@serfab/cadre-core 1.13.0 → 1.14.0

package/dist/control-database.js

@@ -1,13 +1,14 @@
 import debug from 'debug';
 import { toString as uint8ArrayToString } from 'uint8arrays';
-import { Database, registerPlugin } from '@quereus/quereus';
+import { Database, FunctionFlags, TEXT_RETURN, createScalarFunction, registerPlugin } from '@quereus/quereus';
 import cryptoPlugin from '@optimystic/quereus-plugin-crypto/plugin';
 import optimysticPlugin from '@optimystic/quereus-plugin-optimystic/plugin';
 import { digest, randomBytes } from '@optimystic/quereus-plugin-crypto';
 import { CONTROL_SCHEMA } from './control-schema.js';
 import { canonicalDatetime } from './canonical-datetime.js';
-import { controlAuthorizationFields, CONTROL_TABLES } from './control-authorization.js';
-import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, CONTROL_TABLES } from './control-authorization.js';
+import { ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { verifyCadreInviteRow } from './peer-authorization.js';
 import { retryControlWrite, SCHEMA_INIT_RETRY_POLICY } from './control-write-retry.js';
 import { isCohortUnreachableRead, retryControlRead } from './control-read-retry.js';
 import { chainMessages } from './control-retry.js';
@@ -75,13 +76,15 @@ export class FormationAbortedError extends Error {
     }
 }
 /**
- * The invitation's seat budget is already spent: the count of recorded `FormationUsage` rows
- * for the token has reached `FormationInvite.TotalUses`, so this redemption cannot be given a
- * seat.
+ * The invitation's seat budget is already spent: the count of recorded usage rows for the
+ * invitation has reached its `TotalUses`, so this redemption cannot be given a seat. `token`
+ * is the `FormationInvite.Token` or the `CadreInvite.Key`, whichever table the caller
+ * redeemed against.
  *
  * Raised off the committed-count check ({@link ControlDatabase.assertSeatRemains}) ahead of
  * the write, inside {@link ControlDatabase.redeemInvitation} /
- * {@link ControlDatabase.recordFormationUsage}, and off the unlocked pre-check
+ * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
+ * ({@link ControlDatabase.redeemCadreInvite}), and off the unlocked pre-check
  * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
  * pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
@@ -101,6 +104,23 @@ export class InvitationExhaustedError extends Error {
         this.name = 'InvitationExhaustedError';
     }
 }
+/**
+ * {@link ControlDatabase.seatCadreInvite} was refused by `CadreInvite.AuthorizedInsert`: the
+ * row's `IssuerKey` is not an owner on THIS node, or its `IssuerSig` does not verify. The
+ * common cause is the first — the issuing owner's `OwnerKey` row has not replicated here yet,
+ * or that owner has since been removed — which is why the redemption protocol maps this to a
+ * retryable code; a tampered row fails the same way and simply never succeeds.
+ */
+export class CadreInviteIssuerUnknownError extends Error {
+    constructor(inviteKey, issuerKey, options) {
+        super(`Cadre invitation ${inviteKey} cannot be seated here: its issuer ${issuerKey} is not an owner on this node, or its signature does not verify`, options);
+        this.inviteKey = inviteKey;
+        this.issuerKey = issuerKey;
+        this.name = 'CadreInviteIssuerUnknownError';
+    }
+}
+/** The refusal {@link CadreInviteIssuerUnknownError} wraps — the constraint named, as the engine words it. */
+const CADRE_INVITE_UNAUTHORIZED = /CHECK constraint failed: AuthorizedInsert\b/;
 /**
  * Parse a stored Quereus `datetime` value into epoch milliseconds.
  *
@@ -132,14 +152,14 @@ function parseNullableStoredDatetimeMs(value) {
  * The message is a SINGLE framed SHA-256 digest over the ordered field vector from
  * {@link controlAuthorizationFields} (the crypto plugin's injective multi-field
  * encoding): two fixed literals — the domain tag naming the table rule and the action
- * tag — followed by the row fields in the schema's fixed order, with the single-use
- * StampId as the final field where the table has one:
+ * tag — then the party id, then the row fields in the schema's fixed order, with the
+ * single-use StampId as the final field where the table has one:
  *
- *   message = sha256(encodeFields([domain, action, field_1, ..., StampId]))   // raw digest bytes
+ *   message = sha256(encodeFields([domain, action, partyId, field_1, ..., StampId]))   // raw digest bytes
  *
  * ed25519 signs these raw digest bytes DIRECTLY (no second hash). The SQL constraints
  * verify the identical bytes with one variadic call
- * (`verify(digest('CadreControl.X', 'add', field_1, ...), context.Signature, A.Key, 'ed25519')`):
+ * (`verify(digest('CadreControl.X', 'add', party_id(), field_1, ...), context.Signature, A.Key, 'ed25519')`):
  * SQL `digest(...)` returns the base64url string of the same digest, which `verify`'s default
  * base64url input encoding decodes back to those raw bytes — so signer and verifier
  * operate on the same bytes. Every field is TEXT on both sides (the SQL columns are
@@ -147,12 +167,43 @@ function parseNullableStoredDatetimeMs(value) {
  * type tags agree. Binding the row contents closes captured-stamp replay; the leading
  * domain/action tags scope the signature to ONE table rule, so an approval minted for
  * one constraint can never satisfy another (e.g. a ValidationKey enrollment can no
- * longer double as an OwnerKey enrollment). Single source of truth: every signed writer
- * (and every test/harness signer) MUST build the message through this function with the
- * schema's tags and field order, or `verify` will reject the row.
+ * longer double as an OwnerKey enrollment); the party id scopes it to ONE party, so two
+ * parties sharing an owner key never accept each other's approvals. `partyId` is the
+ * party the signer is configured for, and the SQL side reads its own through the
+ * node-local `party_id()` ({@link registerPartyIdFunction}). Single source of truth:
+ * every signed writer (and every test/harness signer) MUST build the message through
+ * this function with the schema's tags and field order, or `verify` will reject the row.
+ */
+export function buildAuthorizationMessage(domain, action, partyId, rowFields) {
+    return digest(controlAuthorizationFields(domain, action, partyId, rowFields), 'sha256', 'bytes');
+}
+/**
+ * {@link buildAuthorizationMessage} for the two party-free digests (`UnboundControlDomain`):
+ * the same framed digest with no party id after the tags.
+ */
+function buildUnboundAuthorizationMessage(domain, action, rowFields) {
+    return digest(unboundAuthorizationFields(domain, action, rowFields), 'sha256', 'bytes');
+}
+/**
+ * Register the zero-argument scalar `party_id()` on `db`: the party id this machine is
+ * configured for, which every party-bound `digest(...)` in the control schema puts third.
+ * Node-local by design — a `context` value would be the writer's choice (a cohort member
+ * that re-ran the statement would replay it as a literal), and a stored `Party` table would
+ * be replicated data the schema already treats as untrusted. A cohort member that re-runs a
+ * statement therefore evaluates its OWN party id, and the schema text stays identical for
+ * every party. Each `Database` carries its own registration, so a process serving two
+ * parties holds two.
+ *
+ * NOTE: flagged deterministic, so the planner may fold the call into a plan; plans are
+ * per `Database` today. If Quereus ever shares plans across `Database` instances, drop
+ * the DETERMINISTIC flag or one party's id would be folded into another's checks.
+ *
+ * `ControlDatabase.initialize` calls this before hydrating persisted schemas, because a
+ * warm restart parses the persisted CHECK text, which calls it. Exported for specs that
+ * build their own `Database` around a copy of a bound constraint.
  */
-export function buildAuthorizationMessage(domain, action, rowFields) {
-    return digest(controlAuthorizationFields(domain, action, rowFields), 'sha256', 'bytes');
+export function registerPartyIdFunction(db, partyId) {
+    db.registerFunction(createScalarFunction({ name: 'party_id', numArgs: 0, flags: FunctionFlags.UTF8 | FunctionFlags.DETERMINISTIC, returnType: TEXT_RETURN }, () => partyId));
 }
 /**
  * The exact bytes an outside approver signs to authorize ONE redemption of a
@@ -169,9 +220,13 @@ export function buildAuthorizationMessage(domain, action, rowFields) {
  * that same nonce, then pass BOTH the nonce and the signature to
  * {@link ControlDatabase.redeemInvitation} / {@link ControlDatabase.recordFormationUsage}:
  * signing one nonce and inserting another fails the CHECK.
+ *
+ * No party id, unlike every owner digest: the approver is sent only these five fields
+ * (`formation-approval.ts`), and the `token` it binds is a random secret seated in one
+ * party's `FormationInvite` table (the schema's `FormationUsage.Authorized` comment).
  */
 export function formationVouchMessage(fields) {
-    return buildAuthorizationMessage('CadreControl.FormationUsage', 'vouch', [
+    return buildUnboundAuthorizationMessage('CadreControl.FormationUsage', 'vouch', [
         fields.token, fields.usageStampId, fields.strandId, fields.peerKey, fields.disclosure,
     ]);
 }
@@ -191,13 +246,48 @@ export function formationVouchMessage(fields) {
  * the strand when it signs (a bound invite's host strand arrives only in the result
  * frame; an unbound strand is minted by the responder). The responder cannot
  * substitute one anyway — a bound invite is pinned to its own strand by `Authorized`,
- * and an unbound redemption mints a fresh strand, so there is no victim to name.
+ * and an unbound redemption mints a fresh strand, so there is no victim to name. The
+ * party id is absent for the same reason (it too arrives only in the result frame) and
+ * the `token` scopes the digest to one party instead, as for {@link formationVouchMessage}.
  */
 export function formationConsentMessage(fields) {
-    return buildAuthorizationMessage('CadreControl.FormationUsage', 'consent', [
+    return buildUnboundAuthorizationMessage('CadreControl.FormationUsage', 'consent', [
         fields.token, fields.usageStampId, fields.peerKey, fields.disclosure,
     ]);
 }
+/**
+ * The exact bytes an owner signs to seat a `CadreInvite` row — the TS mirror of the `'add'`
+ * digest in `CadreInvite.AuthorizedInsert`, over the whole row in the schema's order with
+ * nullable columns as `''` (`cadreInviteRowFields`, shared with the base64url verifier
+ * `peer-authorization.ts`'s `cadreInviteAddDigest`). `expiresAt` must already be the stored
+ * canonical `datetime` string ({@link canonicalDatetime}), as {@link ControlDatabase.insertCadreInvite}
+ * produces it, or the signed segment will not match what the CHECK sees after coercion.
+ */
+export function cadreInviteAddMessage(partyId, row) {
+    return buildAuthorizationMessage('CadreControl.CadreInvite', 'add', partyId, cadreInviteRowFields(row));
+}
+/**
+ * The exact bytes the HOLDER of a cadre invitation signs, with the invitation's private key,
+ * to redeem it once — the TS mirror of the `'redeem'` digest `CadreInviteUsage.InvitePossessed`
+ * verifies against the invitation's public key. Binding the device and the nonce means a
+ * captured redemption can admit no other device and spend no other use.
+ */
+export function cadreInviteRedeemMessage(partyId, fields) {
+    return buildAuthorizationMessage('CadreControl.CadreInviteUsage', 'redeem', partyId, [
+        fields.inviteKey, fields.usageStampId, fields.peerKey,
+    ]);
+}
+/**
+ * The exact bytes the DEVICE signs, with its own key, to consent to being admitted by one
+ * redemption — the TS mirror of the `'consent'` digest `CadreInviteUsage.PeerConsented`
+ * verifies against `PeerKey`. Same fields as {@link cadreInviteRedeemMessage} under a
+ * distinct action tag, so neither signature can stand in for the other.
