@serfab/cadre-core 1.13.0 → 1.15.0

package/src/cadre-node.ts

@@ -18,11 +18,10 @@ import type {
   CadreNodeEvents,
   ControlNetworkSeed,
   ApplySeedResult,
+  SeedAckMessage,
+  SeedDeliveryTarget,
   AddDroneOptions,
-  AddPhoneOptions,
   DroneInitResult,
-  InviteResult,
-  CadreInvite,
   OpenInvitation,
   FormStrandResult,
   StrandFormationDisclosure,
@@ -35,13 +34,27 @@ import type {
   DeviceTokenRecord,
   CadrePeerVoucherFields,
   CadrePeerRow,
+  OwnerKeyRow,
+  RevocationRow,
+  InvitationChain,
+  CadreInviteStatus,
+  CadreMachine,
+  MachineRemovalPlan,
+  MachineRemovalResult,
+  RemoveMachineOptions,
+  CadreRemoval,
+  CadreInvitationReach,
+  CreateCadreInvitationOptions,
+  CreateCadreInvitationResult,
+  RedeemCadreInvitationOptions,
+  RedeemCadreInvitationResult,
   PeerAddressRecord,
   ResolveDeviceTokenOpts,
-  PendingJoinRow,
+  PendingJoin,
   PendingJoinStatus
 } from './types.js';
 import { controlClusterPolicy, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS, DEFAULT_CONNECTION_MONITOR } from './types.js';
-import { sign } from '@optimystic/quereus-plugin-crypto';
+import { generatePrivateKey, sign } from '@optimystic/quereus-plugin-crypto';
 import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
 import { strandTransportKey } from './strand-transport-key.js';
 import {
@@ -64,21 +77,22 @@ import {
   JoinedStrandSession,
   KeyStoreJoinedStrandStore,
   MemoryJoinedStrandStore,
+  type JoinedStrandRecord,
   type JoinedStrandStore,
   type PartyJoinedStrandLedger
 } from './joined-strand-store.js';
 import { mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './peer-addr-book.js';
 import { strandFretPeerAddrs } from './strand-fret-addrs.js';
-import { verifyCadrePeerVoucher } from './peer-authorization.js';
-import { ed25519PublicKeyB64FromPeerId } from './seed-bootstrap.js';
+import { verifyCadrePeerVoucher, verifyInvitationAdmission, verifyRevocationSigner } from './peer-authorization.js';
+import { deriveOwnerAnchor } from './owner-anchor-sync.js';
+import { describeMachines, planMachineRemoval, revouchWithinPlan, MachineRemovalRefusedError } from './machine-removal.js';
+import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 import {
   signPeerRecord,
   verifyPeerRecordSignature,
   isPeerRecordFresh,
   orderSignalingFirst,
   isSignalingAddr,
-  trailingPeerId,
-  withTrailingPeerId,
   currentMemberTrustPolicy,
   DEFAULT_PEER_RECORD_MAX_AGE_MS,
   DEFAULT_PEER_RECORD_HEARTBEAT_MS
@@ -103,35 +117,49 @@ import {
   dialPeerAddrs,
   SelfRelayOnlyError,
   CONTROL_COHORT_DIAL_ADDRESS_ATTEMPTS,
+  trailingPeerId,
+  withTrailingPeerId,
   type PeerDialBudget
 } from './peer-dial.js';
-import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayAdmissionReserveDeadlineMs, relayReservationBudgetMs, relayedDialBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
+import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayReservationBudgetMs, relayedDialBudgetMs, relayedRequestBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
-import { ControlDatabase, isPendingJoinConflict, isStrandIdConflict, pendingJoinId, type RevokedRowRef } from './control-database.js';
+import { ControlDatabase, generateStampId, isPendingJoinConflict, isStrandIdConflict, pendingJoinId, type JoinRequestFields, type RevokedRowRef } from './control-database.js';
+import {
+  CadreInviteHandler,
+  encodeCadreInvitation,
+  redeemInPasses,
+  signRedeemRequest,
+  type CadreInvitation
+} from './cadre-invite-protocol.js';
 import { FormationPostApprovalError } from './strand-formation-rejection.js';
 import {
   PendingJoinRunner,
   membershipInvitesToStage,
   parseStoredDisclosure,
-  requestedPendingJoin,
-  type PendingJoinFields
+  requestedPendingJoin
 } from './pending-join-runner.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
-import { SeedBootstrapService, type SeedEventCallbacks, type SeedBootstrapConfig } from './seed-bootstrap.js';
-import type { SeedTrustPolicy } from './seed-trust-policy.js';
+import { SeedBootstrapService, mergeSeedPeers, seedDigest, type SeedEventCallbacks, type SeedBootstrapConfig } from './seed-bootstrap.js';
+import { claimSecretTrustPolicy, type SeedTrustPolicy } from './seed-trust-policy.js';
+import { ClaimRefusedError, claimProof, parseClaimSecret } from './claim-proof.js';
 import {
   StrandSolicitationService,
   type StrandSolicitationServiceOptions
 } from './strand-solicitation.js';
 import { ControlFormationUsageRecorder } from './control-formation-recorder.js';
-import { selectInvitationSiblingAddrs, type InvitationSibling } from './invitation-bootstrap.js';
+import {
+  cadreInvitationReach,
+  selectCadreInvitationMembers,
+  selectInvitationSiblingAddrs,
+  type InvitationSibling
+} from './invitation-bootstrap.js';
 import {
   createMembershipConnectionGater,
-  DEFAULT_ENROLLMENT_WINDOW_MS,
   UnauthorizedReservationBudget,
   type InboundConnectionVerdict
 } from './membership-connection-gater.js';
+import { controlNetworkName, installControlProtocolGuard } from './control-protocol-guard.js';
 import { StrandWakeService, dialWake } from './strand-wake-protocol.js';
 import { StrandAddrService, collectStrandAddrs, type StrandAddrPeer, type StrandAddrOutcome, type StrandAddrCollection } from './strand-addr-protocol.js';
 import {
@@ -143,6 +171,7 @@ import {
   type CircuitRelayTarget
 } from './delegate-admission.js';
 import { relayCircuitAddrs, resolveListenAddrs, resolveTransportOptions, RelayReservationFailedError } from './relay-addrs.js';
+import { nodeTransportsOption } from './node-transports.js';
 import { resolveRelayServer, type ResolvedRelayServer } from './relay-server.js';
 import { replacesAdvertisedAddrs, resolveAnnounceAddrs } from './announce-addrs.js';
 import {
@@ -187,6 +216,17 @@ export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
  */
 export const STRAND_PEER_ADDR_RETRY_MS = 60 * 1000;
 
+/**
+ * Default lifetime of an UNTARGETED, OWNER-GRANTING cadre invitation
+ * ({@link CadreNode.createCadreInvitation}): whoever holds the bundle becomes an owner, so
+ * it is a bearer credential for admin rights and lives only long enough to be pasted or
+ * scanned by the device it was minted for.
+ */
+export const OWNER_INVITATION_DEFAULT_TTL_MS = 15 * 60 * 1000;
+
+/** Default lifetime of every other cadre invitation: targeted, or granting membership only. */
+export const CADRE_INVITATION_DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
+
 type EventHandler<T> = (data: T) => void;
 
 /**
@@ -235,6 +275,25 @@ function unionAddrs(primary: readonly string[], extra: readonly string[]): strin
  * canonical row-bound message BYTES (see `buildAuthorizationMessage`), and it ed25519-signs
  * them directly (no pre-hash) with the owner private key, returning a base64url signature.
  */
+/**
+ * One membership refresh's invitation chain ({@link InvitationChain}), loaded at most once
+ * and shared by the anchor sync (`OwnerKey` rows) and the membership read (`CadrePeer`
+ * rows), each of which calls it only when some row it judges is invitation-admitted.
+ */
+type InvitationChainSource = () => Promise<InvitationChain>;
+
+/**
+ * One membership refresh's `Revocation` tombstones, loaded at most once and shared by the
+ * anchor sync (`OwnerKey` stamps and signers) and the hang-up of removed peers (`CadrePeer`
+ * row keys), each of which calls it only when it has something to judge.
+ */
+type RevocationSource = () => Promise<RevocationRow[]>;
+
+/** Whether a `CadrePeer` or `OwnerKey` row's proof is an invitation admission rather than an owner voucher (`types.ts` → `CadrePeerRow`, `OwnerKeyRow`). */
+function isInvitationAdmitted(row: { vouchSig: string | null; vouchUsage: string | null }): boolean {
+  return row.vouchSig === null && row.vouchUsage !== null;
+}
+
 function signMessageWith(privateKeyB64: string): (message: Uint8Array) => string {
   return (message: Uint8Array): string =>
     sign(message, privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url') as string;
@@ -374,11 +433,26 @@ export class CadreNode implements SAppIdLookup {
    * start() cycle rebuilds it with a fresh caught-up-peer memo.
    */
   private controlBackfill: PeerJoinBackfill | null = null;
+  /**
+   * Devices whose invitation redemption this member has verified and is admitting right now,
+   * each with its count of overlapping redemptions. The control backfill's gate and the
+   * control cohort choice (Optimystic's `isNetworkMember`) count them as members, for that
+   * window only ({@link admitRedeemingDevice}); the per-stream gate never does.
+   */
+  private readonly admittingDevices = new Map<string, number>();
   private strandWatcher: StrandWatcher | null = null;
   private strandManager: StrandInstanceManager;
   private hibernationManager: HibernationManager;
   private enrollmentService: EnrollmentService;
   private seedBootstrapService: SeedBootstrapService | null = null;
+  /**
+   * The claim-secret trust policy of a node started with `config.claim`, built once by
+   * {@link initializeClaimPolicy} over {@link trustedOwnerStore} and handed to every
+   * seed service this node constructs ({@link inboundSeedTrustPolicy}). Kept across
+   * stop()→start() like the anchor it writes: its in-process latch and failure window
+   * are per node, not per seed service. Null when the node has no claim secret.
+   */
+  private claimTrustPolicy: SeedTrustPolicy | null = null;
   private strandSolicitationService: StrandSolicitationService | null = null;
   /**
    * The service whose formation handler is registered on the control node. Trails
@@ -397,6 +471,13 @@ export class CadreNode implements SAppIdLookup {
    * stops conflating control addresses with strand seeding.
    */
   private strandAddrService: StrandAddrService | null = null;
+  /**
+   * Cadre invitation redemption handler (`/sereus/cadre-invite/1.0.0`): a device holding an
+   * invitation dials this machine and proves possession; the handler seats the row and
+   * admits the device against this node's control database. Registered by {@link start}
+   * once that database is up, on every node.
+   */
+  private cadreInviteHandler: CadreInviteHandler | null = null;
   /**
    * Server-side push-wake fan-out. Constructed by {@link start} only when
    * `config.push` (an injected `PushNotifier` + policy) is present — without it
@@ -406,6 +487,8 @@ export class CadreNode implements SAppIdLookup {
   private pushFanoutService: PushFanoutService | null = null;
   /** Backing field for the {@link running} / {@link isRunning} getters. */
   private _running = false;
+  /** The {@link stop} in progress, or null; a concurrent `stop()` awaits it. */
+  private stopInFlight: Promise<void> | null = null;
   /**
    * The control database's own raw storage (cache-wrapped), resolved once per
    * `start()` and released in {@link cleanup}. Owning it is what keeps the
@@ -508,26 +591,11 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Most-recently pushed invite addresses (see {@link setInviteAddresses}).
    * When non-null these take priority over `libp2pNode.getMultiaddrs()` when
-   * minting invites — the host pushes NAT-resolved addresses here so the
-   * control-network node never needs to dial back to the manager.
+   * minting cadre invitations — the host pushes NAT-resolved addresses here so
+   * the control-network node never needs to dial back to the manager.
    */
   private latestInviteAddresses: string[] | null = null;
 
