controlNode, reply.peers.filter((peer) => peer.peerId !== selfPeerId));
+        if (memberPeerId !== null) {
+            // Every address the bundle gave the answering member, so a restart has the same choices.
+            const memberAddrs = this.parseMultiaddrs(invitation.members)
+                .filter((addr) => trailingPeerId(addr) === memberPeerId)
+                .map((addr) => addr.toString());
+            this.retainDialTarget(memberPeerId, memberAddrs, 'redeemCadreInvitation');
+        }
+        // The pins above flip nothing yet (this node holds no rows), but the rows about to
+        // replicate in are judged against them; refresh so the snapshot is not stale when they land.
+        await this.refreshMembershipGate('invitation-redeemed');
+        void this.reconcileControlCohort().catch((error) => log('redeemCadreInvitation: the post-redemption reconcile pass failed: %o', error));
+        return { peerId: memberPeerId, grantsOwner: reply.invite.grantsOwner, redeemedAt: new Date().toISOString() };
     }
     // ============================================================================
     // Strand Solicitation API (native cadre-core formation transport)
@@ -7388,10 +8010,12 @@ export class CadreNode {
         return await this.strandSolicitationService.createOpenInvitation(sAppId, expirationMs, bootstrap);
     }
     /**
-     * Addresses of the party's other machines for an invitation's bootstrap list
-     * ({@link selectInvitationSiblingAddrs} picks which). The source is each authorized
-     * member's signed `CadrePeer` record ({@link resolvePeerRecord}), so a machine whose record
-     * is missing, stale or untrusted is left out; live connections only order them.
+     * Addresses of the party's other machines for an invitation's bootstrap list — an open
+     * strand invitation's ({@link createOpenInvitation}) or a cadre invitation's
+     * ({@link createCadreInvitation}); {@link selectInvitationSiblingAddrs} picks which. The
+     * source is each authorized member's signed `CadrePeer` record ({@link resolvePeerRecord}),
+     * so a machine whose record is missing, stale or untrusted is left out; live connections
+     * only order them.
      *
      * Best-effort: a failed read leaves the invitation naming this machine alone, which is what
      * it named before siblings were added.
@@ -7413,7 +8037,7 @@ export class CadreNode {
             return selectInvitationSiblingAddrs(siblings, connected);
         }
         catch (error) {
-            log('createOpenInvitation: resolving the other machines failed; the invitation names only this one: %o', error);
+            log('siblingInvitationAddrs: resolving the other machines failed; the invitation names only this one: %o', error);
             return [];
         }
     }
@@ -7450,7 +8074,7 @@ export class CadreNode {
      * Ask to join through `invitation` and have the party keep trying until the join works, the
      * invitation is used up or expires, or the request is dismissed: across restarts, and from
      * any owner machine of the party (`docs/strands.md` → "Joining while the inviter is
-     * offline"). Records a party-wide `PendingJoin` row, runs one attempt on this machine at
+     * offline"). Records a party-wide `JoinRequest` row, runs one attempt on this machine at
      * once, and returns the status after it: `'joined'` when the inviter answered yes, `'waiting'`
      * when it was unreachable or not ready, `'failed'` when it refused for good.
      *
@@ -7516,13 +8140,13 @@ export class CadreNode {
         return { ownerKey: signingKey.publicKeyB64, signMessage: signMessageWith(signingKey.privateKeyB64) };
     }
     /**
-     * Write a join request's row, or adopt the party's existing row for the same invitation: a
-     * pending one as it is, a finished one replaced by `requested` (the user asked again).
+     * Write a join request, or adopt the party's existing request for the same invitation: a
+     * pending one as it is, a finished one rewritten as `requested` (the user asked again).