+ */
+export function cadreInviteConsentMessage(partyId, fields) {
+    return buildAuthorizationMessage('CadreControl.CadreInviteUsage', 'consent', partyId, [
+        fields.inviteKey, fields.usageStampId, fields.peerKey,
+    ]);
+}
 /** Runtime guard for the dynamic-`from` count, over the one table list. */
 const CONTROL_TABLE_SET = new Set(CONTROL_TABLES);
 /**
@@ -213,14 +303,33 @@ const GUARDED_KEY_COLUMN = {
     Strand: 'Id',
     StrandPartyKey: 'Id',
     JoinedStrand: 'Id',
-    PendingJoin: 'Id',
+    JoinRequest: 'Id',
     DeviceToken: 'PeerId',
+    CadreInvite: 'Key',
 };
-function signGuardedRemoval(tableName, rowKey, stampId, signMessage) {
+/**
+ * The exact bytes an owner signs to append one `Revocation` tombstone — `Revocation.Authorized`
+ * binds the whole (TableName, RowKey, StampId) row under its own domain tag. Shared by every
+ * tombstone writer (a guarded removal, a `CadreInvite` withdrawal, the ledger marker) so the
+ * field order lives in one place; the base64url verifier is `peer-authorization.ts`'s
+ * `revocationDigest`.
+ */
+function revocationTombstoneMessage(partyId, ref) {
+    return buildAuthorizationMessage('CadreControl.Revocation', 'remove', partyId, [ref.tableName, ref.rowKey, ref.stampId]);
+}
+/**
+ * The exact bytes an owner signs to seat a further `OwnerKey` row (the signed-add branch of
+ * `OwnerKey.Authorized`); the base64url twin is `peer-authorization.ts`'s `ownerKeyAddDigest`.
+ */
+function ownerKeyAddMessage(partyId, key, stampId) {
+    return buildAuthorizationMessage('CadreControl.OwnerKey', 'add', partyId, [key, stampId]);
+}
+function signGuardedRemoval(partyId, tableName, rowKey, stampId, signMessage) {
+    const ref = { tableName, rowKey, stampId };
     return {
-        ref: { tableName, rowKey, stampId },
-        signature: signMessage(buildAuthorizationMessage(`CadreControl.${tableName}`, 'remove', [rowKey, stampId])),
-        revocationSignature: signMessage(buildAuthorizationMessage('CadreControl.Revocation', 'remove', [tableName, rowKey, stampId])),
+        ref,
+        signature: signMessage(buildAuthorizationMessage(`CadreControl.${tableName}`, 'remove', partyId, [rowKey, stampId])),
+        revocationSignature: signMessage(revocationTombstoneMessage(partyId, ref)),
     };
 }
 /**
@@ -254,8 +363,8 @@ export function isStrandIdConflict(error, table) {
     return errorChainMatches(error, idConflictPattern(table));
 }
 /**
- * Did {@link ControlDatabase.insertPendingJoin} fail because the party already holds a
- * `PendingJoin` row for this invitation? The caller adopts the existing row instead.
+ * Did {@link ControlDatabase.insertJoinRequest} fail because the party already holds a
+ * `JoinRequest` row for this invitation? The caller adopts the existing request instead.
  * Text-matched, failing closed, like {@link isStrandIdConflict}.
  *
  * NOTE: the existing row may be one {@link ControlDatabase.queryPendingJoin} hides (its stamp
@@ -263,10 +372,10 @@ export function isStrandIdConflict(error, table) {
  * until the next reap pass.
  */
 export function isPendingJoinConflict(error) {
-    return errorChainMatches(error, idConflictPattern('PendingJoin'));
+    return errorChainMatches(error, idConflictPattern('JoinRequest'));
 }
 /**
- * The `PendingJoin.Id` of an invitation: the base64url sha256 `digest` of its token. One row
+ * The `JoinRequest.Id` of an invitation: the base64url sha256 `digest` of its token. One row
  * per invitation, and the `Revocation` tombstone that names a removed row carries this, never
  * the bearer token itself.
  */
@@ -274,17 +383,15 @@ export function pendingJoinId(token) {
     return digest([token], 'sha256', 'base64url');
 }
 /**
- * {@link ControlDatabase.replacePendingJoin} found that the live `PendingJoin` row is not the
- * incarnation the caller read: another write replaced or removed it first (a sibling machine
- * recorded an outcome, or the user dismissed the join). Nothing was written; the caller
- * re-reads and decides again. `liveStampId` is null when the row is gone.
+ * A pending-join write found that the live join is not the one the caller read: another write
+ * recorded an outcome, asked again or dismissed it first. Nothing was written; the caller
+ * decides again from `live`, which is null when the request is gone.
  */
 export class PendingJoinChangedError extends Error {
-    constructor(id, expectedStampId, liveStampId) {
-        super(`PendingJoin ${id} changed: expected stamp ${expectedStampId}, found ${liveStampId ?? 'no row'}`);
+    constructor(id, live) {
+        super(`Pending join ${id} changed: ${live === null ? 'no request' : `request ${live.StampId}, ${live.outcome?.kind ?? 'pending'}`}`);
         this.id = id;
-        this.expectedStampId = expectedStampId;
-        this.liveStampId = liveStampId;
+        this.live = live;
         this.name = 'PendingJoinChangedError';
     }
 }
@@ -315,6 +422,49 @@ function isRevocationLedgerConflict(error) {
 function errorChainMatches(error, pattern) {
     return error instanceof Error && chainMessages(error).some(message => pattern.test(message));
 }
+/**
+ * Project `CadrePeer` rows into the {@link SeedPeer} list a seed, or a cadre invitation
+ * redemption reply, carries.
+ *
+ * Owner identity is sourced from the `OwnerKey` table, not from the transport peer id. An
+ * Ed25519 libp2p peer id embeds its public key (identity multihash), so each peer's ed25519
+ * key is derivable from its `PeerId`; a peer is an owner iff that derived key is in
+ * `ownerKeys`. This makes any owner node markable — not just the local one. A non-Ed25519
+ * or unparsable id yields a non-owner rather than failing the whole projection.
+ *
+ * NOTE: this is the one owner lookup deliberately left on the REPLICATED table rather than
+ * the node-local anchor. `SeedPeer.isOwner` is a dial hint — the receiver dials owner-flagged
+ * peers first — not a trust decision, and the receiver re-derives real trust from its own
+ * anchor. So a polluted table costs at most a wasted dial, while anchoring here would
+ * silently drop legitimate co-owners this node never pinned. If `isOwner` ever gates
+ * anything the receiver TRUSTS, move it to the anchor.
+ */
+export function projectSeedPeers(rows, ownerKeys) {
+    return rows.map(({ peerId, multiaddr }) => {
+        const pubKeyB64 = ed25519PublicKeyB64FromPeerId(peerId);
+        const isOwner = pubKeyB64 !== null && ownerKeys.has(pubKeyB64);
+        return {
+            peerId,
+            multiaddrs: multiaddr ? multiaddr.split(',') : [],
+            isOwner,
+            ...(isOwner ? { publicKey: pubKeyB64 } : {}),
+        };
+    });
+}
+/**
+ * The conditions a cadre invitation must still meet to be redeemed, short of its use count:
+ * not withdrawn, unexpired (`expiresAt <= now` is expired, as the redemption refuses it),
+ * and issued by a current owner. Shared by {@link ControlDatabase.hasLiveCadreInvite},
+ * {@link ControlDatabase.isCadreInviteLive} and {@link ControlDatabase.listCadreInviteStatuses}
+ * so they cannot drift from each other, or from `CadreInviteUsage.Authorized`.
+ */
+function cadreInviteStillOpen(row, withdrawn, owners, nowMs) {
+    if (withdrawn.has(row.stampId) || !owners.has(row.issuerKey)) {
+        return false;
+    }
+    const expiresAtMs = parseNullableStoredDatetimeMs(row.expiresAt);
+    return expiresAtMs === null || expiresAtMs > nowMs;
+}
 /**
  * Guarded tables a node may reap locally once their tombstone has committed — the
  * tables whose `AuthorizedDelete` carries the REAP branch (see the constraint comment on
@@ -323,21 +473,54 @@ function errorChainMatches(error, pattern) {
  * secrets stored nowhere else (tickets/backlog/debt-strand-tombstone-reap.md owns any
  * future change). `JoinedStrand` also carries a `MemberPrivateKey` but IS reapable: that
  * secret is the joined strand's shared read key, which its founding party and every member
- * hold, so a reaped row is recoverable by re-forming. `PendingJoin` is reapable for the same
+ * hold, so a reaped row is recoverable by re-forming. `JoinRequest` is reapable for the same
  * reason: the inviting party and the user also hold its invitation. `OwnerKey` has no
  * production removal path and `MinOneOwner` makes an automated owner-key reap a
- * party-bricking hazard.
+ * party-bricking hazard. `CadreInvite` is never deleted at all (its tombstone is a
+ * withdrawal over a row that stays), so there is nothing to reap.
  */
-export const REAPABLE_TABLES = ['CadrePeer', 'DeviceToken', 'ValidationKey', 'JoinedStrand', 'PendingJoin'];
+export const REAPABLE_TABLES = ['CadrePeer', 'DeviceToken', 'ValidationKey', 'JoinedStrand', 'JoinRequest'];
 /**
  * Runtime membership test for {@link REAPABLE_TABLES}, narrowing a tombstone's
  * `TableName` to the subset {@link ControlDatabase.reapRevokedRow} accepts. A tombstone
- * naming an excluded table (`Strand`, `OwnerKey`) is skipped silently — `Strand`
- * tombstones are the common case in a party that has unpublished a strand, so a log line
- * per skip would be per-pass noise.
+ * naming an excluded table (`Strand`, `OwnerKey`, `CadreInvite`) is skipped silently —
+ * `Strand` tombstones are the common case in a party that has unpublished a strand, so a
+ * log line per skip would be per-pass noise.
  */
 const REAPABLE_TABLE_SET = new Set(REAPABLE_TABLES);
 const isReapableTable = (table) => REAPABLE_TABLE_SET.has(table);
+/** Every `CadreInvite` column, in the order {@link cadreInviteRowOf} reads them; callers append their `where`. */
+const CADRE_INVITE_SELECT_SQL = 'select Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.CadreInvite';
+/**
+ * A stored `CadreInvite` row as a {@link CadreInviteRow}. `ExpiresAt` is kept as the
+ * engine-canonical string it reads back as — the form the `'add'` signature covers — never
+ * parsed to ms here; `GrantsOwner` is the schema's 0/1 integer.
+ */
+function cadreInviteRowOf(row) {
+    return {
+        key: row.Key,
+        peerId: row.PeerId ?? null,
+        grantsOwner: Number(row.GrantsOwner) === 1,
+        expiresAt: row.ExpiresAt == null ? null : String(row.ExpiresAt),
+        totalUses: row.TotalUses ?? null,
+        issuerKey: row.IssuerKey,
+        issuerSig: row.IssuerSig,
+        stampId: row.StampId,
+    };
+}
+/** A stored `CadreInviteUsage` row as a {@link CadreInviteUsageRow}. */
+function cadreInviteUsageRowOf(row) {
+    return {
+        usageStampId: row.UsageStampId,
+        inviteKey: row.InviteKey,
+        peerId: row.PeerId,
+        peerKey: row.PeerKey,
+        peerStampId: row.PeerStampId,
+        ownerStampId: row.OwnerStampId ?? null,
+        inviteSig: row.InviteSig,
+        peerSig: row.PeerSig,
+    };
+}
 /** A `JoinedStrand` row as a {@link StrandRow}; the schema's `KnownType` check backs the `Type` cast. */
 function joinedStrandRow(row) {
     return {
@@ -347,47 +530,79 @@ function joinedStrandRow(row) {
         FounderOwnerKey: null,
     };
 }
-/** Every `PendingJoin` column, in the schema's order. */
-const PENDING_JOIN_COLUMNS = 'Id, Invitation, Disclosure, RequestedAt, ExpiresAt, Outcome, OutcomeAt, StrandId, MembershipInvite, FailureCode, FailureReason, StampId';
-const PENDING_JOIN_INSERT_SQL = `
-  insert into CadreControl.PendingJoin (${PENDING_JOIN_COLUMNS})
+const JOIN_REQUEST_INSERT_SQL = `
+  insert into CadreControl.JoinRequest (Id, Invitation, Disclosure, RequestedAt, ExpiresAt, StampId)
+    with context OwnerKey = ?, Signature = ?