-  /**
-   * Epoch ms until which the control-network inbound gate admits
-   * not-yet-authorized peers (see {@link admitInboundControlConnection} /
-   * {@link openEnrollmentWindow}). 0 = no window open. Opened automatically by
-   * {@link createInvite}; deliberately NOT reset on stop() — a stop/start cycle
-   * inside an outstanding invite's validity must not strand the invitee.
-   *
-   * NOTE: in-memory only, so a PROCESS restart mid-invite closes the door until
-   * the owner re-mints or the invitee is authorized. Fine while invites are
-   * short-lived and redeemed promptly; if long-lived invites or restart-prone
-   * hosts become normal, persist the window (or derive it from the issued-invite
-   * records `SeedBootstrapService` already keeps).
-   */
-  private enrollmentWindowUntil = 0;
-
   /**
    * Lazily-parsed PeerIds of `controlNetwork.bootstrapNodes` (see
    * {@link getBootstrapPeerIds}) — infrastructure the inbound gate always admits.
@@ -536,13 +604,15 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Materialized in-memory snapshot of the AUTHORIZED member peer ids (the
-   * {@link listAuthorizedMembers} result), consulted by the per-stream
-   * control-DB gate ({@link authorizeInboundControlStream}). That predicate
-   * runs on EVERY inbound Optimystic control-DB stream and must never await a
-   * control-DB read: those reads pull blocks over the very protocols the
-   * predicate gates, which closes a circular wait that ends in mutual denial
-   * (the upstream gate is fail-closed on timeout, unlike the fail-open
-   * connection gater). So the set is refreshed OUT OF BAND instead — after
+   * {@link listAuthorizedMembers} result), consulted through
+   * {@link isControlNetworkMember} by the per-stream control-DB gate
+   * ({@link authorizeInboundControlStream}) and by Optimystic's cohort choice
+   * (`isNetworkMember`). The stream gate runs on EVERY inbound Optimystic
+   * control-DB stream and must never await a control-DB read: those reads pull
+   * blocks over the very protocols the predicate gates, which closes a circular
+   * wait that ends in mutual denial (the upstream gate is fail-closed on
+   * timeout, unlike the fail-open connection gater). Optimystic's predicate is
+   * synchronous by contract. So the set is refreshed OUT OF BAND instead — after
    * start, on every {@link reconcileControlCohort} pass (15s cadence), and
    * immediately after every LOCAL membership mutation so a just-vouched peer
    * is admitted without waiting for the timer. That last refresh is AUTOMATIC:
@@ -551,7 +621,11 @@ export class CadreNode implements SAppIdLookup {
    * writer has to remember. A change that arrives by REPLICATION is picked up
    * on the next timed refresh — bounded staleness, acceptable because this gate
    * is defense in depth: rows an unadmitted peer manages to write are still
-   * disbelieved at read time by the voucher-anchored predicate.
+   * disbelieved at read time by the voucher-anchored predicate. For cohort
+   * choice the same window means a member whose row arrived by replication is
+   * left out of this node's control-block cohorts until that refresh.
+   * Optimystic reads the predicate live on every lookup, so replacing this set
+   * is the whole re-evaluation; there is no per-peer reclassify call to make.
    */
   private authorizedControlPeers: Set<string> = new Set();
 
@@ -565,6 +639,18 @@ export class CadreNode implements SAppIdLookup {
   private membershipGateDrain: Promise<void> | null = null;
   private membershipGateDeferDepth = 0;
 
+  /**
+   * This node's own `CadrePeer` row as a membership refresh last read it live, or null until
+   * one has. Reporting a removal needs it ({@link noteOwnRemoval}). Kept across
+   * stop()→start(), like {@link removal}.
+   */
+  private ownLiveRow: CadrePeerRow | null = null;
+  /**
+   * The removal this node learned of ({@link removedFromCadre}), or null. Set once and never
+   * cleared, so `cadre:removed` fires once per node object.
+   */
+  private removal: CadreRemoval | null = null;
+
   /**
    * In-memory delegate admission grants (see `delegate-admission.ts`): the
    * strand-node transport peerIds this party's members have announced over the
@@ -594,10 +680,8 @@ export class CadreNode implements SAppIdLookup {
    * Does this node's CONTROL libp2p run the circuit-relay server, and with which
    * init? Resolved once from `network` and `profile` by the same function every
    * strand node's build uses (`relay-server.ts`). Read by
-   * {@link buildControlNodeOptions} (which configures the server from it),
-   * {@link admitInboundControlConnection} (whose deny/admit-for-relay branch must
-   * agree with whether a reservation is even servable here), and the
-   * unauthorized budget above (whose TTL is the server's).
+   * {@link buildControlNodeOptions} (which configures the server from it) and
+   * the unauthorized budget above (whose TTL is the server's).
    */
   private readonly relayServer: ResolvedRelayServer;
 
@@ -709,7 +793,7 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Invite keys of the membership invitations this process has staged, by
-   * {@link adoptFormationMembershipInvite} or from a `joined` `PendingJoin` row
+   * {@link adoptFormationMembershipInvite} or from a `JoinSuccess` row
    * ({@link stageMembershipInvitesFromPendingJoins}), so one the reconciler has settled is not
    * staged again by the next pending-join pass. Same lifetime as
    * {@link pendingMembershipInvites}: a restarted process stages each live one once more, and the
@@ -863,9 +947,11 @@ export class CadreNode implements SAppIdLookup {
    * When this node last PUBLISHED its own `CadrePeer` address record (inserted or
    * refreshed), or null if it never has in this session. Stamped by
    * {@link noteSelfRecordPublished} on every successful publish, wherever it was driven
-   * from — the boot pass, the heartbeat, an address change, a drain or an explicit call.
+   * from — the boot pass, the heartbeat, an address change, a drain, a reconcile pass or an
+   * explicit call.
    *
-   * Read by {@link escalateIfSelfRecordStale} for the one consequence worth an operator's
+   * Read by {@link publishFirstSelfRecord}, which stops trying once it is set, and by
+   * {@link escalateIfSelfRecordStale} for the one consequence worth an operator's
    * attention: once this gap exceeds {@link DEFAULT_PEER_RECORD_MAX_AGE_MS}, every other
    * machine in the party is already discarding this node's address as stale.
    */
@@ -1108,12 +1194,22 @@ export class CadreNode implements SAppIdLookup {
       // store fails closed before a node is created.
       await this.resolveIdentityKey();
 
+      // A conflicting `claim` is refused BEFORE the anchor is built: the store below
+      // writes the config pins, and on a persistent anchor a pin written ahead of
+      // this refusal would survive the failed start and mark the node claimed by it.
+      this.validateClaimConfig();
+
       // Bring up the node-local trusted-owner anchor (and seed config pins)
       // before any network bring-up: a mis-scoped injected store fails closed
       // here, and out-of-band pins are anchored before the first seed/peer
       // interaction could consult them.
       await this.initializeTrustedOwnerStore();
 
+      // A node started with a claim secret gets its trust policy here, over the anchor
+      // just built; a malformed secret fails closed before any network bring-up, like
+      // a mis-scoped anchor above.
+      this.initializeClaimPolicy();
+
       // Bring up the node-local cold-start bootstrap-peer store alongside the
       // anchor, and for the same two reasons: a mis-scoped injected store fails
       // closed before any network bring-up, and the retained dial targets are
@@ -1159,6 +1255,9 @@ export class CadreNode implements SAppIdLookup {
       this.controlNode = await this.createControlNode();
       timing('[start] createControlNode: %dms', Math.round(performance.now() - t0));
       log('Control node started with ID: %s', this.controlNode.peerId.toString());
+      // Before anything else can happen on the node: the quiet period above holds every
+      // connection off, so no stream can arrive ahead of the guard.
+      this.installControlProtocolGuard(this.controlNode);
 
       // Extract coordinatedRepo from the node (attached by createLibp2pNode)
       const coordinatedRepo = (this.controlNode as Libp2pNodeWithRepo).coordinatedRepo;
@@ -1234,11 +1333,10 @@ export class CadreNode implements SAppIdLookup {
       this.hibernationManager.start();
 
       // Register the control-network push-wake receiver: a same-cadre peer can
-      // signal us to bring a hibernating strand online. Gated on AUTHORIZED
-      // membership (not the addressable surface); the wake routes through the same
-      // path as a local wake.
+      // signal us to bring a hibernating strand online. The protocol guard admits
+      // only AUTHORIZED members (not the addressable surface); the wake routes
+      // through the same path as a local wake.
       this.strandWakeService = new StrandWakeService({
-        isMember: (peerId) => this.isAuthorizedMember(peerId),
         getStrand: (strandId) => this.strandManager.getInstance(strandId),
         wake: (strandId) => this.wakeStrand(strandId),
       });
@@ -1246,14 +1344,13 @@ export class CadreNode implements SAppIdLookup {
 
       // Register the control-network strand-address responder: a same-cadre peer
       // resolving a strand's bootstrap seed asks us for our live strand-network
-      // multiaddrs (its CadrePeer row only knows our *control* address). Gated on
-      // AUTHORIZED membership; answers only for strands we are actively meshing.
-      // The same RPC doubles as the delegate-announce channel: a member's request
-      // may carry the derived peerId its strand node runs as, and we record an
-      // admission grant so our connection gate (and thus our relay server, when
-      // enabled) admits it — see delegate-admission.ts.
+      // multiaddrs (its CadrePeer row only knows our *control* address). The
+      // protocol guard admits only AUTHORIZED members; answers only for strands we
+      // are actively meshing. The same RPC doubles as the delegate-announce channel:
+      // a member's request may carry the derived peerId its strand node runs as, and
+      // we record an admission grant so our connection gate (and thus our relay
+      // server, when enabled) admits it — see delegate-admission.ts.
       this.strandAddrService = new StrandAddrService({
-        isMember: (peerId) => this.isAuthorizedMember(peerId),
         getStrandMultiaddrs: (strandId) => this.getStrandMultiaddrs(strandId),
         onDelegateAnnounce: (announcer, strandId, delegate) =>
           this.grantDelegateAdmission(announcer, strandId, delegate),
@@ -1266,6 +1363,24 @@ export class CadreNode implements SAppIdLookup {
       // so the responder never reads a database that cannot answer yet.
       await this.installDefaultFormationResponder();
 
+      // Answer cadre invitation redemptions from now on: a device holding an invitation
+      // dials any member machine, this one included, and proves possession in-protocol.
+      // After the control database is up, since the handler seats and redeems against it.
+      this.cadreInviteHandler = new CadreInviteHandler({
+        partyId: this.config.controlNetwork.partyId,
+        store: this.controlDatabase,
+        admitDevice: (peerId) => this.admitRedeemingDevice(peerId),
+      });
+      await this.cadreInviteHandler.register(this.controlNode);
+
+      // A node waiting to be claimed listens for its claim seed from the start: nobody
+      // else will turn the listener on, and a node no seed can reach cannot be claimed.
+      // Before `control:connected`, so an embedder that reports "awaiting claim" on that
+      // event is already reachable on `/sereus/seed/1.0.0`.
+      if (this.config.claim) {
+        await this.enableSeedListener();
+      }
+
       // Server-side push-wake fan-out: only when push is configured.
       if (this.config.push) {
         this.pushFanoutService = this.buildPushFanout(this.config.push);
@@ -1354,11 +1469,26 @@ export class CadreNode implements SAppIdLookup {
    * Stop the cadre node
    */
   async stop(): Promise<void> {
+    // A second call while one is in flight joins it rather than running cleanup() twice
+    // concurrently: `_running` stays true until cleanup() ends, and an event raised by a
+    // refresh still in flight (`cadre:removed`, whose embedder stops the node) can reach a
+    // handler that calls stop() mid-teardown.
+    if (this.stopInFlight) {
+      return this.stopInFlight;
+    }
     if (!this._running) {
       log('CadreNode not running');
       return;
     }
+    this.stopInFlight = this.stopRunning();
+    try {
+      await this.stopInFlight;
+    } finally {
+      this.stopInFlight = null;
+    }
+  }
 