      */
     async recordJoinRequest(database, requested, { ownerKey, signMessage }) {
         let written;
         try {
-            written = await database.insertPendingJoin(requested, ownerKey, signMessage);
+            written = await database.insertJoinRequest(requested, ownerKey, signMessage);
         }
         catch (error) {
             if (!isPendingJoinConflict(error)) {
@@ -7533,12 +8157,12 @@ export class CadreNode {
                 throw new Error(`A removed join request for this invitation (${requested.Id}) is still held on this machine until its ` +
                     'clean-up runs, which needs a connection to the party. Ask again once connected.', { cause: error });
             }
-            if (existing.Outcome === null) {
+            if (existing.outcome === null) {
                 return existing;
             }
-            written = await database.replacePendingJoin(existing.StampId, requested, ownerKey, signMessage);
+            written = await database.rewritePendingJoin(existing.StampId, { ...requested, outcome: null }, ownerKey, signMessage);
         }
-        this.pendingJoinRunner?.noteWritten(written);
+        this.pendingJoinRunner?.noteWritten(written, 'request');
         return written;
     }
     /** Build and start the pending-join retry loop over this node (see {@link pendingJoinRunner}). */
@@ -7554,15 +8178,19 @@ export class CadreNode {
             selfId: this.controlNode.peerId.toString(),
             linkRoundTripMs: this.config.network?.linkRoundTripMs,
             isOwner: async () => (await this.enrolledOwnerSigningKey()) !== null,
-            // NOTE: one owner-key read and one `PendingJoin` read per pass (30 s); for a party that never
-            // asked for a join the second reads a never-written block, which consults the cohort. If it
-            // shows up in a device profile, poll more slowly while the table reads empty.
+            // NOTE: one owner-key read and one pending-join read (three tables) per pass (30 s); for a
+            // party that never asked for a join the second reads never-written blocks, which consults
+            // the cohort. If it shows up in a device profile, poll more slowly while the tables read empty.
             readRows: () => database().queryPendingJoins(),
             readRow: (id) => database().queryPendingJoin(id),
-            attempt: (row) => this.formStrand(this.pendingJoinInvitation(row), parseStoredDisclosure(row)),
-            replace: async (expectedStampId, next) => {
+            attempt: (join) => this.formStrand(this.pendingJoinInvitation(join), parseStoredDisclosure(join)),
+            record: async (expected, outcome) => {
+                const { ownerKey, signMessage } = await outcomeSigner();
+                return database().recordJoinOutcome(expected, outcome, ownerKey, signMessage);
+            },
+            rewrite: async (expectedStampId, next) => {
                 const { ownerKey, signMessage } = await outcomeSigner();
-                return database().replacePendingJoin(expectedStampId, next, ownerKey, signMessage);
+                return database().rewritePendingJoin(expectedStampId, next, ownerKey, signMessage);
             },
             remove: async (id) => {
                 const { ownerKey, signMessage } = await outcomeSigner();
@@ -7575,33 +8203,33 @@ export class CadreNode {
         });
         this.pendingJoinRunner.start();
     }
-    /** The invitation a `PendingJoin` row stores. A failure names the row, never the invitation, which is a bearer credential. */
-    pendingJoinInvitation(row) {
+    /** The invitation a `JoinRequest` row stores. A failure names the row, never the invitation, which is a bearer credential. */
+    pendingJoinInvitation(join) {
         try {
-            return this.decodeInvitation(row.Invitation);
+            return this.decodeInvitation(join.Invitation);
         }
         catch {
-            throw new Error(`PendingJoin ${row.Id}: the stored invitation does not decode`);
+            throw new Error(`JoinRequest ${join.Id}: the stored invitation does not decode`);
         }
     }
-    pendingJoinSAppId(row) {
+    pendingJoinSAppId(join) {
         try {
-            return this.decodeInvitation(row.Invitation).sAppId;
+            return this.decodeInvitation(join.Invitation).sAppId;
         }
         catch {
-            log('PendingJoin %s: the stored invitation does not decode; reporting no sApp', row.Id);
+            log('JoinRequest %s: the stored invitation does not decode; reporting no sApp', join.Id);
             return '';
         }
     }
     /**
-     * Stage the membership invitation of each `joined` row this process has not staged yet, so a
+     * Stage the membership invitation of each joined request this process has not staged yet, so a
      * closed strand joined on another owner machine is seated by whichever machine launches it
      * first; the party key it admits is the replicated `StrandPartyKey` row the finishing machine
      * seated. A strand that already has an invitation staged keeps it, for the reconciler to
      * settle first.
      */
-    stageMembershipInvitesFromPendingJoins(rows) {
-        for (const { rowId, strandId, invite } of membershipInvitesToStage(rows, this.stagedMembershipInviteKeys, Date.now())) {
+    stageMembershipInvitesFromPendingJoins(joins) {
+        for (const { rowId, strandId, invite } of membershipInvitesToStage(joins, this.stagedMembershipInviteKeys, Date.now())) {
             this.stagedMembershipInviteKeys.add(invite.inviteKey);
             if (this.pendingMembershipInvites.has(strandId)) {
                 continue;