+    values (?, ?, ?, ?, ?, ?)
+`;
+const JOIN_SUCCESS_INSERT_SQL = `
+  insert into CadreControl.JoinSuccess (RequestStampId, RecordedAt, StrandId, MembershipInvite)
+    with context OwnerKey = ?, Signature = ?
+    values (?, ?, ?, ?)
+`;
+const JOIN_FAILURE_INSERT_SQL = `
+  insert into CadreControl.JoinFailure (RequestStampId, RecordedAt, Code, Reason)
     with context OwnerKey = ?, Signature = ?
-    values (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    values (?, ?, ?, ?)
+`;
+/**
+ * A request with its outcome in one statement: the outcome tables are keyed by the request's
+ * stamp, so the join finds exactly this incarnation's outcome.
+ */
+const PENDING_JOIN_SELECT_SQL = `
+  select R.Id, R.Invitation, R.Disclosure, R.RequestedAt, R.ExpiresAt, R.StampId,
+         S.RecordedAt as JoinedAt, S.StrandId, S.MembershipInvite,
+         F.RecordedAt as FailedAt, F.Code, F.Reason
+    from CadreControl.JoinRequest R
+      left join CadreControl.JoinSuccess S on S.RequestStampId = R.StampId
+      left join CadreControl.JoinFailure F on F.RequestStampId = R.StampId
 `;
-/** A `PendingJoin` row as read; the schema's `KnownOutcome` check backs the `Outcome` cast. */
-function pendingJoinRow(row) {
+/** A {@link PENDING_JOIN_SELECT_SQL} row as read. */
+function pendingJoinOf(row) {
     return {
         Id: row.Id,
         Invitation: row.Invitation,
         Disclosure: row.Disclosure,
         RequestedAt: row.RequestedAt,
         ExpiresAt: row.ExpiresAt,
-        Outcome: row.Outcome,
-        OutcomeAt: row.OutcomeAt,
-        StrandId: row.StrandId,
-        MembershipInvite: row.MembershipInvite,
-        FailureCode: row.FailureCode,
-        FailureReason: row.FailureReason,
         StampId: row.StampId,
+        outcome: joinOutcomeOf(row),
     };
 }
+/** The outcome half of a {@link PENDING_JOIN_SELECT_SQL} row; a request never has both (`JoinSuccess.NoFailure`, `JoinFailure.NotJoined`). */
+function joinOutcomeOf(row) {
+    if (typeof row.JoinedAt === 'number') {
+        return { kind: 'joined', RecordedAt: row.JoinedAt, StrandId: row.StrandId, MembershipInvite: row.MembershipInvite };
+    }
+    if (typeof row.FailedAt === 'number') {
+        return { kind: 'failed', RecordedAt: row.FailedAt, Code: row.Code, Reason: row.Reason };
+    }
+    return null;
+}
+/** The fields `JoinRequest.AuthorizedInsert` signs, in the schema's order; integers sign as their text. */
+function joinRequestAddFields(row) {
+    return [row.Id, row.Invitation, row.Disclosure, String(row.RequestedAt), String(row.ExpiresAt), row.StampId];
+}
 /**
- * The row fields `PendingJoin.AuthorizedInsert` signs, in the schema's order: a null column
- * signs as `''` and an integer as its text (`cast(... as text)` on the SQL side).
+ * The owner-signed insert of `outcome` for the request incarnation `requestStampId`: the
+ * `JoinSuccess` / `JoinFailure` row and the signature its `AuthorizedInsert` verifies, over the
+ * row's columns in the schema's order (a null column signs as `''`, an integer as its text).
  */
-function pendingJoinAddFields(row) {
-    return [
-        row.Id, row.Invitation, row.Disclosure, String(row.RequestedAt), String(row.ExpiresAt),
-        row.Outcome ?? '', row.OutcomeAt === null ? '' : String(row.OutcomeAt), row.StrandId ?? '',
-        row.MembershipInvite ?? '', row.FailureCode ?? '', row.FailureReason ?? '', row.StampId,
-    ];
-}
-/** The values of {@link PENDING_JOIN_INSERT_SQL}'s columns, in {@link PENDING_JOIN_COLUMNS} order. */
-function pendingJoinValues(row) {
-    return [
-        row.Id, row.Invitation, row.Disclosure, row.RequestedAt, row.ExpiresAt, row.Outcome, row.OutcomeAt,
-        row.StrandId, row.MembershipInvite, row.FailureCode, row.FailureReason, row.StampId,
-    ];
+function signJoinOutcomeInsert(partyId, requestStampId, outcome, ownerKey, signMessage) {
+    const at = String(outcome.RecordedAt);
+    const { table, sql, fields, values } = outcome.kind === 'joined'
+        ? {
+            table: 'JoinSuccess', sql: JOIN_SUCCESS_INSERT_SQL,
+            fields: [requestStampId, at, outcome.StrandId, outcome.MembershipInvite ?? ''],
+            values: [requestStampId, outcome.RecordedAt, outcome.StrandId, outcome.MembershipInvite],
+        }
+        : {
+            table: 'JoinFailure', sql: JOIN_FAILURE_INSERT_SQL,
+            fields: [requestStampId, at, outcome.Code, outcome.Reason],
+            values: [requestStampId, outcome.RecordedAt, outcome.Code, outcome.Reason],
+        };
+    const signature = signMessage(buildAuthorizationMessage(`CadreControl.${table}`, 'add', partyId, fields));
+    return { sql, params: [ownerKey, signature, ...values] };
 }
 /**
  * ControlDatabase manages the CadreControl schema using Quereus with Optimystic backend.
@@ -424,6 +639,9 @@ export class ControlDatabase {
          * backoff. Applied OVER the read policy's defaults but UNDER the call site's `label`.
          */
         this.controlReadRetryPacing = {};
+        if (typeof config.partyId !== 'string' || config.partyId.length === 0) {
+            throw new Error('ControlDatabase requires a non-empty partyId: every control approval is bound to it');
+        }
         this.config = config;
     }
     /**
@@ -459,6 +677,8 @@ export class ControlDatabase {
             this.db.registerFunction(func.schema);
         }
         timing('[controlDb] optimysticPlugin: %dms', Math.round(performance.now() - t0));
+        // Before hydrate: a warm restart parses the persisted CHECK text, which calls party_id().
+        registerPartyIdFunction(this.db, this.config.partyId);
         this.collectionFactory = pluginResult.collectionFactory;
         // Inject the libp2p node into the collection factory
         t0 = performance.now();
@@ -810,27 +1030,31 @@ export class ControlDatabase {
         return rows.length === 0 ? null : joinedStrandRow(rows[0]);
     }
     /**
-     * Every join this party asked for and has not dismissed (`CadreControl.PendingJoin`),
-     * pending or finished.
+     * Every join this party asked for and has not dismissed, pending or finished: each
+     * `CadreControl.JoinRequest` row with its `JoinSuccess` / `JoinFailure` row.
      *
-     * Rows whose `StampId` is retired in `Revocation` are dropped, as {@link queryCadrePeers}
-     * drops them: such a row is either a replaced or dismissed incarnation this node still
-     * holds until the reap sweep removes it, or one re-seated by a replayed approval on a node
-     * that had not yet seen the tombstone. Either way it must not bring a dismissed join back.
+     * A request whose `StampId` is retired in `Revocation` is dropped, as {@link queryCadrePeers}
+     * drops such rows: it is a re-asked or dismissed incarnation this node still holds until the
+     * reap sweep removes it, or one re-seated by a replayed approval on a node that had not yet
+     * seen the tombstone. Either way it must not bring a dismissed join back.
      */
     async queryPendingJoins() {
         this.ensureInitialized();
-        const revoked = await this.queryRevokedStamps('PendingJoin');
-        const rows = await this.readRows(`select ${PENDING_JOIN_COLUMNS} from CadreControl.PendingJoin`, undefined, 'pending-joins');
-        return rows.map(pendingJoinRow).filter(row => !revoked.has(row.StampId));
+        const revoked = await this.queryRevokedStamps('JoinRequest');
+        const rows = await this.readRows(PENDING_JOIN_SELECT_SQL, undefined, 'pending-joins');
+        return rows.map(pendingJoinOf).filter(join => !revoked.has(join.StampId));
     }
-    /** Single-row sibling of {@link queryPendingJoins}, with the same retired-stamp filter: the row with this id, or null. */
+    /** Single-row sibling of {@link queryPendingJoins}, with the same retired-stamp filter: the join with this id, or null. */
     async queryPendingJoin(id) {
         this.ensureInitialized();
-        const revoked = await this.queryRevokedStamps('PendingJoin');
-        const rows = await this.readRows(`select ${PENDING_JOIN_COLUMNS} from CadreControl.PendingJoin where Id = ?`, [id], 'pending-join');
-        const row = rows.length === 0 ? null : pendingJoinRow(rows[0]);
-        return row === null || revoked.has(row.StampId) ? null : row;
+        const revoked = await this.queryRevokedStamps('JoinRequest');
+        const join = await this.readPendingJoin(id, true);
+        return join === null || revoked.has(join.StampId) ? null : join;
+    }
+    /** The raw read behind {@link queryPendingJoin}, with no retired-stamp filter. `retry: false` inside a locked write body. */
+    async readPendingJoin(id, retry) {
+        const rows = await this.readRows(`${PENDING_JOIN_SELECT_SQL} where R.Id = ?`, [id], 'pending-join', retry);
+        return rows.length === 0 ? null : pendingJoinOf(rows[0]);
     }
     /**
      * Count rows in a CadreControl table as seen by THIS database instance.
@@ -863,6 +1087,9 @@ export class ControlDatabase {
     /**
      * Check whether any owner key exists in the control database.
      * Used to decide whether a fresh-party genesis insert is required.
+     *
+     * Deliberately RAW (no retired-stamp filter, unlike {@link getOwnerKeys}): the genesis
+     * insert is refused by the schema whenever any physical row exists, so this must see one.
      */
     async hasOwnerKey() {
         this.ensureInitialized();
@@ -893,14 +1120,65 @@ export class ControlDatabase {
      * trusted only if it is already enrolled here (see `SeedTrustPolicy`). It is
      * also the owner-identity source for `queryPeers`, decoupling owner
      * status from the libp2p transport peer ID.
-     */
-    async getOwnerKeys() {
+     *
+     * Rows whose `StampId` is retired in `CadreControl.Revocation` are excluded, as
+     * {@link queryCadrePeers} excludes them: `OwnerKey` is never reaped (`MinOneOwner` makes
+     * an automated reap able to empty the table), so a node that received the tombstone
+     * without the delete (a removal committed while the remover was alone, re-issued on growth)
+     * keeps the removed owner's physical row next to it. Without the filter a removed owner
+     * would still count as an owner in every membership snapshot and seed-trust read, still
+     * read as the issuer of a live invitation and still be preferred as a dial target. The
+     * write side filters for itself: every owner lookup in the schema disqualifies a row whose
+     * stamp is retired (`schemas/control.qsql` header), so a removed owner cannot sign here
+     * once its tombstone has arrived, row or no row.
+     *
+     * `retry: false` from a caller that reads under the write lock, for the reason on
+     * {@link queryCadrePeers}.
+     */
+    async getOwnerKeys(retry = true) {
+        return new Set((await this.queryOwnerKeyRows(retry)).map(row => row.key));
+    }
+    /**
+     * Every live `OwnerKey` row with its persisted proof ({@link OwnerKeyRow}) — what the
+     * trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`). Rows whose
+     * `StampId` is retired in `CadreControl.Revocation` are excluded here, as
+     * {@link queryCadrePeers} excludes them and for the reason on {@link getOwnerKeys}, which
+     * reads through this. A row with no stamp (the schema permits it; no writer produces one)
+     * is dropped too: no proof can bind to it, so no reader could ever derive it.
+     *
+     * `retry: false` from the membership-gate refresh, which runs as the control database's
+     * membership listener with that database's write lock held — the reason on
+     * {@link queryCadrePeers}; both reads here take the flag.