+  private async stopRunning(): Promise<void> {
     log('Stopping CadreNode');
     await this.cleanup();
     this.emit('control:disconnected', undefined);
@@ -1446,15 +1576,22 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Construct (or adopt) the node-local trusted-owner anchor and seed the
-   * out-of-band pinned keys from `config.trustedOwners`. The store is NEVER
-   * sourced from the replicated control DB — its entries come only from
-   * genesis self-trust ({@link initializeSeedBootstrap}), config pins (here),
-   * or runtime enrollment pins ({@link trustOwnerKeys}).
+   * out-of-band pinned keys from `config.trustedOwners`. The anchor's BASE comes
+   * only from out of band — genesis self-trust ({@link initializeSeedBootstrap}),
+   * config pins (here), runtime enrollment pins ({@link trustOwnerKeys}) and a
+   * claim; everything else in it is derived from that base along verifiable
+   * chains through the replicated `OwnerKey` table ({@link syncOwnerAnchor}),
+   * never read from the table directly.
    *
    * Idempotent across stop()→start(): the store instance is kept, and
    * re-seeding config pins is a no-op ({@link TrustedOwnerStore.trust} is
    * idempotent). An injected store scoped to a different party is a
    * configuration error (fail closed before any network bring-up).
+   *
+   * NOTE: a config pin of a key the owners have since REMOVED is re-anchored here at
+   * every start and removed again by the first sync (`refreshMembershipGate('start')`,
+   * fired without await from {@link start}), so such a pin is honoured for at most one
+   * membership refresh per start; dropping the pin from the config ends that.
    */
   private async initializeTrustedOwnerStore(): Promise<void> {
     const { trustedOwners } = this.config;
@@ -1478,6 +1615,93 @@ export class CadreNode implements SAppIdLookup {
     }
   }
 
+  /**
+   * Refuse a `config.claim` that sits beside another cold-start trust source. A node
+   * has exactly ONE, so `claim` with a non-empty `trustedOwners.pinnedKeys` or a
+   * `seedTrustPolicy` is refused here rather than silently letting one of them win.
+   * Asserted at this seam, not by a type: the embedders build `CadreNodeConfig` as one
+   * object literal with every optional field present, which a discriminated union over
+   * the whole config would not express.
+   *
+   * Runs BEFORE {@link initializeTrustedOwnerStore}, which writes the config pins into
+   * the anchor: on a persistent anchor a pin written ahead of this refusal would outlive
+   * the failed start, and the node, restarted with the pin dropped from its config and
+   * `claim` kept, would read as claimed by that pin and never accept its claimant.
+   */
+  private validateClaimConfig(): void {
+    if (!this.config.claim) {
+      return;
+    }
+    if ((this.config.trustedOwners?.pinnedKeys?.length ?? 0) > 0) {
+      throw new Error(
+        'CadreNodeConfig: `claim` and `trustedOwners.pinnedKeys` are both set — a node has one ' +
+        'cold-start trust source; a node waiting to be claimed anchors its claimant, not a pin'
+      );
+    }
+    if (this.config.seedTrustPolicy) {
+      throw new Error(
+        'CadreNodeConfig: `claim` and `seedTrustPolicy` are both set — a node has one cold-start ' +
+        'trust source; the claim secret supplies the seed trust policy itself'
+      );
+    }
+  }
+
+  /**
+   * Build {@link claimTrustPolicy} from `config.claim`, once per node (a restart keeps
+   * the policy, as {@link initializeTrustedOwnerStore} keeps the anchor it writes).
+   * Runs after the anchor exists and before any network bring-up, so a malformed secret
+   * fails `start()` closed with nothing to tear down; `parseClaimSecret` names the
+   * problem and never echoes the value. The conflicts with the other trust sources are
+   * {@link validateClaimConfig}'s, checked before the anchor is written.
+   */
+  private initializeClaimPolicy(): void {
+    const { claim } = this.config;
+    if (!claim || this.claimTrustPolicy) {
+      return;
+    }
+    // Unreachable in practice: start() builds the store just above. Guarded so the
+    // policy can never be built over a missing anchor and silently claim into nothing.
+    if (!this.trustedOwnerStore) {
+      throw new Error('CadreNode: the trusted-owner anchor must exist before the claim policy is built');
+    }
+    this.claimTrustPolicy = claimSecretTrustPolicy({
+      secret: parseClaimSecret(claim.secret),
+      trustedOwners: this.trustedOwnerStore,
+      recordClaim: claim.record,
+      onClaimed: (accepted) => this.emit('claim:accepted', accepted),
+    });
+    log('Node starts awaiting a claim; start() enables the seed listener once the control node is up');
+  }
+
+  /**
+   * Is this node waiting to be claimed: started with `config.claim` and owned by nobody
+   * yet (empty anchor)? Read live from the anchor every time, as
+   * {@link admitControlPeerUnconditionally} reads it per stream: the anchor is the one
+   * source of truth for "claimed", and a cached flag would need its own invalidation
+   * from the policy's persist, the rollback and a restart. False on a node with no claim
+   * secret, on a claimed one (restarted with the secret still set or not), and before
+   * {@link start} has built the anchor.
+   *
+   * While true the node admits strangers' CONNECTIONS (the claim seed has to ride one)
+   * and refuses them control-database streams and cohort places ({@link isControlNetworkMember})
+   * and relay reservations ({@link admitControlRelayReservation}): an unclaimed node has
+   * no siblings to replicate from and must not become a public relay while it waits.
+   * cadre-cli reports this on `/status`; `claim:accepted` is the event form.
+   */
+  isAwaitingClaim(): boolean {
+    return this.config.claim !== undefined && this.trustedOwnerStore?.all().size === 0;
+  }
+
+  /**
+   * The removal from the cadre this node has learned of, or null: the query form of
+   * `cadre:removed`, for an embedder that subscribed after it fired. Kept once set, across
+   * stop()→start() and a later re-admission, because the embedder acts on it once (stops this
+   * node, deletes the cadre's data); a re-added machine joins again from a fresh node.
+   */
+  removedFromCadre(): CadreRemoval | null {
+    return this.removal;
+  }
+
   /**
    * Construct (or adopt) the node-local cold-start bootstrap-peer store (see
    * {@link bootstrapPeerStore}). Synchronous: an injected store has already
@@ -1617,6 +1841,41 @@ export class CadreNode implements SAppIdLookup {
     return this.strandNetworkStateStore;
   }
 
+  /**
+   * The strands this machine joined from another party and has not published party-wide
+   * (see {@link CadreNodeConfig.joinedStrands}). Publication needs a control connection,
+   * so a one-node party's joins live here until it holds one; `exportStrandBundle` reads
+   * it beside the `JoinedStrand` table.
+   *
+   * @throws when the node is not started.
+   */
+  listUnpublishedJoinedStrands(): Promise<JoinedStrandRecord[]> {
+    if (!this.joinedStrands) {
+      throw new Error('CadreNode must be started before listing its unpublished joined strands');
+    }
+    return this.joinedStrands.unpublishedRecords();
+  }
+
+  /**
+   * The strand-network addresses a formation carried for `strandId` (see
+   * {@link formationStrandAddrs}), as kept: attributed per peer. Empty when none were
+   * carried or the strand's peers were forgotten. A copy; the node keeps its own list.
+   */
+  getCarriedStrandAddrs(strandId: string): string[] {
+    return [...(this.formationStrandAddrs.get(strandId) ?? [])];
+  }
+
+  /**
+   * Seat `addrs` as the addresses a formation carried for `strandId`, exactly as a
+   * formation of this node's own would ({@link recordFormationStrandAddrs}): a strand
+   * move seats the exporting node's list here so the first launch has a cross-party
+   * seed. The usual rules apply: a list naming a peer replaces the strand's earlier
+   * one, and a list naming none records nothing.
+   */
+  recordCarriedStrandAddrs(strandId: string, addrs: readonly string[]): Promise<void> {
+    return this.recordFormationStrandAddrs(strandId, addrs, 'recordCarriedStrandAddrs');
+  }
+
   /**
    * The node-local trusted-owner anchor (null before {@link start}). This is
    * the set the authorized-membership predicate and seed-trust anchor consult —
@@ -1628,22 +1887,23 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Persist out-of-band-established owner keys into the node-local anchor —
-   * the runtime enrollment seam: call with `CadreInvite.ownerKeys` when
-   * redeeming an invite (BEFORE the first `applySeed`, so the anchor already
-   * holds the pins when seed trust consults it), or with an operator-supplied
-   * pin. Idempotent. ('genesis' provenance is reserved for the node's own
-   * founding key, seeded internally by {@link initializeSeedBootstrap}.)
+   * the runtime enrollment seam: {@link redeemCadreInvitation} calls it with the
+   * cadre invitation's `ownerKeys` BEFORE dialing a member (so the anchor already
+   * holds the pins when the reply and the rows that follow are judged), and an
+   * embedder calls it with an operator-supplied pin. Idempotent. ('genesis'
+   * provenance is reserved for the node's own founding key, seeded internally by
+   * {@link initializeSeedBootstrap}; 'chain' is written only by {@link syncOwnerAnchor}.)
    *
    * Validates every key's shape before trusting any of them (all-or-nothing):
    * a malformed entry anywhere in `keys` rejects the whole call before a
-   * single key is anchored. For the invite route this means a `CadreInvite`
+   * single key is anchored. For the invitation route this means a bundle
    * carrying one malformed `ownerKeys` entry fails the redemption outright —
    * consistent with the anchor's existing whole-record-or-nothing policy for
    * a corrupt persisted entry (see `trusted-owner-store.ts`'s
    * `unusableEntry: 'discard-all'`) — rather than silently anchoring a subset
    * and leaving the caller to notice a key went missing.
    */
-  async trustOwnerKeys(keys: Iterable<string>, source: Exclude<TrustSource, 'genesis'>): Promise<void> {
+  async trustOwnerKeys(keys: Iterable<string>, source: Exclude<TrustSource, 'genesis' | 'chain'>): Promise<void> {
     if (!this.trustedOwnerStore) {
       throw new Error('CadreNode must be started before trusting owner keys');
     }
@@ -1658,19 +1918,24 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * The control libp2p node's Optimystic network name — ONE binding for every
-   * derivation from it (`db-p2p` namespaces all of the node's protocol ids as
-   * `/optimystic/<networkName>/...`), so the node options and the block-transfer
-   * protocol prefix the control backfill dials can never drift apart.
-   *
-   * NOTE: the party id goes in UNENCODED here, unlike in `controlStorageScope`. Safe
-   * today because a party id is locally configured rather than replicated in, and both
-   * ends of a connection derive this string identically — an odd party id yields an odd
-   * but consistent protocol id, not a mismatch or an escaped name. If a party id ever
-   * arrives from the network, encode it here as the storage scope key already does.
+   * Refuse non-members on every members-only protocol of the control node, at one seam
+   * (`control-protocol-guard.ts`). Wake and strand-addr are judged by the live
+   * {@link isAuthorizedMember}, bounded by the asker's own attempt deadline at this
+   * node's declared link; everything a control-database read depends on is judged by
+   * the snapshot ({@link authorizeInboundControlStream}).
    */
+  private installControlProtocolGuard(controlNode: Libp2p): void {
+    installControlProtocolGuard(controlNode, {
+      partyId: this.config.controlNetwork.partyId,
+      isMemberLive: (peerId) => this.isAuthorizedMember(peerId),
+      isMemberSnapshot: (peerId, protocol) => this.authorizeInboundControlStream(peerId, protocol),
+      liveDecisionTimeoutMs: relayedRequestBudgetMs(this.config.network?.linkRoundTripMs),
+    });
+  }
+
+  /** This node's control network name ({@link controlNetworkName}, the one binding for it). */
   private controlNetworkName(): string {
-    return `control-${this.config.controlNetwork.partyId}`;
+    return controlNetworkName(this.config.controlNetwork.partyId);
   }
 