+     *
+     * @param retired - the retired `OwnerKey` stamps, when the caller has already read the
+     *   tombstones (`CadreNode.syncOwnerAnchor` reads {@link queryRevocations} for their
+     *   signers); omitted, they are read here. Before the ledger marker is filed every
+     *   `Revocation` read is a cohort consult, so the sync passing its own set keeps the
+     *   membership refresh at one such read for the anchor.
+     */
+    async queryOwnerKeyRows(retry = true, retired) {
         this.ensureInitialized();
-        const keys = new Set();
-        for (const row of await this.readRows('select Key from CadreControl.OwnerKey', undefined, 'owner-keys')) {
-            keys.add(row.Key);
+        const revoked = retired ?? await this.queryRevokedStamps('OwnerKey', retry);
+        const rows = [];
+        const sql = 'select Key, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.OwnerKey';
+        for (const row of await this.readRows(sql, undefined, 'owner-keys', retry)) {
+            const stampId = row.StampId ?? null;
+            if (stampId === null) {
+                log('queryOwnerKeyRows: dropping OwnerKey row %s with no StampId', row.Key);
+                continue;
+            }
+            if (revoked.has(stampId)) {
+                continue;
+            }
+            rows.push({
+                key: row.Key,
+                stampId,
+                vouchOwner: row.VouchOwner ?? null,
+                vouchSig: row.VouchSig ?? null,
+                vouchUsage: row.VouchUsage ?? null,
+            });
         }
-        return keys;
+        return rows;
     }
     /**
      * Enumerate the CadrePeer rows (cadre membership) for admin/membership reads.
@@ -942,7 +1220,7 @@ export class ControlDatabase {
         this.ensureInitialized();
         const revoked = await this.queryRevokedStamps('CadrePeer', retry);
         const rows = [];
-        for (const row of await this.readRows('select PeerId, Multiaddr, StampId, VouchOwner, VouchSig from CadreControl.CadrePeer', undefined, 'cadre-peers', retry)) {
+        for (const row of await this.readRows('select PeerId, Multiaddr, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.CadrePeer', undefined, 'cadre-peers', retry)) {
             const stampId = row.StampId ?? null;
             if (stampId !== null && revoked.has(stampId)) {
                 continue;
@@ -953,10 +1231,24 @@ export class ControlDatabase {
                 stampId,
                 vouchOwner: row.VouchOwner ?? null,
                 vouchSig: row.VouchSig ?? null,
+                vouchUsage: row.VouchUsage ?? null,
             });
         }
         return rows;
     }
+    /**
+     * The cadre's peers as a seed or a redemption reply carries them: every live `CadrePeer`
+     * row with its addresses, each flagged `isOwner` when the key behind its peer id is in
+     * the replicated `OwnerKey` table ({@link projectSeedPeers}).
+     *
+     * Read through {@link queryCadrePeers}, never a raw `CadrePeer` select, so a removed
+     * member's addresses are never packed into a seed or handed to a redeeming device as a
+     * dial hint: a revoked peer is off the addressable surface everywhere, and this is one of
+     * its exits.
+     */
+    async querySeedPeers() {
+        return projectSeedPeers(await this.queryCadrePeers(), await this.getOwnerKeys());
+    }
     /**
      * Every approver public key currently enrolled in `CadreControl.ValidationKey` — the
      * set a `ValidationUrl` redemption's approval signature must be signed by (see
@@ -1136,22 +1428,26 @@ export class ControlDatabase {
         }
     }
     /**
-     * Every locally-held `CadreControl.Revocation` tombstone — identity triple plus its
-     * `ReissuedAt` counter. Consumed by the cohort-growth re-issue sweep, which
-     * enumerates what this node holds before {@link reissueRevocations} re-broadcasts
-     * it, and by the reap sweep ({@link reapRevokedRows}). Plain scan with no `where`, so
-     * the composite-primary-key point-lookup hazard (see the statement comment in
+     * Every locally-held `CadreControl.Revocation` tombstone — identity triple, its
+     * `ReissuedAt` counter and the stored signer pair. Consumed by the cohort-growth re-issue
+     * sweep, which enumerates what this node holds before {@link reissueRevocations}
+     * re-broadcasts it, and by the reap sweep ({@link reapRevokedRows}). Plain scan with no
+     * `where`, so the composite-primary-key point-lookup hazard (see the statement comment in
      * {@link reissueRevocations}) does not arise. Unlocked, like every other read.
      *
      * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}): it retires nothing, so
      * neither sweep may reap or re-sign it, and skipping it keeps `RevocationRow.tableName`
      * a {@link RevocableTable}. Filtered on `TableName` alone, in TypeScript: `RowIsGone`
      * admits no other row under `'Revocation'`.
+     *
+     * `retry: false` from a caller that reads under the write lock, for the reason on
+     * {@link queryCadrePeers}.
      */
-    async queryRevocations() {
+    async queryRevocations(retry = true) {
         this.ensureInitialized();
         const rows = [];
-        for (const row of await this.readRows('select TableName, RowKey, StampId, ReissuedAt from CadreControl.Revocation', undefined, 'revocations')) {
+        const sql = 'select TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig from CadreControl.Revocation';
+        for (const row of await this.readRows(sql, undefined, 'revocations', retry)) {
             if (row.TableName === REVOCATION_LEDGER_MARKER.tableName) {
                 continue;
             }
@@ -1160,6 +1456,8 @@ export class ControlDatabase {
                 rowKey: row.RowKey,
                 stampId: row.StampId,
                 reissuedAt: row.ReissuedAt ?? 0,
+                signerKey: row.SignerKey,
+                signerSig: row.SignerSig,
             });
         }
         return rows;
@@ -1291,12 +1589,12 @@ export class ControlDatabase {
         log('Inserting owner key: %s', key);
         // Bootstrap is authorized by the schema's genesis branch — `(select count(1) from
         // committed.OwnerKey) = 0`, i.e. the party had no owner before this transaction — so no
-        // signature is needed. Every other branch of `OwnerKey.Authorized` requires a signature
-        // from a PRE-EXISTING owner, so this method only ever succeeds on a fresh party; seating
-        // a second owner (or removing one) has no writer here and must sign the digests
-        // documented on the schema's `Authorized` constraint. We still persist a fresh, unique
-        // StampId in the row's own column to satisfy the not-null/unique anti-replay constraint —
-        // the StampId is a real column value, not the optimystic `StampId()` SQL function.
+        // signature is needed. Every other branch of `OwnerKey.Authorized` requires a PRE-EXISTING,
+        // unretired owner, so this method only ever succeeds on a fresh party; a second
+        // owner is seated by {@link insertOwnerKeyVouched} and removed by {@link deleteOwnerKey}.
+        // We still persist a fresh, unique StampId in the row's own column to satisfy the
+        // not-null/unique anti-replay constraint — the StampId is a real column value, not the
+        // optimystic `StampId()` SQL function.
         const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
         await this.execWrite(`
       insert into CadreControl.OwnerKey (Key, StampId)
@@ -1305,6 +1603,88 @@ export class ControlDatabase {
     `, [key, stampId], 'owner-key-insert');
         log('Owner key inserted');
     }
+    /**
+     * Owner-signed INSERT of a further `OwnerKey` row, notifying the membership listener once
+     * it has committed. The signed-add branch of `OwnerKey.Authorized`: the signer must be an
+     * owner in the pre-transaction snapshot, its signature covers the `'add'` digest over
+     * (Key, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a reader
+     * can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
+     *
+     * Through {@link mutateCadrePeer}, the membership hub. The liveness read, the stamp and the
+     * signature all sit inside the locked body: a {@link lockedWithRetry} re-run starts over a
+     * rolled-back attempt with a fresh stamp, as {@link redeemCadreInvite} does.
+     *
+     * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
+     * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
+     * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
+     * would collide on the primary key. Re-add from the machine that removed the key, or any
+     * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
+     * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
+     *
+     * @returns `true` when this call seated the row, `false` when `key` is already a live owner
+     *   here (nothing written).
+     * @throws when this node holds `key`'s row under a retired stamp (above), or when the
+     *   schema refuses the signer.
+     */
+    async insertOwnerKeyVouched(key, ownerKey, signMessage) {
+        this.ensureInitialized();
+        return await this.mutateCadrePeer('owner-key-add', async () => {
+            // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
+            const heldStamp = await this.queryStampId('OwnerKey', key, false);
+            if (heldStamp !== null) {
+                if (!(await this.queryRevokedStamps('OwnerKey', false)).has(heldStamp)) {
+                    log('insertOwnerKeyVouched: %s is already an owner; nothing written', key);
+                    return false;
+                }
+                throw new Error(`Cannot re-add owner key ${key} here: this node still holds the row it was removed under ` +
+                    '(OwnerKey rows are not reaped); re-add it from the machine that removed it');
+            }
+            const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
+            const signature = signMessage(ownerKeyAddMessage(this.config.partyId, key, stampId));
+            // Bare `exec`: already inside the write lock, which is NOT re-entrant.
+            await this.db.exec(`
+        insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
+          with context OwnerKey = ?, Signature = ?
+          values (?, ?, ?, ?)
+      `, [ownerKey, signature, key, stampId, ownerKey, signature]);
+            log('Owner key %s added (vouched by %s)', key, ownerKey);
+            return true;
+        });
+    }
+    /**
+     * Owner-signed removal of one `OwnerKey` row plus the `Revocation` tombstone retiring its
+     * stamp, notifying the membership listener once it has committed. The remove branch of
+     * `OwnerKey.Authorized` requires a signer other than the removed key, and `MinOneOwner`
+     * keeps the table from emptying; both are refused by name here first, read from this
+     * node's live owners ({@link getOwnerKeys}), so a caller gets a clear error rather than a
+     * constraint failure. The schema stays the authority: a concurrent removal elsewhere can
+     * make the local count wrong in either direction, and then `MinOneOwner` or the tombstone's
+     * primary key decides (see the NOTE on {@link deleteGuardedRow}).
+     *
+     * Through {@link mutateCadrePeer}, the membership hub, which notifies whenever the body
+     * resolves, the absent-key answer included.
+     *
+     * @returns `true` when the row was removed, `false` when `key` is not a live owner here
+     *   (nothing written, no tombstone).
+     * @throws when `key` is `ownerKey`, or is the only live owner.
+     */
+    async deleteOwnerKey(key, ownerKey, signMessage) {
+        if (key === ownerKey) {
+            throw new Error(`Cannot remove owner key ${key}: an owner cannot remove itself`);
+        }
+        return await this.mutateCadrePeer('owner-key-remove', async () => {
+            // retry: false — inside the locked write body (see queryStampId's NOTE).
+            const owners = await this.getOwnerKeys(false);
+            if (!owners.has(key)) {
+                log('deleteOwnerKey: %s is not a live owner here (already absent)', key);
+                return false;
+            }
+            if (owners.size <= 1) {
+                throw new Error(`Cannot remove owner key ${key}: cannot remove the last owner`);
+            }
+            return await this.deleteGuardedRow('OwnerKey', key, ownerKey, signMessage);
+        });
+    }
     /**
      * Insert a strand into the control database using an owner signature.
      *
@@ -1334,7 +1714,7 @@ export class ControlDatabase {
         // Id, Type, MemberPrivateKey ('' when null), StampId. FounderOwnerKey is
         // deliberately NOT in the digest — the schema binds it by equality to the
         // verified context.OwnerKey instead (see the constraint's comment).
-        const message = buildAuthorizationMessage('CadreControl.Strand', 'add', [strandId, type, memberPrivateKey ?? '', stampId]);
+        const message = buildAuthorizationMessage('CadreControl.Strand', 'add', this.config.partyId, [strandId, type, memberPrivateKey ?? '', stampId]);
         const signature = signMessage(message);
         // StampId is a real, unique column (single-use anti-replay), no longer a context value.
         // FounderOwnerKey must equal the signing owner or the constraint rejects the row.
@@ -1396,10 +1776,10 @@ export class ControlDatabase {
             return false;
         }
         const partyKeyStamp = await this.queryStampId('StrandPartyKey', strandId, false);
-        const strandRemoval = signGuardedRemoval('Strand', strandId, strandStamp, signMessage);
+        const strandRemoval = signGuardedRemoval(this.config.partyId, 'Strand', strandId, strandStamp, signMessage);
         const partyKeyRemoval = partyKeyStamp === null
             ? null
-            : signGuardedRemoval('StrandPartyKey', strandId, partyKeyStamp, signMessage);
+            : signGuardedRemoval(this.config.partyId, 'StrandPartyKey', strandId, partyKeyStamp, signMessage);
         await this.inTransaction('delete Strand', async () => {
             await this.execGuardedRemoval(strandRemoval, ownerKey);
             if (partyKeyRemoval !== null) {
@@ -1436,7 +1816,7 @@ export class ControlDatabase {
         const stampId = generateStampId(peerId);
         // Field order MUST match the schema's StrandPartyKey `AuthorizedInsert` verify:
         // Id, PrivateKey, StampId.
-        const message = buildAuthorizationMessage('CadreControl.StrandPartyKey', 'add', [strandId, privateKey, stampId]);
+        const message = buildAuthorizationMessage('CadreControl.StrandPartyKey', 'add', this.config.partyId, [strandId, privateKey, stampId]);
         const signature = signMessage(message);
         await this.execWrite(`
       insert into CadreControl.StrandPartyKey (Id, PrivateKey, StampId)
@@ -1478,7 +1858,7 @@ export class ControlDatabase {
         const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
         // Field order MUST match the schema's JoinedStrand `AuthorizedInsert` verify:
         // Id, Type, MemberPrivateKey ('' when null), StampId.
-        const message = buildAuthorizationMessage('CadreControl.JoinedStrand', 'add', [row.Id, row.Type, row.MemberPrivateKey ?? '', stampId]);
+        const message = buildAuthorizationMessage('CadreControl.JoinedStrand', 'add', this.config.partyId, [row.Id, row.Type, row.MemberPrivateKey ?? '', stampId]);
         const signature = signMessage(message);
         await this.execWrite(`
       insert into CadreControl.JoinedStrand (Id, Type, MemberPrivateKey, StampId)
@@ -1497,76 +1877,124 @@ export class ControlDatabase {
         return this.lockedWithRetry(() => this.deleteGuardedRow('JoinedStrand', strandId, ownerKey, signMessage), {}, 'joined-strand-delete');
     }
     /**
-     * Record, party-wide, a join this party asked for (`PendingJoin` row), using an owner
-     * signature over every column of the row (see {@link pendingJoinAddFields}). Returns the
-     * row as written, with the fresh `StampId` a later {@link replacePendingJoin} names.
+     * Record, party-wide, a join this party asked for: a `JoinRequest` row under a fresh stamp,
+     * owner-signed over every column. Returns the pending join as written.
      *
-     * Fails with a `PendingJoin.Id` uniqueness violation when the party already holds a row for
-     * this invitation; {@link isPendingJoinConflict} identifies that case.
+     * Fails with a `JoinRequest.Id` uniqueness violation when the party already holds a request
+     * for this invitation; {@link isPendingJoinConflict} identifies that case.
      */
-    async insertPendingJoin(row, ownerKey, signMessage) {
+    async insertJoinRequest(request, ownerKey, signMessage) {
         this.ensureInitialized();
-        log('Inserting pending join: %s (outcome: %s)', row.Id, row.Outcome);
-        const { written, params } = this.signPendingJoinInsert(row, ownerKey, signMessage);
-        await this.execWrite(PENDING_JOIN_INSERT_SQL, params, 'pending-join-insert');
-        log('Pending join inserted: %s', row.Id);
-        return written;
+        const { written, insert } = this.signJoinRequestInsert(request, ownerKey, signMessage);
+        await this.execWrite(insert.sql, insert.params, 'join-request-insert');
+        log('Join request inserted: %s', request.Id);
+        return { ...written, outcome: null };
     }
     /**
-     * Replace the live `PendingJoin` row `next.Id` with `next`, under a fresh stamp — the only way
-     * an outcome is written, since the table refuses updates. Returns the row as written.
+     * Record the outcome of the pending join `expected`: its owner-signed `JoinSuccess` /
+     * `JoinFailure` row, keyed by the request's stamp. A join recorded over a failure deletes the
+     * failure row in the same transaction (the schema authorizes that delete by the join, and
+     * leaves the one-outcome rule in that direction to this writer). Returns the pending join as
+     * written.
      *
-     * One locked transaction deletes the row (owner-signed `'remove'` digest, with its
-     * `Revocation` tombstone) and inserts its successor, so no reader ever sees the id missing in
-     * between. The live row must still be the incarnation the caller read: when its `StampId` is
-     * not `expectedStampId`, or the row is gone, this throws {@link PendingJoinChangedError} and
-     * writes nothing. That check is local; a sibling machine's replacement or removal that lands
-     * between it and the commit fails the transaction instead (its tombstone for the same stamp,
-     * or its successor row, collides on a primary key), and the caller re-reads either way.
+     * The live join must still be what the caller read: the same request incarnation with the
+     * same outcome kind. Otherwise this throws {@link PendingJoinChangedError} and writes nothing.
+     * That check is local; a sibling machine's write landing between it and the commit fails the
+     * transaction instead (its outcome row collides on the primary key, or its tombstone retires
+     * the stamp), and the caller re-reads either way.
+     */
+    async recordJoinOutcome(expected, outcome, ownerKey, signMessage) {
+        this.ensureInitialized();
+        const insert = signJoinOutcomeInsert(this.config.partyId, expected.StampId, outcome, ownerKey, signMessage);
+        return this.lockedWithRetry(async () => {
+            const live = await this.readPendingJoin(expected.Id, false);
+            if (live === null || live.StampId !== expected.StampId || live.outcome?.kind !== expected.outcome?.kind) {
+                throw new PendingJoinChangedError(expected.Id, live);
+            }
+            await this.inTransaction('record join outcome', async () => {
+                if (live.outcome?.kind === 'failed') {
+                    await this.deleteJoinOutcome('JoinFailure', expected.StampId);
+                }
+                await this.db.exec(insert.sql, insert.params);
+            });
+            log('Join outcome recorded: %s (%s)', expected.Id, outcome.kind);
+            return { ...live, outcome };
+        }, {}, 'join-outcome-record');
+    }
+    /**
+     * Re-write the pending join `next` (request and outcome) under a fresh stamp, retiring the
+     * live request incarnation `expectedStampId`: how a finished request is asked for again, and
+     * how a join written while this machine was alone is re-broadcast. One locked transaction
+     * deletes the outcome row and the request (owner-signed `'remove'` digest, with its
+     * `Revocation` tombstone) and inserts the successors, so no reader ever sees the id missing in
+     * between. Throws {@link PendingJoinChangedError} and writes nothing when the live request is
+     * not `expectedStampId`.
      *
      * Signatures and the new stamp are minted before the lock, so a retried attempt re-presents
      * the same signed messages (the contract on {@link withWriteLock}). A retry after an attempt
-     * that committed but reported failure throws {@link PendingJoinChangedError} whose
-     * `liveStampId` is the returned row's own stamp, so a caller that re-reads finds its write.
+     * that committed but reported failure throws {@link PendingJoinChangedError} whose live join
+     * carries the returned stamp, so a caller that re-reads finds its write.
      */
-    async replacePendingJoin(expectedStampId, next, ownerKey, signMessage) {
+    async rewritePendingJoin(expectedStampId, next, ownerKey, signMessage) {
         this.ensureInitialized();
-        const id = next.Id;
-        const removal = signGuardedRemoval('PendingJoin', id, expectedStampId, signMessage);
-        const { written, params } = this.signPendingJoinInsert(next, ownerKey, signMessage);
+        const { outcome, ...request } = next;
+        const removal = signGuardedRemoval(this.config.partyId, 'JoinRequest', next.Id, expectedStampId, signMessage);
+        const { written, insert } = this.signJoinRequestInsert(request, ownerKey, signMessage);
+        const outcomeInsert = outcome === null ? null : signJoinOutcomeInsert(this.config.partyId, written.StampId, outcome, ownerKey, signMessage);
         return this.lockedWithRetry(async () => {
             // retry: false — this runs inside the locked write body (see queryStampId's NOTE).
-            const liveStampId = await this.queryStampId('PendingJoin', id, false);
+            const liveStampId = await this.queryStampId('JoinRequest', next.Id, false);
             if (liveStampId !== expectedStampId) {
-                throw new PendingJoinChangedError(id, expectedStampId, liveStampId);
+                throw new PendingJoinChangedError(next.Id, await this.readPendingJoin(next.Id, false));
             }
-            await this.inTransaction('replace PendingJoin', async () => {
+            await this.inTransaction('rewrite pending join', async () => {
+                await this.deleteJoinOutcomes(expectedStampId);
                 await this.execGuardedRemoval(removal, ownerKey);
-                await this.db.exec(PENDING_JOIN_INSERT_SQL, params);
+                await this.db.exec(insert.sql, insert.params);
+                if (outcomeInsert !== null) {
+                    await this.db.exec(outcomeInsert.sql, outcomeInsert.params);
+                }
             });
-            log('Pending join replaced: %s (outcome: %s; stamp retired)', id, next.Outcome);
+            log('Pending join rewritten: %s (%s; stamp retired)', next.Id, outcome?.kind ?? 'pending');
             this.notifyGuardedDelete(removal.ref);
-            return written;
-        }, {}, 'pending-join-replace');
+            return { ...written, outcome };
+        }, {}, 'pending-join-rewrite');
     }
     /**
-     * Owner-signed removal of one `PendingJoin` row, as {@link deleteJoinedStrand} removes its
-     * row: `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same
-     * transaction. A no-op (no throw, no tombstone) when the row does not exist — `false` then,
-     * `true` when a row was actually removed.
+     * Owner-signed removal of one pending join, as {@link deleteJoinedStrand} removes its row:
+     * `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same transaction,
+     * and the request's outcome row with it. A no-op (no throw, no tombstone) when there is no
+     * request — `false` then, `true` when one was actually removed.
      */
     deletePendingJoin(id, ownerKey, signMessage) {
-        return this.lockedWithRetry(() => this.deleteGuardedRow('PendingJoin', id, ownerKey, signMessage), {}, 'pending-join-delete');
+        return this.lockedWithRetry(() => this.deleteGuardedRow('JoinRequest', id, ownerKey, signMessage, (stampId) => this.deleteJoinOutcomes(stampId)), {}, 'pending-join-delete');
     }
     /**
-     * Mint a fresh stamp for `row` and the owner signature `PendingJoin.AuthorizedInsert`
-     * verifies, returning the row as it will be written and the parameters of
-     * {@link PENDING_JOIN_INSERT_SQL}.
+     * Mint a fresh stamp for `request` and the owner signature `JoinRequest.AuthorizedInsert`
+     * verifies, returning the row as it will be written and its insert.
      */
-    signPendingJoinInsert(row, ownerKey, signMessage) {
-        const written = { ...row, StampId: generateStampId(this.config.libp2pNode.peerId.toString()) };
-        const signature = signMessage(buildAuthorizationMessage('CadreControl.PendingJoin', 'add', pendingJoinAddFields(written)));
-        return { written, params: [ownerKey, signature, ...pendingJoinValues(written)] };
+    signJoinRequestInsert(request, ownerKey, signMessage) {
+        const written = { ...request, StampId: generateStampId(this.config.libp2pNode.peerId.toString()) };
+        const signature = signMessage(buildAuthorizationMessage('CadreControl.JoinRequest', 'add', this.config.partyId, joinRequestAddFields(written)));
+        const params = [ownerKey, signature, written.Id, written.Invitation, written.Disclosure, written.RequestedAt, written.ExpiresAt, written.StampId];
+        return { written, insert: { sql: JOIN_REQUEST_INSERT_SQL, params } };
+    }
+    /**
+     * Remove the outcome row of the request incarnation `requestStampId`, whichever table holds
+     * it. Unsigned: the schema authorizes the delete by the tombstone retiring that stamp, filed
+     * in the same transaction or already committed (a reap).