   /**
@@ -1698,6 +1963,8 @@ export class CadreNode implements SAppIdLookup {
    * reconnect re-runs identify), and — because the production join order is
    * connect-then-authorize — on every committed membership change via
    * {@link refreshAuthorizedControlPeers}'s `scheduleConnectedPeers()` call.
+   * The one non-member the gate admits is a device whose invitation
+   * redemption this member is admitting ({@link admitRedeemingDevice}).
    *
    * No-ops (logged) when the embedder configured no control storage or the
    * node exposes no key network — the backfill would have nothing to read or
@@ -1728,7 +1995,7 @@ export class CadreNode implements SAppIdLookup {
       // under — derived from the same networkName binding the node options
       // used, never re-spelled here.
       protocolPrefix: `/optimystic/${networkName}`,
-      authorizePeer: (peerId) => this.isAuthorizedMember(peerId)
+      authorizePeer: async (peerId) => this.admittingDevices.has(peerId) || await this.isAuthorizedMember(peerId)
     }, {
       // A shorter settle window than the strand default (1000 ms): the control
       // store is small (a party's membership — dozens of blocks), a re-push is
@@ -1755,6 +2022,60 @@ export class CadreNode implements SAppIdLookup {
     this.controlBackfill.start();
   }
 
+  /**
+   * Admit a device whose invitation redemption has verified to this member's control
+   * replication until the returned release is called (the handler's `admitDevice`;
+   * `CadreInviteHandler.admitDeviceIfLive` says why the redemption's writes need it): push it
+   * this member's control store and wait for the push, with the device counted as a member by
+   * the backfill's gate and by the control cohort choice ({@link admittingDevices}), so the
+   * seat and the admission that follow are written to the device too. A failed push releases
+   * at once and rethrows: in the cohort without the store, the device would refuse the
+   * commits and tear the writes. With no backfill on this node nothing is admitted.
+   *
+   * Through {@link PeerJoinBackfill.forceCatchUpPeer}, not `catchUpPeer`: the device's own
+   * `peer:identify` scheduled a run a moment earlier, which was denied if it passed the gate
+   * before the device was added here, and `catchUpPeer` would answer that run's in-flight
+   * status with an empty result.
+   */
+  private async admitRedeemingDevice(peerId: string): Promise<() => void> {
+    const backfill = this.controlBackfill;
+    if (!backfill) {
+      log('No control backfill on this node; device %s is neither caught up nor admitted before its admission', peerId);
+      return () => undefined;
+    }
+    // NOTE: counted in before the push, because the backfill's gate must admit the device to
+    // push to it; so for the push's length any other control write this member makes includes
+    // a device without the base revisions, which refuses it and the write retries. If that
+    // shows up as retried control writes during redemptions, count the device into the cohort
+    // choice only once the push resolves (a second set beside this one).
+    const release = this.countAdmittingDevice(peerId);
+    try {
+      const result = await backfill.forceCatchUpPeer(peerIdFromString(peerId));
+      log('Device %s caught up before its admission: offered=%d accepted=%d rejected=%d',
+        peerId, result.offered, result.accepted, result.rejected.length);
+      return release;
+    } catch (error) {
+      release();
+      throw error;
+    }
+  }
+
+  /** Count one more redemption admitting `peerId`; the returned release undoes it, once. */
+  private countAdmittingDevice(peerId: string): () => void {
+    this.admittingDevices.set(peerId, (this.admittingDevices.get(peerId) ?? 0) + 1);
+    let released = false;
+    return () => {
+      if (released) return;
+      released = true;
+      const remaining = (this.admittingDevices.get(peerId) ?? 1) - 1;
+      if (remaining > 0) {
+        this.admittingDevices.set(peerId, remaining);
+      } else {
+        this.admittingDevices.delete(peerId);
+      }
+    };
+  }
+
   /**
    * The control database's cache-wrapped raw storage, resolved from
    * `config.storage.provider` on first use and then held in {@link controlStorage}
@@ -1903,7 +2224,13 @@ export class CadreNode implements SAppIdLookup {
       }),
       arachnode: { enableRingZulu: profile === 'storage' },
       ...(identityKey && { privateKey: identityKey }),
-      ...(network?.transports && { transports: network.transports }),
+      // With `network.relayAddrs` set, built with libp2p's relay discovery off (given a
+      // transport list to wrap — `node-transports.ts`), so the supervisor
+      // `driveControlRelayReservation` starts is the only thing that fills the search slot:
+      // otherwise a member's control node running the relay server, which this node
+      // identifies (same party namespace), can take it first (`relay-reservation.ts`,
+      // "WHY LIBP2P'S RELAY DISCOVERY IS SWITCHED OFF").
+      ...nodeTransportsOption(network, transportOptions, (network?.relayAddrs ?? []).length > 0),
       ...(network?.noiseCrypto && { noiseCrypto: network.noiseCrypto }),
       // Always present, unlike the conditional spreads around it: an absent
       // `connectionMonitor` would leave libp2p's 5s ping deadline, which drops a peer
@@ -1922,7 +2249,9 @@ export class CadreNode implements SAppIdLookup {
       ...optimysticDialLimits(network?.linkRoundTripMs),
       // `{ wsPort }` when a listen entry names WebSocket, otherwise `{}` — and always
       // `{}` when `network.transports` is set, since the embedder owns transport policy
-      // then. Spread NEXT to `transports` because the two answer the same question.
+      // then. Spread NEXT to `transports` because the two answer the same question, and a
+      // no-op whenever a list is passed there — with `relayAddrs` set that list comes from
+      // `network.defaultTransports` when the embedder gave none, on the same switch.
       ...transportOptions,
       // Configured `listenAddrs`, plus the bare `/p2p-circuit` search listener when
       // `network.relayAddrs` is set — that listener registers the pending reservation
@@ -1933,9 +2262,11 @@ export class CadreNode implements SAppIdLookup {
       // `announceAddrs` replaces the advertised set (see warnIfAnnounceAddrsDiscardRelay).
       ...resolveAnnounceAddrs(network),
       // The CONTROL node composes the membership admission gate onto any
-      // caller-supplied gater (deny from either wins on the inbound-encrypted
-      // and relay-reservation hooks; all other hooks pass through). Strand
-      // cohort nodes keep the raw configured gater (see
+      // caller-supplied gater (a deny from the caller's wins on every composed
+      // hook; the membership policy refuses reservations, never connections,
+      // and puts an unplaced peer's connection on the provisional deadline,
+      // derived from THIS node's declared link because this node decides).
+      // Strand cohort nodes keep the raw configured gater (see
       // strand-instance-manager.ts) — their peers are legitimately
       // cross-party, so cadre membership must not gate them.
       connectionGater: createMembershipConnectionGater(
@@ -1946,14 +2277,24 @@ export class CadreNode implements SAppIdLookup {
         },
         network?.connectionGater,
         ADMISSION_DECISION_TIMEOUT_MS,
-        relayAdmissionReserveDeadlineMs(network?.linkRoundTripMs)
+        relayedRequestBudgetMs(network?.linkRoundTripMs)
       ),
       // Fail-closed per-stream authorization for the four Optimystic control-DB
       // protocols — the members-only layer the connection gater's stranger
       // carve-outs cannot express (see authorizeInboundControlStream). Control
-      // node only: strand cohort nodes serve cross-party peers.
+      // node only: strand cohort nodes serve cross-party peers. The protocol guard
+      // (installControlProtocolGuard) checks these four with this same predicate
+      // first; Optimystic's own check is kept because it is a working, supported
+      // upstream defence, not a second policy.
       authorizeInboundStream: (remotePeerId, protocol) =>
-        this.authorizeInboundControlStream(remotePeerId, protocol)
+        this.authorizeInboundControlStream(remotePeerId, protocol),
+      // Who this node SENDS control writes to (cohort and coordinator choice), where
+      // `authorizeInboundStream` is who may send to it. Without it Optimystic picks cohort
+      // members from the protocols a peer's peer-store record lists, which any connected
+      // peer can fill. The stream gate's rule, unlogged (Optimystic asks several times per
+      // peer per cohort assembly and counts refusals on its own debug line), plus a device
+      // whose verified redemption is being written, which must hold the rows that admit it.
+      isNetworkMember: (peerId) => this.isControlNetworkMember(peerId) || this.admittingDevices.has(peerId)
     };
 