+     */
+    async deleteJoinOutcomes(requestStampId) {
+        await this.deleteJoinOutcome('JoinSuccess', requestStampId);
+        await this.deleteJoinOutcome('JoinFailure', requestStampId);
+    }
+    /** One unsigned outcome delete (see {@link deleteJoinOutcomes}; a failure's is also authorized by the join superseding it). */
+    async deleteJoinOutcome(table, requestStampId) {
+        await this.db.exec(`
+      delete from CadreControl.${table}
+        with context OwnerKey = null, Signature = null
+        where RequestStampId = ?
+    `, [requestStampId]);
     }
     /**
      * Insert a validation key into the control database using an owner signature.
@@ -1587,7 +2015,7 @@ export class ControlDatabase {
         const peerId = this.config.libp2pNode.peerId.toString();
         const stampId = generateStampId(peerId);
         // Field order MUST match the schema's ValidationKey `AuthorizedInsert` verify: Key, StampId.
-        const message = buildAuthorizationMessage('CadreControl.ValidationKey', 'add', [key, stampId]);
+        const message = buildAuthorizationMessage('CadreControl.ValidationKey', 'add', this.config.partyId, [key, stampId]);
         const signature = signMessage(message);
         await this.execWrite(`
       insert into CadreControl.ValidationKey (Key, StampId)
@@ -1657,7 +2085,7 @@ export class ControlDatabase {
         // Stamp is minted from the ADMITTED peer's id, not this node's — the nonce names the
         // row it vouches.
         const stampId = generateStampId(row.peerId);
-        const signature = signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', [row.peerId, stampId]));
+        const signature = signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [row.peerId, stampId]));
         return await this.mutateCadrePeer('peer-insert', async () => {
             // retry: false — this guard runs inside the locked write body (see queryStampId's NOTE).
             if (await this.queryStampId('CadrePeer', row.peerId, false) !== null) {
@@ -1710,6 +2138,11 @@ export class ControlDatabase {
      * change the member set. Keeping the rule uniform ("every CadrePeer mutator notifies")
      * beats a per-method exception the next reader has to relearn.
      *
+     * Also clears `VouchUsage`: a row carries exactly one proof (the owner branch of
+     * `AuthorizedUpdate` requires it null), so re-vouching an invitation-admitted row moves it
+     * onto the signature and its invitation is no longer consulted for it — the way an owner
+     * retires a device's dependency on an invitation it may later withdraw.
+     *
      * NOTE: this rebinds VouchOwner to the CALLING owner's key, and the authorized-membership
      * predicate (`CadreNode.listAuthorizedMembers`) now judges rows by that column against each
      * reader's node-local anchor. Benign today because the only caller — the write-while-alone
@@ -1733,13 +2166,13 @@ export class ControlDatabase {
             log('reauthorizeCadrePeer: no CadrePeer row for %s (nothing to re-touch)', peerId);
             return false;
         }
-        const signature = signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', [peerId, stampId]));
+        const signature = signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, stampId]));
         await this.mutateCadrePeer('peer-reauthorize', async () => {
             // Bare `exec` — inside the non-re-entrant write lock (see insertCadrePeer).
             await this.db.exec(`
         update CadreControl.CadrePeer
           with context OwnerKey = ?, Signature = ?
-          set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?
+          set UpdatedAt = ?, VouchOwner = ?, VouchSig = ?, VouchUsage = null
           where PeerId = ?
       `, [ownerKey, signature, updatedAt, ownerKey, signature, peerId]);
         });
@@ -1788,15 +2221,9 @@ export class ControlDatabase {
      * Owner-signed delete of one guarded row plus the `Revocation` tombstone retiring its
      * stamp, in ONE transaction. The single body behind EVERY guarded delete —
      * {@link deleteStrand}, {@link deleteValidationKey}, {@link deleteCadrePeer},
-     * {@link deleteDeviceToken}; see any of them for the per-table security rationale. Each
-     * of those is a thin named wrapper, so callers never pass a table name and this
-     * generic shape stays off the public surface.
-     *
-     * `OwnerKey` is excluded from `table` only because no owner-key removal path exists in
-     * production yet — the schema has the `'remove'` branch (`OwnerKey.Authorized`, which
-     * requires a DIFFERENT owner as signer) and `control-revocation-replay.spec.ts` drives
-     * it with hand-rolled SQL. Widen this and add a wrapper when that path lands; the body
-     * needs no change.
+     * {@link deleteDeviceToken}, {@link deleteOwnerKey}; see any of them for the per-table
+     * security rationale. Each of those is a thin named wrapper, so callers never pass a
+     * table name and this generic shape stays off the public surface.
      *
      * The row's CURRENT stamp is read first and signed over, so the remove digest binds to
      * this exact row instance. A no-op (no throw, no tombstone) when the row is absent —
@@ -1804,6 +2231,9 @@ export class ControlDatabase {
      * second read (e.g. {@link CadreNode.unpublishStrand}'s committed-while-alone warning,
      * which must not fire for a no-op).
      *
+     * `alongside`, when given, runs inside the transaction before the removal, for a table whose
+     * row has dependants the schema requires removed with it ({@link deletePendingJoin}).
+     *
      * NOTE: the stamp read is outside the transaction. A concurrent writer that removes
      * the row in between makes the signature bind a stamp that is no longer live; the
      * delete then matches nothing and the tombstone insert collides with the other
@@ -1814,7 +2244,7 @@ export class ControlDatabase {
      * Deliberately NOT wrapped in {@link withWriteLock}: every public entry point already
      * holds the (non-re-entrant) lock, so taking it again here would self-deadlock.
      */
-    async deleteGuardedRow(table, keyValue, ownerKey, signMessage) {
+    async deleteGuardedRow(table, keyValue, ownerKey, signMessage, alongside) {
         this.ensureInitialized();
         // retry: false — this runs inside the locked write body (see queryStampId's NOTE).
         const stampId = await this.queryStampId(table, keyValue, false);
@@ -1822,8 +2252,11 @@ export class ControlDatabase {
             log('delete %s: no row for %s (already absent)', table, keyValue);
             return false;
         }
-        const removal = signGuardedRemoval(table, keyValue, stampId, signMessage);
-        await this.inTransaction(`delete ${table}`, () => this.execGuardedRemoval(removal, ownerKey));
+        const removal = signGuardedRemoval(this.config.partyId, table, keyValue, stampId, signMessage);
+        await this.inTransaction(`delete ${table}`, async () => {
+            await alongside?.(stampId);
+            await this.execGuardedRemoval(removal, ownerKey);
+        });
         log('%s deleted: %s (stamp retired)', table, keyValue);
         this.notifyGuardedDelete(removal.ref);
         return true;
@@ -1831,7 +2264,7 @@ export class ControlDatabase {
     /**
      * Delete the row incarnation `removal` names and file its tombstone — the statement pair
      * every owner removal of a guarded row runs ({@link deleteGuardedRow},
-     * {@link deleteStrandAndPartyKey}, {@link replacePendingJoin}). The caller supplies the
+     * {@link deleteStrandAndPartyKey}, {@link rewritePendingJoin}). The caller supplies the
      * transaction: the schema's `RevocationRecorded` check refuses the delete unless the
      * tombstone commits with it.
      *
@@ -1848,14 +2281,28 @@ export class ControlDatabase {
         with context OwnerKey = ?, Signature = ?
         where ${GUARDED_KEY_COLUMN[tableName]} = ? and StampId = ?
     `, [ownerKey, removal.signature, rowKey, stampId]);
-        // ReissuedAt named explicitly at 0 (the only value FreshTombstone accepts) rather
-        // than leaning on the column default — the seat-at-zero rule is load-bearing for
-        // reissueRevocations' monotonic bump, so state it at the write site.
+        await this.execTombstone(removal.ref, removal.revocationSignature, ownerKey);
+    }
+    /**
+     * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
+     * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of a
+     * `CadreInvite` withdrawal ({@link withdrawCadreInvite}), whose row stays — or the ledger
+     * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
+     * lock and, where one is needed, the transaction.
+     *
+     * `ReissuedAt` is named explicitly at 0 (the only value `FreshTombstone` accepts) rather
+     * than leaning on the column default — the seat-at-zero rule is load-bearing for
+     * {@link reissueRevocations}' monotonic bump, so state it at the write site.
+     *
+     * `SignerKey` / `SignerSig` store the context pair (`Revocation.Authorized` pins them
+     * equal), so a node that receives the row by replication can tell which owner filed it.
+     */
+    async execTombstone(ref, revocationSignature, ownerKey) {
         await this.db.exec(`
-      insert into CadreControl.Revocation (TableName, RowKey, StampId, ReissuedAt)
+      insert into CadreControl.Revocation (TableName, RowKey, StampId, ReissuedAt, SignerKey, SignerSig)
         with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, 0)
-    `, [ownerKey, removal.revocationSignature, tableName, rowKey, stampId]);
+        values (?, ?, ?, 0, ?, ?)
+    `, [ownerKey, revocationSignature, ref.tableName, ref.rowKey, ref.stampId, ownerKey, revocationSignature]);
     }
     /**
      * Fire the guarded-delete listener for one committed tombstone, swallowing (and
@@ -1956,6 +2403,16 @@ export class ControlDatabase {
             // in one pass, hoist the notify to one refresh after the sweep instead.
             await this.mutateCadrePeer('peer-reap', () => this.db.exec(sql, [rowKey, stampId]));
         }
+        else if (table === 'JoinRequest') {
+            // The request's outcome row goes with it; the committed tombstone authorizes that delete
+            // too. An outcome row held for a request this node never received (the request was
+            // written alone and its outcome connected, before the growth-edge re-issue) is left: it
+            // is unreadable, since every reader starts from the request.
+            await this.lockedWithRetry(() => this.inTransaction('reap JoinRequest', async () => {
+                await this.deleteJoinOutcomes(stampId);
+                await this.db.exec(sql, [rowKey, stampId]);
+            }), {}, 'reap-JoinRequest');
+        }
         else {
             await this.execWrite(sql, [rowKey, stampId], `reap-${table}`);
         }
@@ -1994,7 +2451,7 @@ export class ControlDatabase {
      *   reads from this node (every other node already filters it by tombstone). A revoked
      *   node therefore keeps its own copy of its own row; "a node that learns it has been
      *   revoked should shut itself down" is a distinct behaviour and its own ticket.
-     *   `ValidationKey`, `JoinedStrand` and `PendingJoin` have no self notion and are not
+     *   `ValidationKey`, `JoinedStrand` and `JoinRequest` have no self notion and are not
      *   special-cased.
      *
      * A per-row failure is logged and skipped rather than aborting the sweep: an abort would
@@ -2083,7 +2540,7 @@ export class ControlDatabase {
         // and every digest field is TEXT on both sides (see buildAuthorizationMessage).
         const signed = rows.map((row) => ({
             row,
-            signature: signMessage(buildAuthorizationMessage('CadreControl.Revocation', 'reissue', [row.tableName, row.rowKey, row.stampId, String(reissuedAt)])),
+            signature: signMessage(buildAuthorizationMessage('CadreControl.Revocation', 'reissue', this.config.partyId, [row.tableName, row.rowKey, row.stampId, String(reissuedAt)])),
         }));
         return this.lockedWithRetry(async () => {
             // Counter lives INSIDE the locked body so a lockedWithRetry re-run (which
@@ -2149,19 +2606,14 @@ export class ControlDatabase {
      */
     async openRevocationLedger(ownerKey, signMessage) {
         this.ensureInitialized();
-        const { tableName, rowKey, stampId } = REVOCATION_LEDGER_MARKER;
-        const signature = signMessage(buildAuthorizationMessage('CadreControl.Revocation', 'remove', [tableName, rowKey, stampId]));
+        const signature = signMessage(revocationTombstoneMessage(this.config.partyId, REVOCATION_LEDGER_MARKER));
         try {
             return await this.lockedWithRetry(async () => {
                 if (await this.revocationLedgerFiled()) {
                     return 'already-open';
                 }
-                // Bare `exec`: already inside the write lock, which is NOT re-entrant.
-                await this.db.exec(`
-          insert into CadreControl.Revocation (TableName, RowKey, StampId)
-            with context OwnerKey = ?, Signature = ?
-            values (?, ?, ?)
-        `, [ownerKey, signature, tableName, rowKey, stampId]);
+                // execTombstone is a bare `exec`: already inside the write lock, which is NOT re-entrant.
+                await this.execTombstone(REVOCATION_LEDGER_MARKER, signature, ownerKey);
                 log('Revocation ledger marker filed');
                 return 'opened';
             }, {}, 'revocation-ledger-open');
@@ -2258,15 +2710,18 @@ export class ControlDatabase {
         this.controlWriteAbandonedListener = listener;
     }
     /**
-     * Run a `CadrePeer` row mutation and notify the membership listener once it has
+     * Run a membership-relevant mutation and notify the membership listener once it has
      * COMMITTED.
      *
-     * EVERY `CadrePeer` writer goes through here, with one documented exception
-     * ({@link updateSelfPeerRecord}, which cannot change the snapshot) — that is what makes
-     * the party-membership snapshot refresh automatic rather than a caller obligation. A
+     * Covers every write that can change who is a member or an owner: EVERY `CadrePeer`
+     * writer, with one documented exception ({@link updateSelfPeerRecord}, which cannot
+     * change the snapshot), the `OwnerKey` writers ({@link insertOwnerKeyVouched},
+     * {@link deleteOwnerKey}) and the invitation redemption ({@link redeemCadreInvite}),
+     * which seats both. That is what makes the party-membership snapshot refresh automatic
+     * rather than a caller obligation. The name predates the `OwnerKey` writers. A
      * writer necessarily holds the target node's ControlDatabase (the `SeedBootstrapService`'s
-     * event callbacks are NOT a viable seam: the temp services `CadreNode.applySeed`/
-     * `dialInvite` build, and services constructed outside `CadreNode` entirely, never get
+     * event callbacks are NOT a viable seam: the temp service `CadreNode.applySeed`
+     * builds, and services constructed outside `CadreNode` entirely, never get
      * callbacks wired), so this is the one point on the write path that cannot be bypassed.
      *
      * `body` owns its own transaction if it needs one and must COMMIT before returning, so
@@ -2447,7 +2902,7 @@ export class ControlDatabase {
             return;
         }
         throw new Error(`mutateCadrePeer(${reason}): a transaction is open ${where} the mutation body — a ` +
-            'CadrePeer write must commit before the membership listener runs; move the ' +
+            'membership write must commit before the membership listener runs; move the ' +
             'mutateCadrePeer wrapper out to enclose the commit');
     }
     /**
@@ -2526,7 +2981,7 @@ export class ControlDatabase {
         const strandIdField = options.strandId ?? '';
         // Field order MUST match the schema's FormationInvite `AuthorizedInsert` verify:
         // Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId, StampId.
-        const message = buildAuthorizationMessage('CadreControl.FormationInvite', 'add', [
+        const message = buildAuthorizationMessage('CadreControl.FormationInvite', 'add', this.config.partyId, [
             token, sAppId, expiresAtField, totalUsesField, validationUrlField, strandIdField, stampId,
         ]);
         const signature = signMessage(message);
@@ -2860,6 +3315,389 @@ export class ControlDatabase {
         }
         return false;
     }
+    // ── Cadre invitations (CadreInvite / CadreInviteUsage) ─────────────────────────────────
+    /**
+     * Mint and insert an owner-signed `CadreInvite`: an invitation to join THIS cadre that any
+     * member machine can later redeem on the owner's behalf ({@link redeemCadreInvite}).
+     *
+     * The owner signs the whole row ({@link cadreInviteAddMessage}) — `ExpiresAt` through
+     * {@link canonicalDatetime} so the signed segment byte-matches the stored `datetime`, as
+     * {@link insertFormationInvite} does — and the stored `IssuerKey`/`IssuerSig` are pinned to
+     * that signer by `CadreInvite.AuthorizedInsert`. The signature is part of the row because
+     * the row travels: the returned {@link CadreInviteRow} is what the invitation bundle
+     * carries to the holder, and {@link seatCadreInvite} re-inserts it verbatim on a member
+     * that has not received it by replication.
+     *
+     * `key` is the invitation's ed25519 PUBLIC key; the caller minted the pair and hands the
+     * private half to the invitee out of band. It is never stored here (`Strand.Invite` has the
+     * same shape).
+     *
+     * @param invite.key - the invitation public key (base64url ed25519), the row's primary key
+     * @param invite.peerId - the device the invitation is for, or null for whoever redeems first
+     * @param invite.grantsOwner - whether redemption also seats an `OwnerKey` row for the device
+     * @param invite.expiresAtMs - epoch ms after which it cannot be redeemed; omit for never
+     * @param invite.totalUses - how many redemptions it allows; omit for unlimited
+     * @returns the row as stored, `expiresAt` in its canonical form
+     */
+    async insertCadreInvite(invite, ownerKey, signMessage) {
+        this.ensureInitialized();
+        const key = requireEd25519PublicKeyB64(invite.key, 'cadre invitation key');
+        const signed = {
+            key,
+            peerId: invite.peerId ?? null,
+            grantsOwner: invite.grantsOwner,
+            expiresAt: invite.expiresAtMs == null ? null : await canonicalDatetime(this.db, invite.expiresAtMs),
+            totalUses: invite.totalUses ?? null,
+            stampId: generateStampId(this.config.libp2pNode.peerId.toString()),
+        };
+        const row = {
+            ...signed,
+            issuerKey: ownerKey,
+            issuerSig: signMessage(cadreInviteAddMessage(this.config.partyId, signed)),
+        };
+        await this.lockedWithRetry(() => this.execCadreInviteInsert(row), {}, 'cadre-invite-insert');
+        log('Cadre invitation inserted: %s (peer=%s owner=%s)', key, row.peerId ?? 'any', row.grantsOwner);
+        return row;
+    }
+    /**
+     * Seat an owner-signed `CadreInvite` row received inside an invitation bundle, under its own
+     * stored `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, so a member that
+     * already holds the row (by replication, or from an earlier redemption attempt) is a no-op.
+     *
+     * @returns `true` when this call inserted the row, `false` when it was already present.
+     * @throws {CadreInviteIssuerUnknownError} when `CadreInvite.AuthorizedInsert` refuses it: the
+     *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
+     *   not verify. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     */
+    async seatCadreInvite(row) {
+        this.ensureInitialized();
+        try {
+            return await this.lockedWithRetry(async () => {
+                // retry: false — inside the locked write body (see queryStampId's NOTE).
+                if (await this.queryStampId('CadreInvite', row.key, false) !== null) {
+                    log('CadreInvite %s already seated; seat skipped', row.key);
+                    return false;
+                }
+                await this.execCadreInviteInsert(row);
+                log('Cadre invitation seated from its bundle: %s', row.key);
+                return true;
+            }, {}, 'cadre-invite-seat');
+        }
+        catch (error) {
+            if (errorChainMatches(error, CADRE_INVITE_UNAUTHORIZED)) {
+                throw new CadreInviteIssuerUnknownError(row.key, row.issuerKey, { cause: error });
+            }
+            throw error;
+        }
+    }
+    /** Bare `CadreInvite` insert shared by {@link insertCadreInvite} and {@link seatCadreInvite}; the caller holds the lock. */
+    async execCadreInviteInsert(row) {
+        await this.db.exec(`
+      insert into CadreControl.CadreInvite (Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?, ?, ?, ?)
+    `, [
+            row.issuerKey, row.issuerSig,
+            row.key, row.peerId, row.grantsOwner ? 1 : 0, row.expiresAt, row.totalUses,
+            row.issuerKey, row.issuerSig, row.stampId,
+        ]);
+    }
+    /**
+     * Read one `CadreInvite` row by key, or null when absent. Withdrawn rows are returned too —
+     * the row is the holder's proof and never goes away; liveness is {@link hasLiveCadreInvite}'s
+     * question, and `CadreInviteUsage.Authorized`'s at redemption.
+     *
+     * `retry: false` is passed by {@link redeemCadreInvite}, which reads INSIDE its locked write
+     * body — the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
+     */
+    async queryCadreInvite(key, retry = true) {
+        this.ensureInitialized();
+        for (const row of await this.readRows(`${CADRE_INVITE_SELECT_SQL} where Key = ?`, [key], 'cadre-invite', retry)) {
+            return cadreInviteRowOf(row);
+        }
+        return null;
+    }
+    /**
+     * Every `CadreInvite` row this node holds, withdrawn and expired ones included (see
+     * {@link queryCadreInvite}). Read by the membership predicate when at least one `CadrePeer`
+     * row is invitation-admitted; `retry: false` is forwarded from
+     * {@link CadreNode.listAuthorizedMembers} on the membership-gate refresh path for
+     * {@link queryCadrePeers}' reason.
+     */
+    async queryCadreInvites(retry = true) {
+        this.ensureInitialized();
+        const rows = await this.readRows(CADRE_INVITE_SELECT_SQL, undefined, 'cadre-invites', retry);
+        return rows.map(cadreInviteRowOf);
+    }
+    /**
+     * Every `CadreInviteUsage` row this node holds — the redemption records the membership
+     * predicate verifies invitation-admitted rows against. Same `retry` contract as
+     * {@link queryCadreInvites}.
+     */
+    async queryCadreInviteUsages(retry = true) {
+        this.ensureInitialized();
+        const rows = await this.readRows('select UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig from CadreControl.CadreInviteUsage', undefined, 'cadre-invite-usages', retry);
+        return rows.map(cadreInviteUsageRowOf);
+    }
+    /**
+     * How many times a cadre invitation has been redeemed (its `CadreInviteUsage` rows), served
+     * through the `CadreInviteUsageByInvite` index. As {@link countFormationUsage}: a permissive
+     * PRE-check, not the cap — the cap is `CadreInviteUsage.Authorized`'s own committed count.
+     *
+     * `retry: false` is passed by {@link assertCadreInviteSeatRemains}, inside the locked body.
+     */
+    async countCadreInviteUsage(key, retry = true) {
+        this.ensureInitialized();
+        const sql = 'select count(1) as Count from CadreControl.CadreInviteUsage where InviteKey = ?';
+        for (const row of await this.readRows(sql, [key], 'cadre-invite-usage-count', retry)) {
+            return row.Count ?? 0;
+        }
+        return 0;
+    }
+    /**
+     * Is any cadre invitation still redeemable — not withdrawn, unexpired, with uses below its
+     * `TotalUses`, and issued by a current owner? The conditions `CadreInviteUsage.Authorized`
+     * applies, read ahead of time so the control-network connection gate can answer "does this
+     * node expect a stranger?" with no key to ask about, exactly as
+     * {@link hasOutstandingFormationInvite} answers it for strand formation. The expiry
+     * comparison is `expiresAtMs <= now`, so an invitation the redemption would refuse never
+     * holds the gate open.
+     *
+     * Withdrawal is read through {@link queryRevokedStamps}, the per-table retired-stamp seam
+     * every other revocation-aware reader uses (and the one an isolated node can still answer).
+     */
+    async hasLiveCadreInvite(nowMs = Date.now()) {
+        this.ensureInitialized();
+        // NOTE: getOwnerKeys reads the retired OwnerKey stamps first, so this gate path scans
+        // Revocation twice (once per table, the two in parallel). If the stranger path's decision
+        // ever nears the admission gate's 2 s deadline, read the retired stamps once for both.
+        const [withdrawn, owners] = await Promise.all([this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()]);
+        // NOTE: scans every CadreInvite row (expired and withdrawn ones included, since rows are
+        // never deleted) on the stranger path of an inbound connection. Cadre-scale invitation
+        // counts make that free today; if a long-lived cadre accumulates thousands and inbound
+        // upgrades slow down, add an expiry-ordered index or prune withdrawn/expired rows (which
+        // first needs every device they admitted re-vouched, so the chain no longer needs them).