     return nodeOptions;
@@ -1975,86 +2316,85 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Decide whether an inbound CONTROL-network connection from `remotePeerId`
-   * should be admitted — the policy behind the connection gater wired in
-   * {@link createControlNode}. Deny only on a positive "unauthorized outsider
-   * while no stranger path is open" determination; everything ambiguous admits
-   * and defers to the fail-closed per-stream gates (see
+   * Decide how an inbound CONTROL-network connection from `remotePeerId` is
+   * admitted — the policy behind the connection gater wired in
+   * {@link createControlNode}. Every connection is admitted; the answer decides
+   * only whether it carries the provisional deadline (see
    * `membership-connection-gater.ts` for the layer's rationale and the
-   * stranger-open protocol allowlist).
+   * stranger-open protocol allowlist). Asked once when the connection arrives
+   * and again at a provisional connection's deadline.
    *
-   * Returns `'admit'` when ANY of:
+   * Returns `'admit'` (no deadline) when ANY of:
    *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
    *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
    *     configured bootstrap/relay infrastructure);
-   *  2. an enrollment window is open ({@link openEnrollmentWindow}, opened by
-   *     {@link createInvite}) — the invitee dials in before it is authorized;
-   *  3. the peer holds a live DELEGATE ADMISSION GRANT — an authorized member
+   *  2. the peer holds a live DELEGATE ADMISSION GRANT — an authorized member
    *     announced it (over the strand-addr RPC) as the transport peerId of its
    *     own strand node, so a NAT'd member's strand node can hold a
    *     circuit-relay reservation here (see `delegate-admission.ts`).
    *     Connection only: the per-stream gate below never honors a grant;
-   *  4. the authorized-member set is empty — cold start: the rows that would
+   *  3. the authorized-member set is empty — cold start: the rows that would
    *     authorize anyone arrive by replication over these very connections;
-   *  5. the peer IS an authorized member; or
-   *  6. an open invitation is OUTSTANDING — at least one unexpired,
+   *  4. the peer IS an authorized member; or
+   *  5. an open invitation is OUTSTANDING — at least one unexpired,
    *     not-fully-consumed invitation this node minted or persisted (see
    *     `StrandSolicitationService.hasOutstandingInvitation`). A formation
    *     initiator is another party's peer by design and its token is only
    *     checkable inside the protocol, so the gate asks the coarser question
    *     "does this node expect a stranger at all?". REGISTERING the responder
-   *     does not suspend stranger denial: every node registers one at
-   *     {@link start}, and registering mints no invitation.
+   *     does not count: every node registers one at {@link start}, and
+   *     registering mints no invitation; or
+   *  6. a LIVE cadre invitation exists — a `CadreInvite` row this node holds
+   *     that is not withdrawn, unexpired, has uses left and whose issuer is
+   *     still an owner (`ControlDatabase.hasLiveCadreInvite`). The device that
+   *     redeems it is a stranger until the redemption writes its row, and its
+   *     proof of possession is only checkable inside `/sereus/cadre-invite/1.0.0`;
+   *     same reasoning as check 5, and the same expectation-of-a-stranger key.
    *
    * Ordering is semantically free (the checks are OR'd) but decides who pays:
-   * checks 1-3 are in-memory, 4/5 share one control-DB read, and only a peer
-   * already on the deny path reaches check 6's invitation lookup.
+   * checks 1-2 are in-memory, 3/4 share one control-DB read, and only a peer
+   * that is otherwise headed for a provisional admission reaches check 5's and
+   * 6's invitation lookups.
    *
-   * Caveats of check 6, both self-healing:
+   * Caveats of check 5:
    *  - the in-memory mint registry dies with the process, so after a restart
    *    only invitations persisted as `FormationInvite` rows still hold the
-   *    exemption open (re-mint otherwise — same story as the enrollment window);
+   *    window open (re-mint otherwise);
    *  - a peer holding a token whose `FormationInvite` row has not replicated to
-   *    this node yet is denied even though the formation handler would have
-   *    accepted it, exactly like the unreplicated-membership-row case below.
-   *
-   * When every check falls through, the verdict depends on whether this node
-   * runs the circuit-relay server ({@link relayServer}): without one,
-   * `'deny'`; with one, `'admit-for-relay'` — a circuit-relay reservation is
-   * established by the reserving peer DIALING the relay, so a connection deny
-   * here kills the reservation, and that deny is NOT self-healing: an outbound
-   * reconcile re-dial re-establishes a data link, but no outbound dial can
-   * grant the remote peer a reservation, and a relay-only peer has no address
-   * of its own to dial back — the reservation IS its address. The gater admits
-   * such a connection, decides the reservation via
-   * {@link admitControlRelayReservation}, and drops the connection if no
-   * reservation is admitted in time (see `membership-connection-gater.ts` →
-   * "The relay-reservation seam").
-   *
-   * NOTE: check 4/5 runs a control-DB read per inbound connection
+   *    this node yet is admitted only provisionally, so its connection is closed
+   *    at the deadline unless the row has landed by then.
+   *
+   * When every check falls through: `'admit-provisionally'`, on every node,
+   * relay server or not. The gate sees only a peer id, so it cannot tell an
+   * outsider from a device whose invitation row this node has not received yet
+   * (it redeems here by seating the row from its bundle, after which check 6
+   * admits) or from a sibling whose membership row is still replicating (check 4
+   * admits once it lands; if it has not landed by the deadline, the connection
+   * is closed and either side's next reconcile dial re-forms it, since outbound
+   * dials are never gated). The protocol guard refuses all of them every
+   * members-only protocol meanwhile. A circuit-relay reservation admitted by
+   * {@link admitControlRelayReservation} disarms the deadline (see
+   * `membership-connection-gater.ts` → "The relay-reservation seam").
+   *
+   * NOTE: check 3/4 runs a control-DB read per inbound connection
    * (`listAuthorizedMembers`); connections are rare and cadres small, and this
    * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
    * read is safe here — unlike the per-stream gate, which must consult the
    * materialized {@link authorizedControlPeers} snapshot instead.
-   * NOTE: check 6 adds a second control read (`hasOutstandingFormationInvite`) for a
-   * stranger with no locally minted invitation in play, on every node now that every
-   * node runs the responder — a relay-enabled storage node included. If stranger
-   * connections to such a node ever arrive fast enough for that read to show, cache
-   * the answer for a few seconds.
-   * NOTE: on a relay-DISABLED node, a sibling whose membership row has not yet
-   * replicated here is denied until the row converges (typically via the
-   * owner); either side's next outbound reconcile dial (outbound is never
-   * gated) re-establishes the DATA link — self-healing for data, visible as a
-   * transient deny. That self-healing story never covered a reservation, which
-   * is exactly why the relay-enabled path above exists.
+   * NOTE: checks 5 and 6 add two more control reads (`hasOutstandingFormationInvite`,
+   * `hasLiveCadreInvite`) for a stranger with no locally minted invitation in play, on
+   * every node, and a provisional connection's deadline runs the whole decision once
+   * more. If stranger connections ever arrive fast enough for those reads — on arrival
+   * or at the deadline — to show, cache the answers for a few seconds.
    */
   private async admitInboundControlConnection(remotePeerId: string): Promise<InboundConnectionVerdict> {
+    // NOTE: a node waiting to be claimed (isAwaitingClaim) lands on this empty-anchor
+    // admission too, so a stranger can hold an idle, mute connection to it for as long
+    // as it waits on a public address; if that ever shows up as a resource problem, put
+    // unclaimed-node admissions on the provisional deadline too.
     if (this.admitControlPeerUnconditionally(remotePeerId)) {
       return 'admit';
     }
-    if (Date.now() < this.enrollmentWindowUntil) {
-      return 'admit';
-    }
     if (this.delegateAdmission.has(remotePeerId)) {
       return 'admit';
     }
@@ -2069,16 +2409,15 @@ export class CadreNode implements SAppIdLookup {
       if (await this.strandSolicitationService?.hasOutstandingInvitation()) {
         return 'admit';
       }
+      if (await this.controlDatabase?.hasLiveCadreInvite()) {
+        return 'admit';
+      }
     } catch (error) {
       log('admitInboundControlConnection: outstanding-invitation check threw for %s — admitting (fail-open): %o', remotePeerId, error);
       return 'admit';
     }
-    if (this.relayServer.enabled) {
-      log('admitInboundControlConnection: admitting %s FOR RELAY ONLY — not an authorized member and no enrollment path open; the gater drops the connection unless a reservation is admitted', remotePeerId);
-      return 'admit-for-relay';
-    }
-    log('admitInboundControlConnection: DENYING inbound from %s — not an authorized member and no enrollment path open', remotePeerId);
-    return 'deny';
+    log('admitInboundControlConnection: %s is not an authorized member and no stranger window is open — admitting provisionally', remotePeerId);
+    return 'admit-provisionally';
   }
 
   /**
@@ -2088,7 +2427,13 @@ export class CadreNode implements SAppIdLookup {
    * "The relay-reservation seam"); the circuit-relay server consults it per
    * RESERVE request, so it is never called on a node whose relay server is off.
    *
-   * Admits when ANY of:
+   * Refuses everyone, ahead of every admission below, while this node is waiting to be
+   * claimed ({@link isAwaitingClaim}): a storage-profile node runs the relay server by
+   * default, and an unclaimed node on a public address must not become anyone's relay.
+   * The empty-anchor admission in check 1 exists for a node that will be enrolled by
+   * its siblings, which an unclaimed node has none of.
+   *
+   * Otherwise admits when ANY of:
    *  1. a shared-baseline check admits ({@link admitControlPeerUnconditionally}
    *     — not running / DB torn down, absent-or-empty trusted-owner anchor, or
    *     configured bootstrap/relay infrastructure);
@@ -2108,14 +2453,18 @@ export class CadreNode implements SAppIdLookup {
    * that boots, reserves, and only then has its row replicate here would
    * otherwise keep that slot spent for the rest of the entry's TTL.
    *
-   * The connection gate's stranger carve-outs (an open enrollment window, an
-   * outstanding formation invitation) deliberately do NOT extend here: they
-   * exist so a stranger's SEED or FORMATION stream can ride a connection, and
-   * neither needs relay capacity. A genuine invitee that does need a relay slot
-   * takes one from the budget like any other unplaced peer, so an open window
-   * never becomes an unbounded grant of this node's forwarding capacity.
+   * The connection gate's stranger carve-outs (an outstanding formation
+   * invitation, a live cadre invitation) deliberately do NOT extend here: they
+   * exist so a stranger's FORMATION or CADRE-INVITE stream can ride a connection,
+   * and neither needs relay capacity. A genuine invitee that does need a relay
+   * slot takes one from the budget like any other unplaced peer, so a live
+   * invitation never becomes an unbounded grant of this node's forwarding capacity.
    */
   private async admitControlRelayReservation(remotePeerId: string): Promise<boolean> {
+    if (this.isAwaitingClaim()) {
+      log('admitControlRelayReservation: REFUSING %s — this node is unclaimed and relays for nobody until it is', remotePeerId);
+      return false;
+    }
     if (this.admitControlPeerUnconditionally(remotePeerId)) {
       return this.admitReservationUncounted(remotePeerId);
     }
@@ -2138,25 +2487,13 @@ export class CadreNode implements SAppIdLookup {
     return true;
   }
 
-  /**
-   * Hold the control-network inbound gate open for not-yet-authorized peers
-   * until `untilEpochMs` (extends, never shrinks, an already-open window).
-   * {@link createInvite} calls this automatically; a host running an
-   * out-of-band enrollment flow (e.g. accepting a phone whose invite this node
-   * never minted) can open it explicitly before the stranger dials in.
-   */
-  openEnrollmentWindow(untilEpochMs: number): void {
-    this.enrollmentWindowUntil = Math.max(this.enrollmentWindowUntil, untilEpochMs);
-    log('Enrollment window open until %d', this.enrollmentWindowUntil);
-  }
-
   /**
    * Record (or refresh) a delegate admission grant: `delegatePeerId` is the
    * transport peerId of `announcerPeerId`'s strand-`strandId` node, admitted
    * at the CONNECTION and RESERVATION levels (all a circuit-relay reservation
    * needs, without spending the unauthorized-reservation budget) for
-   * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder after its
-   * authorized-membership gate has passed; public so tests can drive the
+   * `DELEGATE_GRANT_TTL_MS`. Called by the strand-addr responder, which the
+   * protocol guard admits only authorized members to; public so tests can drive the
    * admission policy without a full strand launch. A re-announce for the same
    * (announcer, strand) REPLACES the previous delegate rather than
    * accumulating. Never honored by {@link authorizeInboundControlStream}.
@@ -2198,59 +2535,95 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Per-stream authorization for the four Optimystic control-DB protocols
-   * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`),
-   * wired as `authorizeInboundStream` in {@link createControlNode} — the
-   * fail-closed layer behind the fail-open connection gater. Control node
-   * ONLY: strand cohort nodes legitimately serve cross-party peers.
+   * The membership rule this control node applies to a remote peer, without logging. Two
+   * consumers: the per-stream gate ({@link authorizeInboundControlStream}, who may SEND to
+   * this node on a members-only protocol) and Optimystic's `isNetworkMember` (who this node
+   * sends control writes TO — which peers can be a control block's cohort member or
+   * coordinator), which adds only a device whose verified invitation redemption is being
+   * written ({@link admittingDevices}). One rule for both keeps the outbound choice as
+   * permissive as the inbound acceptance: a joining node's cohort must include the inviter
+   * its empty anchor or empty snapshot lets replicate to it, or it would see a self-only
+   * cohort, rule an existing collection absent and found a second copy. Sereus builds the
+   * control node with `bootstrapNodes: []`, so Optimystic's refused-bootstrap-peer guard
+   * does not cover that.
    *
    * The STRICT SUBSET of {@link admitInboundControlConnection}: the same
    * "no basis to judge" admissions (shared via
    * {@link admitControlPeerUnconditionally}), minus the stranger carve-outs
-   * (enrollment window, outstanding open invitation, delegate admission
-   * grant). The first two exist so a stranger can reach `/sereus/seed/1.0.0`
-   * and `/sereus/formation/1.0.0` — neither is gated here, and admitting a
-   * stranger to `repo` during an enrollment window is exactly the hole this
-   * gate closes. A DELEGATE-admitted connection (a member's strand node
+   * (outstanding open invitation, live cadre invitation, delegate admission
+   * grant). The first two exist so a stranger can reach `/sereus/formation/1.0.0`
+   * and `/sereus/cadre-invite/1.0.0` — neither is gated here, and admitting a
+   * stranger to `repo` while an invitation is live is exactly the hole this
+   * rule closes. A DELEGATE-admitted connection (a member's strand node
    * holding a circuit-relay reservation, see `delegate-admission.ts`) is
-   * likewise exactly a case this gate must still refuse: the delegate gets
-   * the connection and never the control DB.
-   *
-   * Admits when ANY of:
+   * likewise refused: the delegate gets the connection and never the control DB.
+   *
+   * Refuses everyone, ahead of every admission below, while this node is waiting to be
+   * claimed ({@link isAwaitingClaim}). The empty-anchor and empty-snapshot admissions
+   * exist so a brand-new node can take replication from the siblings that will
+   * authorize it; an unclaimed node has no siblings yet, and the rows that will
+   * authorize anyone arrive only after the claim, over the owner's streams that the
+   * same two admissions then let in. Its cohort is itself alone meanwhile, which costs
+   * nothing: it built its control database with zero connections. Configured bootstrap
+   * infra is refused too: a relay opens no control-database stream.
+   *
+   * Otherwise admits when ANY of:
    *  1. a shared-baseline check admits (not running / no DB, empty anchor,
-   *     configured bootstrap infra);
+   *     configured bootstrap infra — which Optimystic still classifies `foreign`,
+   *     since a relay serves none of the party's database protocols);
    *  2. the materialized authorized set is empty — cold start, before the
    *     rows that would authorize anyone have replicated in;
    *  3. the peer IS in the materialized authorized set.
    *
    * Deliberately SYNCHRONOUS and pure in-memory — see
    * {@link authorizedControlPeers} for why a control-DB read here would
-   * deadlock into mutual denial. With a sync predicate the upstream deadline
-   * (`authorizeInboundStreamTimeoutMs`) never trips, so it stays at its
-   * default.
+   * deadlock into mutual denial.
    *
    * NOTE: the snapshot keys on PEER ID, so a node with no persistent identity
    * key never lands a `CadrePeer` row ({@link registerSelf} skips) and its
-   * siblings deny its control-DB streams once their own snapshot is non-empty —
-   * owner status is a KEY, not a peer id, so being the owner does not exempt it.
-   * Harmless today (a real deployment persists its identity; the ephemeral-owner
-   * case appears only in tests, which configure the owner as bootstrap infra —
-   * `push-wake-e2e.integration.ts` design note 3). If an ephemeral-identity node
-   * ever becomes a supported deployment, this gate needs a key-based admission.
-   */
-  private authorizeInboundControlStream(remotePeerId: string, protocol: string): boolean {
-    if (this.admitControlPeerUnconditionally(remotePeerId)) {
-      return true;
+   * siblings deny its control-DB streams, and leave it out of their cohorts, once
+   * their own snapshot is non-empty — owner status is a KEY, not a peer id, so
+   * being the owner does not exempt it. Harmless today (a real deployment persists
+   * its identity; the ephemeral-owner case appears only in tests, which configure
+   * the owner as bootstrap infra — `push-wake-e2e.integration.ts` design note 3).
+   * If an ephemeral-identity node ever becomes a supported deployment, this rule
+   * needs a key-based admission.
+   */
+  private isControlNetworkMember(remotePeerId: string): boolean {
+    if (this.isAwaitingClaim()) {
+      return false;
     }
-    if (this.authorizedControlPeers.size === 0) {
+    if (this.admitControlPeerUnconditionally(remotePeerId)) {
       return true;
     }
-    if (this.authorizedControlPeers.has(remotePeerId)) {
+    return this.authorizedControlPeers.size === 0 || this.authorizedControlPeers.has(remotePeerId);
+  }
+
+  /**
+   * Per-stream authorization for the protocol guard's `members-snapshot` class
+   * (`control-protocol-guard.ts`): the four Optimystic control-DB protocols
+   * (`/optimystic/control-<party>/{repo,cluster,sync,block-transfer}/…`), FRET's
+   * five, and any protocol nobody classed. Also wired as Optimystic's
+   * `authorizeInboundStream` in {@link createControlNode} for the four DB
+   * protocols. The fail-closed layer behind the fail-open connection gater.
+   * Control node ONLY: strand cohort nodes legitimately serve cross-party peers.
+   *
+   * Admits exactly the peers {@link isControlNetworkMember} does, and logs why it
+   * refused one. With a sync predicate the upstream deadline
+   * (`authorizeInboundStreamTimeoutMs`) never trips, so it stays at its default.
+   */
+  private authorizeInboundControlStream(remotePeerId: string, protocol: string): boolean {
+    if (this.isControlNetworkMember(remotePeerId)) {
       return true;
     }
     // Upstream logs its own denial line; this one carries the WHY.
-    log('authorizeInboundControlStream: DENYING %s on %s — not in the materialized authorized set (%d member(s))',
-      remotePeerId, protocol, this.authorizedControlPeers.size);
+    if (this.isAwaitingClaim()) {
+      log('authorizeInboundControlStream: DENYING %s on %s — this node is unclaimed and replicates with nobody until it is',
+        remotePeerId, protocol);
+    } else {
+      log('authorizeInboundControlStream: DENYING %s on %s — not in the materialized authorized set (%d member(s))',
+        remotePeerId, protocol, this.authorizedControlPeers.size);
+    }
     return false;
   }
 
@@ -2268,13 +2641,23 @@ export class CadreNode implements SAppIdLookup {
    * read here would sleep its backoff holding the lock and stall every other local
    * writer. Nothing is lost — this refresh already keeps the previous snapshot on
    * failure and is re-driven by the next membership write and by the timed reconcile.
+   *
+   * The trusted-owner anchor sync ({@link syncOwnerAnchor}) runs FIRST, so the snapshot
+   * built here judges `CadrePeer` rows against the anchor as the `OwnerKey` table now
+   * has it. The invitation chain both reads may need, and the tombstone list the sync and
+   * the two end-of-refresh checks ({@link hangUpRevokedControlPeers}, then
+   * {@link noteOwnRemoval}) read, are each loaded at most once per refresh.
    */
   private async refreshAuthorizedControlPeers(reason: string): Promise<void> {
     if (!this._running || !this.controlDatabase) {
       return;
     }
     try {
-      const members = await this.listAuthorizedMembers(false);
+      const loadChain = this.invitationChainSource(this.controlDatabase, false);
+      const loadTombstones = this.revocationSource(this.controlDatabase, false);
+      await this.syncOwnerAnchor(reason, false, loadChain, loadTombstones);
+      const rows = await this.controlDatabase.queryCadrePeers(false);
+      const members = this.authorizedAmong(rows, await this.chainFor(rows, loadChain));
       this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
       log('refreshAuthorizedControlPeers(%s): %d authorized peer(s)', reason, this.authorizedControlPeers.size);
       // Remember the party's size for the NEXT launch's control-node repair yardstick
@@ -2341,11 +2724,136 @@ export class CadreNode implements SAppIdLookup {
       // re-arming peers whose last pass was denied under the SAME membership
       // snapshot instead of re-arming unconditionally.
       void this.controlBackfill?.scheduleConnectedPeers();
+      await this.hangUpRevokedControlPeers(rows, loadTombstones);
+      await this.noteOwnRemoval(rows, loadTombstones);
     } catch (error) {
       log('refreshAuthorizedControlPeers(%s) failed — keeping previous snapshot: %o', reason, error);
     }
   }
 
+  /**
+   * Hang up this node's control connections to every peer that a `CadrePeer` tombstone names
+   * and that has no live `CadrePeer` row: a machine removed from the cadre, whose streams the
+   * protocol guard already refuses but whose open connection would otherwise stay up until it
+   * dropped on its own. Runs at the end of every membership refresh: on the remover from the
+   * removal's own membership notification, so the connection is closed before
+   * {@link removeMachine} returns; on every other machine from the refresh that follows the
+   * replicated tombstone.
+   *
+   * Denies only on evidence held, the strand enforcer's rule (`strand-revocation-enforcer.ts`):
+   * a peer that merely dropped out of the authorized snapshot (an anchor read that failed, a
+   * voucher whose owner is gone) keeps its connection, self is never hung up, and a peer with a
+   * tombstone AND a live row under a fresh stamp was re-admitted and keeps its connection too.
+   * The tombstones are the refresh's own read (`loadTombstones`, shared with
+   * {@link syncOwnerAnchor}), taken only when some connected peer has no live row, so a cadre
+   * with every connection accounted for costs nothing here. A failed `hangUp` is logged and
+   * retried by the next refresh. Never rejects.
+   */
+  private async hangUpRevokedControlPeers(rows: readonly CadrePeerRow[], loadTombstones: RevocationSource): Promise<void> {
+    const node = this.controlNode;
+    if (!node) {
+      return;
+    }
+    const selfPeerId = node.peerId.toString();
+    const live = new Set(rows.map((row) => row.peerId));
+    const rowless = new Map<string, PeerId>();
+    for (const connection of node.getConnections()) {
+      const remote = connection.remotePeer.toString();
+      if (remote !== selfPeerId && !live.has(remote)) {
+        rowless.set(remote, connection.remotePeer);
+      }
+    }
+    if (rowless.size === 0) {
+      return;
+    }
+    // NOTE: on a node whose anchor is empty the anchor sync skips its tombstone read, so a
+    // connection to a peer with no row (a configured relay or bootstrap peer) makes this the
+    // refresh's one `Revocation` read; bounded at one per refresh. If an un-enrolled node's
+    // refresh ever shows up in the consult budget, skip this read while the anchor is empty.
+    let revoked: Set<string>;
+    try {
+      revoked = new Set((await loadTombstones()).filter((tombstone) => tombstone.tableName === 'CadrePeer').map((tombstone) => tombstone.rowKey));
+    } catch (error) {
+      log('membership refresh: tombstone read for the hang-up of removed peers failed; next refresh retries: %o', error);
+      return;
+    }
+    // NOTE: awaited inside the membership listener, so under the control database's write
+    // lock; libp2p bounds each connection's close at its 1 s `connectionCloseTimeout`, so a
+    // silent peer holds local writes for at most that. If several removed peers ever pile up
+    // here, hang them up concurrently or move the call after the listener returns.
+    for (const [remote, peer] of rowless) {
+      if (!revoked.has(remote)) {
+        continue;
+      }
+      try {
+        await node.hangUp(peer);
+        log('membership refresh: hung up %s (its CadrePeer row is tombstoned and no live row replaced it)', remote);
+      } catch (error) {
+        log('membership refresh: hangUp of removed peer %s failed; next refresh retries: %o', remote, error);
+      }
+    }
+  }
+
+  /**
+   * Learn that an owner removed this node from the cadre, at the end of every membership
+   * refresh: a `CadrePeer` tombstone names this node's peer id, `rows` (the refresh's own
+   * retired-stamp-filtered read) has no live row for it, and an earlier refresh of this process
+   * saw one ({@link ownLiveRow}). Then it records {@link removal} and emits `cadre:removed`,
+   * once. Nothing is stopped here: stopping and deleting are the embedder's, whose storage,
+   * saved starts and process lifetime they are.
+   *
+   * The "seen live" condition keeps a machine joining again, whose fresh store can sync the old
+   * tombstone before its new row, from reporting itself removed. A re-admission under a fresh
+   * stamp is a live row, so a tombstone plus a live row is never a removal. The tombstones are
+   * the refresh's shared read, taken only once the own row is missing. Never rejects.
+   */
+  private async noteOwnRemoval(rows: readonly CadrePeerRow[], loadTombstones: RevocationSource): Promise<void> {
+    const selfPeerId = this.controlNode?.peerId.toString();
+    if (selfPeerId === undefined || this.removal !== null) {
+      return;
+    }
+    const own = rows.find((row) => row.peerId === selfPeerId);
+    if (own) {
+      this.ownLiveRow = own;
+      return;
+    }
+    // NOTE: a machine that synced its tombstone and restarted before its embedder acted never
+    // reports, since the new process never saw its row live. The embedders persist what they
+    // did (a marker, a deleted party), so the window is a crash between this event and that
+    // action; if it is ever hit, persist the removal here.
+    const lastLive = this.ownLiveRow;
+    if (lastLive === null) {
+      return;
+    }
+    let tombstones: RevocationRow[];
+    try {
+      tombstones = (await loadTombstones()).filter((tombstone) => tombstone.tableName === 'CadrePeer' && tombstone.rowKey === selfPeerId);
+    } catch (error) {
+      log('membership refresh: tombstone read for this node\'s own removal failed; next refresh retries: %o', error);
+      return;
+    }
+    if (tombstones.length === 0 || !this._running || !this.controlDatabase) {
+      return;
+    }
+    const tombstone = tombstones.find((candidate) => candidate.stampId === lastLive.stampId) ?? tombstones[0];
+    this.removal = { partyId: this.partyId, stampId: tombstone.stampId, signerKey: this.anchoredRevocationSigner(tombstone), at: Date.now() };
+    log('membership refresh: this node was removed from cadre %s (tombstone %s, signer %s)', this.partyId, tombstone.stampId, tombstone.signerKey);
+    this.emit('cadre:removed', this.removal);
+  }
+
+  /**
+   * The tombstone's signer when its signature verifies and the key is in this node's
+   * trusted-owner anchor, else null. A tombstone that fails this is still a removal (every
+   * other machine honours it, and this node's own row is gone), so it is logged, not refused.
+   */
+  private anchoredRevocationSigner(tombstone: RevocationRow): string | null {
+    if (verifyRevocationSigner(this.partyId, tombstone) && this.trustedOwnerStore?.has(tombstone.signerKey)) {
+      return tombstone.signerKey;
+    }
+    log('membership refresh: the tombstone removing this node (%s) is not signed by an owner anchored here (signer %s)', tombstone.stampId, tombstone.signerKey);
+    return null;
+  }
+
   /**
    * Add the configured `controlNetwork.bootstrapNodes` to the control node's address book
    * and dial each peer once — what `@libp2p/bootstrap` would have done had the node been
@@ -2478,14 +2986,36 @@ export class CadreNode implements SAppIdLookup {
    * founded the party passes the first test and not the second (`runOwnerGenesis` in the
    * reference apps), and a write it signed would only be refused.
    */
-  private async enrolledOwnerSigningKey(): Promise<{ privateKeyB64: string; publicKeyB64: string } | null> {
-    const signingKey = this.seedBootstrapService?.canAuthorize() ? this.getSelfSigningKey() : null;
+  private async enrolledOwnerSigningKey(): Promise<Ed25519KeyPair | null> {
+    const signingKey = this.ownerSigningKeyCandidate();
     if (!signingKey || !this.controlDatabase) {
       return null;
     }
     return (await this.controlDatabase.getOwnerKeys()).has(signingKey.publicKeyB64) ? signingKey : null;
   }
 