+        const metered = [];
+        let unlimitedLive = false;
+        for (const row of await this.readRows('select Key, ExpiresAt, TotalUses, IssuerKey, StampId from CadreControl.CadreInvite', undefined, 'live-cadre-invites')) {
+            const open = cadreInviteStillOpen({ stampId: row.StampId, issuerKey: row.IssuerKey, expiresAt: row.ExpiresAt ?? null }, withdrawn, owners, nowMs);
+            if (!open) {
+                continue;
+            }
+            const totalUses = row.TotalUses ?? null;
+            if (totalUses === null) {
+                unlimitedLive = true;
+            }
+            else {
+                metered.push({ key: row.Key, totalUses });
+            }
+        }
+        if (unlimitedLive) {
+            return true;
+        }
+        // NOTE: one retried read per metered invitation, each with its own read budget, on a path
+        // the admission gate awaits under a 2 s fail-open deadline — the same shape and the same
+        // revisit condition as hasOutstandingFormationInvite's loop.
+        for (const invite of metered) {
+            if (await this.countCadreInviteUsage(invite.key) < invite.totalUses) {
+                return true;
+            }
+        }
+        return false;
+    }
+    /**
+     * Is this one cadre invitation still redeemable here — the conditions
+     * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is the one this node
+     * holds under `invite.key`; when it holds none, `invite` itself (a bundle's copy, not seated
+     * yet), but only if its issuer signature verifies, because an unsigned copy would otherwise be
+     * judged by whichever owner it names as issuer. A permissive pre-check like
+     * {@link countCadreInviteUsage}: {@link seatCadreInvite} and the redemption's own write are
+     * what enforce every condition.
+     */
+    async isCadreInviteLive(invite, nowMs = Date.now()) {
+        this.ensureInitialized();
+        const row = await this.queryCadreInvite(invite.key) ?? (verifyCadreInviteRow(this.config.partyId, invite) ? invite : null);
+        if (row === null) {
+            return false;
+        }
+        const [withdrawn, owners] = await Promise.all([this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()]);
+        if (!cadreInviteStillOpen(row, withdrawn, owners, nowMs)) {
+            return false;
+        }
+        return row.totalUses === null || await this.countCadreInviteUsage(row.key) < row.totalUses;
+    }
+    /**
+     * Every `CadreInvite` row this node holds with its standing: how many redemptions are
+     * recorded, whether it is withdrawn, and whether it is still redeemable — the same
+     * conditions {@link hasLiveCadreInvite} applies, answered per row for an owner's listing
+     * rather than short-circuited. One usage count per row, so this is the owner's
+     * occasional read, not a gate's.
+     */
+    async listCadreInviteStatuses(nowMs = Date.now()) {
+        this.ensureInitialized();
+        const [invites, withdrawnStamps, owners] = await Promise.all([
+            this.queryCadreInvites(), this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()
+        ]);
+        const statuses = [];
+        // NOTE: one retried count read per invitation, withdrawn and expired rows included, since
+        // rows are never deleted; if a long-lived cadre's listing ever shows as slow, group the
+        // usage counts in one statement or skip the count for rows that are no longer open.
+        for (const invite of invites) {
+            const usesRecorded = await this.countCadreInviteUsage(invite.key);
+            const withdrawn = withdrawnStamps.has(invite.stampId);
+            const live = cadreInviteStillOpen(invite, withdrawnStamps, owners, nowMs)
+                && (invite.totalUses === null || usesRecorded < invite.totalUses);
+            statuses.push({ invite, live, withdrawn, usesRecorded });
+        }
+        return statuses;
+    }
+    /**
+     * Owner-signed WITHDRAWAL of a cadre invitation: file the `Revocation` tombstone retiring its
+     * stamp, with the row kept. The row stays because every device the invitation admitted
+     * proves its membership through it (`CadrePeer.AuthorizedInsert`'s consent branch,
+     * `verifyInvitationAdmission`); `CadreInvite.NoDelete` refuses a delete, and
+     * `Revocation.RowIsGone` admits a `'CadreInvite'` tombstone while the row lives. Afterwards
+     * `CadreInviteUsage.Authorized` refuses every further redemption, and `CadreInvite.NotRevoked`
+     * refuses re-seating the row from the holder's signed copy on any node holding the
+     * tombstone.
+     *
+     * Idempotent: a no-op (no throw, nothing written) when the row is absent locally or already
+     * withdrawn — `false` then, `true` when this call filed the tombstone. The owner must hold the
+     * row to withdraw it, since the tombstone names the row's stamp.
+     *
+     * Fires the guarded-delete listener like a removal does, so a withdrawal committed while the
+     * node was alone is queued for re-issue on cohort growth ({@link CadreNode.noteGuardedDelete}).
+     */
+    async withdrawCadreInvite(key, ownerKey, signMessage) {
+        this.ensureInitialized();
+        const filed = await this.lockedWithRetry(async () => {
+            // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
+            const stampId = await this.queryStampId('CadreInvite', key, false);
+            if (stampId === null) {
+                log('withdrawCadreInvite: no CadreInvite row for %s (nothing to withdraw)', key);
+                return null;
+            }
+            if ((await this.queryRevokedStamps('CadreInvite', false)).has(stampId)) {
+                log('withdrawCadreInvite: %s already withdrawn (stamp %s retired)', key, stampId);
+                return null;
+            }
+            const ref = { tableName: 'CadreInvite', rowKey: key, stampId };
+            await this.execTombstone(ref, signMessage(revocationTombstoneMessage(this.config.partyId, ref)), ownerKey);
+            return ref;
+        }, {}, 'cadre-invite-withdraw');
+        if (filed === null) {
+            return false;
+        }
+        log('Cadre invitation withdrawn: %s (stamp %s retired, row kept)', key, filed.stampId);
+        this.notifyGuardedDelete(filed);
+        return true;
+    }
+    /**
+     * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member and,
+     * when the invitation grants ownership, as an owner — with NO owner signature. One
+     * transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`), the
+     * `OwnerKey` row when granted (consent branch of `Authorized`), and last the
+     * `CadreInviteUsage` row that authorizes both; the usage row's own checks (`PeerExists`,
+     * `OwnerExists`) read the rows back, so the three are mutually bound to this exact
+     * redemption and none can be held in reserve. The invitation must already be committed
+     * ({@link seatCadreInvite}): every consent branch reads `committed.CadreInvite`.
+     *
+     * The two signatures are the holder's and the device's, minted on the device over
+     * {@link cadreInviteRedeemMessage} / {@link cadreInviteConsentMessage}; this machine only
+     * verifies them (by writing the row). `peerId` must be the identity multihash of `peerKey`:
+     * the schema cannot derive it, so a writer asserts the pair and every reader re-derives it
+     * (`verifyInvitationAdmission`) — a mismatched pair is written and then never trusted.
+     *
+     * Idempotent for a retry after a dropped reply: when the device's row is already present
+     * (and its `OwnerKey` row too, when granted) nothing is written and no seat is spent —
+     * `alreadyMember: true`. A present row whose `OwnerKey` row is missing under an
+     * owner-granting invitation is completed: the usage row then names the existing peer stamp.
+     * The seat check ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a
+     * single-use redemption is answered `alreadyMember` rather than refused as exhausted.
+     *
+     * Through {@link mutateCadrePeer}, so the membership hub is notified; inside the locked body
+     * every read passes `retry: false` and every stamp is minted per attempt, so a
+     * {@link lockedWithRetry} re-run starts clean.
+     *
+     * @throws {InvitationExhaustedError} when the invitation's seats are all spent (by name,
+     *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains}).
+     */
+    async redeemCadreInvite(params) {
+        this.ensureInitialized();
+        const { inviteKey, peerId, peerKey, usageStampId, inviteSig, peerSig } = params;
+        const nowMs = params.nowMs ?? Date.now();
+        const multiaddr = params.multiaddrs?.length ? params.multiaddrs.join(',') : '';
+        log('Redeeming cadre invitation %s for %s', inviteKey, peerId);
+        return this.mutateCadrePeer('cadre-invite-redeem', async () => {
+            const invite = await this.queryCadreInvite(inviteKey, false);
+            if (invite === null) {
+                throw new Error(`Cannot redeem cadre invitation ${inviteKey}: no CadreInvite row is seated on this node (seatCadreInvite first)`);
+            }
+            const seated = await this.readSeatedAdmission(peerId, peerKey, invite.grantsOwner);
+            if (seated.peerStampId !== null && (!invite.grantsOwner || seated.ownerStampId !== null)) {
+                log('redeemCadreInvite: %s already admitted; nothing written', peerId);
+                return { alreadyMember: true, peerStampId: seated.peerStampId, ownerStampId: seated.ownerStampId };
+            }
+            await this.assertCadreInviteSeatRemains(invite);
+            // Stamps minted from the ADMITTED device's id, as insertCadrePeer does: the nonce names
+            // the row it seats. Minted inside the body, so a re-run mints afresh over a rolled-back
+            // attempt rather than re-presenting a stamp the usage row may already name.
+            const peerStampId = seated.peerStampId ?? generateStampId(peerId);
+            const ownerStampId = invite.grantsOwner ? (seated.ownerStampId ?? generateStampId(peerId)) : null;
+            const nowCanonical = await canonicalDatetime(this.db, nowMs);
+            await this.inTransaction('cadre-invite-redeem', async () => {
+                if (seated.peerStampId === null) {
+                    await this.db.exec(`
+            insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig, VouchUsage)
+              with context OwnerKey = null, Signature = null
+              values (?, ?, ?, ?, null, ?, ?, null, ?)
+          `, [peerId, peerKey, multiaddr, nowMs, peerStampId, invite.issuerKey, usageStampId]);
+                }
+                if (ownerStampId !== null && seated.ownerStampId === null) {
+                    await this.db.exec(`
+            insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig, VouchUsage)
+              with context OwnerKey = null, Signature = null
+              values (?, ?, ?, null, ?)
+          `, [peerKey, ownerStampId, invite.issuerKey, usageStampId]);
+                }
+                await this.db.exec(`
+          insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig)
+            with context Now = ?
+            values (?, ?, ?, ?, ?, ?, ?, ?)
+        `, [nowCanonical, usageStampId, inviteKey, peerId, peerKey, peerStampId, ownerStampId, inviteSig, peerSig]);
+            });
+            log('Redeemed cadre invitation %s: %s admitted (owner=%s, usage %s)', inviteKey, peerId, ownerStampId !== null, usageStampId);
+            return { alreadyMember: false, peerStampId, ownerStampId };
+        });
+    }
+    /**
+     * The rows a redemption would seat that are already present: the device's `CadrePeer`
+     * stamp, and — only when the invitation grants ownership — its `OwnerKey` stamp. Raw stamp
+     * reads ({@link queryStampId}), so a physically present row counts; inside the locked
+     * body, so never retried.
+     */
+    async readSeatedAdmission(peerId, peerKey, grantsOwner) {
+        return {
+            peerStampId: await this.queryStampId('CadrePeer', peerId, false),
+            ownerStampId: grantsOwner ? await this.queryStampId('OwnerKey', peerKey, false) : null,
+        };
+    }
+    /**
+     * Refuse a redemption that would consume a seat the cadre invitation does not have, by
+     * name ({@link InvitationExhaustedError}) — the cadre-invitation twin of
+     * {@link assertSeatRemains}, for the same reason: the schema's cap clause refuses as a
+     * generic `Authorized` failure a caller would otherwise report as retryable. Reads the
+     * committed count inside the locked body, so on a same-node race the loser is refused here.
+     */
+    async assertCadreInviteSeatRemains(invite) {
+        if (invite.totalUses === null) {
+            return;
+        }
+        const used = await this.countCadreInviteUsage(invite.key, false);
+        if (used >= invite.totalUses) {
+            throw new InvitationExhaustedError(invite.key, used, invite.totalUses);
+        }
+    }
     /**
      * Close the database and cleanup resources.
      *