+  /**
+   * Whether this node can act as an owner of its cadre: its identity key is wired as its
+   * owner signing key ({@link initializeSeedBootstrap}) and enrolled in the live `OwnerKey`
+   * set ({@link enrolledOwnerSigningKey}). What the owner-only flows (`createCadreInvitation`,
+   * `claimNode`, `rentNode`) need; false before `start()`, and on a machine that joined as a
+   * member. The reference apps' "is this device an owner" check.
+   */
+  async isOwner(): Promise<boolean> {
+    return (await this.enrolledOwnerSigningKey()) !== null;
+  }
+
+  /** {@link enrolledOwnerSigningKey} judged against an owner set the caller has already read. */
+  private ownerSigningKeyEnrolledIn(ownerKeys: ReadonlySet<string>): Ed25519KeyPair | null {
+    const signingKey = this.ownerSigningKeyCandidate();
+    return signingKey !== null && ownerKeys.has(signingKey.publicKeyB64) ? signingKey : null;
+  }
+
+  /** This machine's identity key as an owner signing key, when its seed bootstrap is wired to sign; enrollment not yet checked. */
+  private ownerSigningKeyCandidate(): Ed25519KeyPair | null {
+    return this.seedBootstrapService?.canAuthorize() ? this.getSelfSigningKey() : null;
+  }
+
   /**
    * Schedule the node's initial self-record publish + ongoing refresh shortly
    * after start (non-blocking). {@link registerSelf} is idempotent and safely
@@ -2498,7 +3028,11 @@ export class CadreNode implements SAppIdLookup {
         try {
           await this.registerSelf();
         } catch (error) {
-          // Background task — a failed publish must not crash the node.
+          // Background task — a failed publish must not crash the node. A restarted machine
+          // whose own CadrePeer row replicates in while this update runs fails here with
+          // ConcurrentModificationError (seen on the owner's restart in every traced run of
+          // cadre-invite-any-member); the next connected reconcile pass retries
+          // (publishFirstSelfRecord).
           log('Self-registration failed: %o', error);
         }
         // Wire the ongoing refresh + control-cohort reconcile cadence, then run
@@ -2568,22 +3102,27 @@ export class CadreNode implements SAppIdLookup {
     }
 
     const peerId = this.controlNode.peerId.toString();
-    const addrs = await this.collectSelfAddrs();
     const existing = await this.controlDatabase.queryPeerRecord(peerId);
+    // A listener-only service (`enableSeedListener`, a claim node's) holds no owner key and
+    // cannot sign the insert, so it is "no owner service" here too.
+    const ownerService = this.seedBootstrapService?.canAuthorize() ? this.seedBootstrapService : null;
+    if (!existing && !ownerService) {
+      // "No row" also covers "revoked": queryPeerRecord reads a row whose StampId is
+      // retired in Revocation as absent, so a removed node lands here every heartbeat
+      // and stops refreshing its own record — correct, but say so, or the message reads
+      // as "never added" for a node that was removed.
+      log('registerSelf: no readable CadrePeer row for self (never added, or removed and its stamp retired) and no owner service to self-insert; skipping');
+      return 'skipped';
+    }
+    // Collected only past that skip, which a node waiting for its row replicated in takes on
+    // every connected reconcile pass ({@link publishFirstSelfRecord}).
+    const addrs = await this.collectSelfAddrs();
 
-    if (!existing) {
-      if (!this.seedBootstrapService) {
-        // "No row" also covers "revoked": queryPeerRecord reads a row whose StampId is
-        // retired in Revocation as absent, so a removed node lands here every heartbeat
-        // and stops refreshing its own record — correct, but say so, or the message reads
-        // as "never added" for a node that was removed.
-        log('registerSelf: no readable CadrePeer row for self (never added, or removed and its stamp retired) and no owner service to self-insert; skipping');
-        return 'skipped';
-      }
+    if (!existing && ownerService) {
       // First-time row: requires an owner signature (the node is its own
       // owner). insertSelfPeerRecord throws if no owner key is present.
       const record = this.signSelfRecord(peerId, signingKey, addrs, null);
-      if (await this.seedBootstrapService.insertSelfPeerRecord(record)) {
+      if (await ownerService.insertSelfPeerRecord(record)) {
         if (this.committedAlone()) this.pendingSelfPeerWrite = true;
         this.noteSelfRecordPublished();
         log('registerSelf: inserted own CadrePeer record (owner-signed, updatedAt=%d, %d addrs, sig=%s…)', record.updatedAt, addrs.length, record.sig.slice(0, 16));
@@ -2720,7 +3259,8 @@ export class CadreNode implements SAppIdLookup {
   ): PeerAddressRecord {
     const updatedAt = Math.max(Date.now(), (existing?.updatedAt ?? 0) + 1);
     return signPeerRecord(
-      { peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt },
+      this.partyId,
+      { peerId, publicKey: signingKey.publicKeyB64, addrs, updatedAt, profile: this.config.profile },
       signingKey.privateKeyB64
     );
   }
@@ -2802,6 +3342,42 @@ export class CadreNode implements SAppIdLookup {
     return ed25519KeyPairFromLibp2p(this.identityKey);
   }
 
+  /**
+   * Publish this node's own address record from the reconcile pass until its first publish of
+   * this session lands. A node with no owner key — seeded (`addDrone`, `cadre enroll add`),
+   * claimed (`claimNode`) or otherwise authorized after it booted — cannot insert its own
+   * `CadrePeer` row; the row an owner wrote for it reaches it by replication once the two
+   * connect, usually after the boot-time publish and the first-growth drain have both found
+   * nothing to publish. Without this the record would wait for the heartbeat
+   * ({@link startRecordRefresh}), and the cadre could not resolve the node's addresses until
+   * then. The reconcile pass is where replicated membership is picked up, so each pass tries.
+   * It also retries an owner's boot-time publish that failed.
+   *
+   * A try before the row has arrived is a `skipped` publish: one `CadrePeer` read. Not tried
+   * while the node waits to be claimed (it has no row and no party yet) or once it has learned
+   * it was removed (nothing to publish). A removed node that never saw its own row live in this
+   * process does not learn it was removed ({@link noteOwnRemoval}), and pays that read on every
+   * pass.
+   *
+   * Connected-only: a row written elsewhere arrives over a connection, and an owner's publish
+   * committed alone is local-only and forks its own history — a restarted owner whose embedder
+   * runs a pass before it reconnects would write its row on the stale side of the fork, and
+   * then never see rows written while it was down (`cadre-invite-any-member` runs that pass and
+   * fails every time without this condition). The boot-time publish and the first-growth drain already try at the node's lone and
+   * first-connection moments; this retries on the passes after.
+   */
+  private async publishFirstSelfRecord(): Promise<void> {
+    if (this.lastSelfRecordPublishAt !== null || this.isAwaitingClaim() || this.removal !== null
+      || this.getControlConnectionCount() === 0) {
+      return;
+    }
+    const outcome = await this.registerSelf().catch((error: unknown) => {
+      log('reconcileControlCohort: first self-record publish failed (continuing): %o', error);
+      return 'skipped' as const;
+    });
+    log('reconcileControlCohort: first self-record publish: %s', outcome);
+  }
+
   /**
    * Collect this node's current dialable addresses for publication, signaling
    * (`/p2p-circuit`) first. Prefers the best invite/NAT-resolved set and folds
@@ -2848,23 +3424,21 @@ export class CadreNode implements SAppIdLookup {
     };
     this.controlNode.addEventListener('self:peer:update', this.selfPeerUpdateHandler);
 
-    // NOTE: a node AUTHORIZED AFTER IT BOOTED can wait a whole heartbeat (7.5 min)
-    // to publish its address. `registerSelf` no-ops while a node has no readable
-    // `CadrePeer` row, so its boot-time publish does nothing, and the two triggers
-    // wired here are the only ones after that: `self:peer:update` needs an ADDRESS
-    // CHANGE, and a relay-only node's addresses stop changing the moment its
-    // reservation lands — inside `start()`, before this listener exists (on the
-    // `network.requireRelay: false` posture the reservation may instead land LATER,
-    // from the retry supervisor, and then this listener is what publishes the
-    // `/p2p-circuit` address the boot-time publish could not carry). Harmless
-    // where a late-authorized node's addresses keep churning (NAT/relay rotation
-    // fire the event anyway), and invisible while parties authorize members before
-    // they boot. If late enrollment becomes the normal path — an invited phone is
-    // exactly that — republish on the membership-change seam that already exists
-    // (`ControlDatabase.setMembershipChangeListener`) rather than lengthening this
-    // list of triggers. Measured while writing
-    // `relay-only-control-addr.integration.ts` case 4, which drives `registerSelf()`
-    // explicitly because neither trigger is dependable there.
+    // A node AUTHORIZED AFTER IT BOOTED (seeded, claimed, invited) gets its first
+    // publish from the reconcile pass ({@link publishFirstSelfRecord}), not from the
+    // two triggers wired here. `registerSelf` no-ops while a node has no readable
+    // `CadrePeer` row, so its boot-time publish does nothing, and neither trigger is
+    // dependable after that: `self:peer:update` needs an ADDRESS CHANGE, and a
+    // relay-only node's addresses stop changing the moment its reservation lands —
+    // inside `start()`, before this listener exists (on the `network.requireRelay:
+    // false` posture the reservation may instead land LATER, from the retry
+    // supervisor, and then this listener is what publishes the `/p2p-circuit` address
+    // the boot-time publish could not carry); the heartbeat is 7.5 min away. Nor is
+    // the membership-change seam (`ControlDatabase.setMembershipChangeListener`): it
+    // fires on LOCAL commits only, and the row a late-authorized node waits for is
+    // written elsewhere. Measured while writing `relay-only-control-addr.integration.ts`
+    // case 4, which drives `registerSelf()` explicitly because neither trigger is
+    // dependable there.
     this.recordRefreshTimer = setInterval(() => republish('heartbeat'), DEFAULT_PEER_RECORD_HEARTBEAT_MS);
     (this.recordRefreshTimer as { unref?: () => void } | null)?.unref?.();
 
@@ -2976,7 +3550,7 @@ export class CadreNode implements SAppIdLookup {
     }
 
     // Self-signature over (peerId, addrs, updatedAt).
-    if (!verifyPeerRecordSignature(record)) {
+    if (!verifyPeerRecordSignature(this.partyId, record)) {
       // Field detail distinguishes "holding the owner-vouch revision (Sig null,
       // no addrs — a not-yet-self-published row)" from a genuinely corrupt or
       // mixed-revision row. Sig/addrs are public replicated data.
@@ -3035,8 +3609,9 @@ export class CadreNode implements SAppIdLookup {
    * ({@link bootstrapDialAddrs}).
    *
    * An address naming a DIFFERENT trailing peer id is dropped: it does not reach
-   * `peerId`, so it does not belong in this peer's candidate list (libp2p's own
-   * dial queue filters the same shape out one layer lower).
+   * `peerId`, so it does not belong in this peer's candidate list (`dialPeerAddrs`
+   * binds every address to the peer it is given and drops the same shape one
+   * layer lower; here it is dropped before it can reach the address book).
    */
   private normalizeDialAddrs(addrs: Multiaddr[], peerId: string): Multiaddr[] {
     // Keyed by the NORMALIZED string, so two entries differing only by the suffix
@@ -3169,6 +3744,10 @@ export class CadreNode implements SAppIdLookup {
     if (!this._running || !this.controlNode || !this.controlDatabase) {
       return { dialed: [] };
     }
+    await this.publishFirstSelfRecord();
+    if (!this._running || !this.controlNode || !this.controlDatabase) {
+      return { dialed: [] };
+    }
     // Refresh relay delegate grants BEFORE the sibling enumeration below: a
     // solo cadre with a party relay has no siblings to dial but must still keep
     // its running strands' grants alive (a dropped relay connection re-dials
@@ -3464,8 +4043,7 @@ export class CadreNode implements SAppIdLookup {
    * addresses ({@link dialPeerAddrs}): the reconcile pass's steady-state sibling
    * ({@link dialControlSibling}) and cold-start bootstrap peer
    * ({@link dialBootstrapPeer}) dials, and — handed to every
-   * {@link SeedBootstrapService} this node builds — `applySeed`'s owner dials and
-   * `dialInvite`.
+   * {@link SeedBootstrapService} this node builds — `applySeed`'s owner dials.
    *
    * See `peer-dial.ts`'s `DEFAULT_CONTROL_COHORT_DIAL_TIMEOUT_MS` for why a peer's dial is
    * bounded as a whole, and `DEFAULT_CONTROL_COHORT_PER_ADDRESS_DIAL_TIMEOUT_MS` for why each
@@ -3540,6 +4118,7 @@ export class CadreNode implements SAppIdLookup {
       log('reconcileControlCohort: dialing sibling %s (%d addr(s))', sibling.peerId, addrs.length);
       await dialPeerAddrs(
         controlNode,
+        sibling.peerId,
         addrs,
         this.controlDialBudget(),
         `reconcileControlCohort dial of sibling ${sibling.peerId}`
@@ -3575,9 +4154,9 @@ export class CadreNode implements SAppIdLookup {
    *
    * The list may name transports this node cannot dial (a lent node reports TCP
    * and `/ws` addresses to a phone that dials WebSockets only). That needs no
-   * filtering here: libp2p's dial queue (`calculateMultiaddrs`, libp2p 3.3.11)
-   * rejects an address no transport can dial before touching the network, so
-   * such an address costs a log line.
+   * filtering here: libp2p's transport manager rejects an address no transport
+   * can dial before touching the network (`TransportUnavailableError`), so such
+   * an address costs a log line.
    *
    * The list is NOT handed to one `dial()`. libp2p tries a multi-address dial's
    * addresses one after another under a single deadline, and sorts loopback
@@ -3806,6 +4385,7 @@ export class CadreNode implements SAppIdLookup {
       log('reconcileControlCohort(cold-start): dialing bootstrap peer %s (%d addr(s))', peerId, parsed.length);
       await dialPeerAddrs(
         controlNode,
+        peerId,
         parsed,
         this.controlDialBudget(),
         `reconcileControlCohort cold-start dial of bootstrap peer ${peerId}`
@@ -3901,7 +4481,7 @@ export class CadreNode implements SAppIdLookup {
       return;
     }
     this.pendingRevocations.set(revocation.stampId, revocation);
-    log('%s delete of %s committed while alone (0 control connections); Revocation tombstone ' +
+    log('%s tombstone for %s committed while alone (0 control connections); Revocation tombstone ' +
       '(stamp %s) queued for re-issue on cohort growth', revocation.tableName, revocation.rowKey, revocation.stampId);
   }
 
@@ -3976,7 +4556,7 @@ export class CadreNode implements SAppIdLookup {
     // 4. In-session pending owner authorize writes.
     await this.drainPendingPeerWrites();
 
-    // 5. `PendingJoin` rows this process wrote while alone. Their tombstones went out in step 1.
+    // 5. Pending joins this process wrote while alone. Their tombstones went out in step 1.
     await this.pendingJoinRunner?.reissueWritesMadeAlone();
   }
 
@@ -4036,7 +4616,10 @@ export class CadreNode implements SAppIdLookup {
    */
   private async drainPendingRevocations(): Promise<void> {
     const sweep = !this.reissuedHeldRevocations;
-    if (!sweep && this.pendingRevocations.size === 0) {
+    // A removed machine's owner key went with its row (`removeMachine`), so the schema's
+    // live-owner clause refuses every re-issue it could sign; reconstructAuthoredMembership
+    // and drainPendingPeerWrites stop on the same test.
+    if (this.removal !== null || (!sweep && this.pendingRevocations.size === 0)) {
       return;
     }
     if (!this._running || !this.controlNode || !this.controlDatabase) {
@@ -4062,6 +4645,10 @@ export class CadreNode implements SAppIdLookup {
         this.pendingRevocations.delete(row.stampId);
       }
     } catch (error) {
+      // NOTE: an owner whose key alone was removed (`removeOwner`, its machine still a member,
+      // so not a removal this node reports) keeps running these drains, and every attempt
+      // fails the schema's live-owner clause and lands here on each growth edge. Noise, not
+      // harm; if it shows up, gate the drains on this node's key being a live owner.
       log('drain: revocation re-issue failed; leaving queued for next growth: %o', error);
     }
   }
@@ -4084,7 +4671,7 @@ export class CadreNode implements SAppIdLookup {
    * `CadrePeer` trace, but its tombstone is re-issuable).
    */
   private async reconstructAuthoredMembership(): Promise<void> {
-    if (!this.controlDatabase || !this.controlNode) {
+    if (!this.controlDatabase || !this.controlNode || this.removal !== null) {
       return;
     }
     if (!this.seedBootstrapService?.canAuthorize()) {
@@ -4146,7 +4733,7 @@ export class CadreNode implements SAppIdLookup {
    * here.
    */
   private async drainPendingPeerWrites(): Promise<void> {
-    if (this.pendingPeerWrites.size === 0) {
+    if (this.pendingPeerWrites.size === 0 || this.removal !== null) {
       return;
     }
     if (!this.seedBootstrapService?.canAuthorize()) {
@@ -4299,6 +4886,7 @@ export class CadreNode implements SAppIdLookup {
     // Strictly increase UpdatedAt even on a same-millisecond re-publish (rotation).
     const updatedAt = Math.max(Date.now(), (existing?.updatedAt ?? 0) + 1);
     const record = signDeviceTokenRecord(
+      this.partyId,
       { peerId, platform, token, updatedAt },
       signingKey.privateKeyB64
     );
@@ -4395,7 +4983,7 @@ export class CadreNode implements SAppIdLookup {
 
     // Self-signature over (peerId, platform, token, updatedAt), verified against the
     // CadrePeer.PublicKey bound to this peerId.
-    if (!verifyDeviceTokenSignature(record, peerRecord.publicKey)) {
+    if (!verifyDeviceTokenSignature(this.partyId, record, peerRecord.publicKey)) {
       log('resolveDeviceToken: signature verification failed for %s', peerId);
       return null;
     }
@@ -4656,6 +5244,12 @@ export class CadreNode implements SAppIdLookup {
       this.strandAddrService = null;
     }
 
+    // Unregister the cadre invitation redemption handler, for the same reason.
+    if (this.cadreInviteHandler && this.controlNode) {
+      await this.cadreInviteHandler.unregister(this.controlNode);
+    }
+    this.cadreInviteHandler = null;
+
     // Tear down the push-wake fan-out (releases the notifier's APNs HTTP/2 session).
     if (this.pushFanoutService) {
       await this.pushFanoutService.close().catch((err) => log('Push fan-out close failed: %o', err));
@@ -5947,6 +6541,8 @@ export class CadreNode implements SAppIdLookup {
       // comes up `'syncing'` announces the moment its database is published.
       firstSync: this.config.strandFirstSync,
       onWritable: (writableStrandId) => this.handleStrandWritable(writableStrandId),
+      onCommitDurability: (commit) => this.emit('strand:commit-durability', commit),
+      onCommitHeld: (held) => this.emit('strand:commit-held', held),
       // Re-announce the delegate to ONE relay before the strand node's reservation
       // supervisor re-drives it (see announceDelegateToRelay). Retained with the
       // launch config, so a hibernation wake's rebuilt supervisors get it too.
@@ -7120,6 +7716,15 @@ export class CadreNode implements SAppIdLookup {
    *
    * Passing an empty list stops the supervisor and resets the posture to `none`
    * without dialing or waiting.
+   *
+   * NOTE: on a node with no `network.relayAddrs` (a browser tab with a hand-written
+   * bare `/p2p-circuit`), libp2p's relay discovery stays on, because it was the only
+   * thing filling that slot before this call. Such a tab connected to some other
+   * relay-capable peer it identifies (a party member running the relay server) can
+   * lose its one slot to that peer before this supervisor's request runs, the theft
+   * `nodeTransportsOption` prevents on configured nodes (`relay-reservation.ts`). If a
+   * tab is ever seen reserved through a relay it was not asked to use, build that
+   * node through `withoutRelayDiscovery` too, or have the tab configure `relayAddrs`.
    */
   async reserveRelays(
     addrs: string[],
@@ -7228,22 +7833,35 @@ export class CadreNode implements SAppIdLookup {
     if (!this.controlNode || !this.controlDatabase) {
       throw new Error('CadreNode must be started before initializing seed bootstrap');
     }
+    // A hosted node waiting to be claimed never holds an owner key: the claim is its
+    // one trust source, and genesis-anchoring a key here would mark it claimed by
+    // itself. Refused here rather than in start() because this call comes after it.
+    if (this.config.claim) {
+      throw new Error('CadreNode: a node started with `claim` is owned by its claimant and cannot initialize seed bootstrap with an owner key');
+    }
 
     // A node wiring seed-bootstrap with an owner PRIVATE key is declaring that
     // key an authority of its own party (founder genesis / self-signing owner)
     // — anchor it in the node-local store. The in-memory set updates
     // synchronously (see TrustedOwnerStore.trust); only the file persist is
     // fire-and-forget, logged on failure.
-    // NOTE: non-founder members that also wire seed-bootstrap with their own
-    // derived key (e.g. the phone joiner path in runOwnerGenesis, which needs
-    // it to self-publish its CadrePeer row) self-anchor a key that is not a
-    // party authority. Harmless while such a node never mints an invite: the
-    // store does not replicate, so a node trusting itself grants nothing to
-    // others. But `createInvite` now hands out the anchor's contents as the
-    // invitee's pins, so the moment a non-founder member mints an invite it
-    // exports its own non-authority key as a cadre owner key. If that becomes
-    // reachable (today only cadre-cli/cadre-host owners mint invites), gate this
-    // self-anchor on the actual OwnerKey genesis insert instead.
+    // NOTE: wiring a key that is not a live owner here self-anchors a key that is
+    // no party authority, and the anchor sync (`syncOwnerAnchor`) does not correct
+    // it: a `genesis` entry is base, kept whether or not a live `OwnerKey` row
+    // vouches it. A machine that joined by invitation reaches this only through
+    // `wireOwnKeyIfOwner`, which checks the row first, so a joined non-owner never
+    // self-anchors. Three callers still wire unconditionally on every start, so a
+    // node of theirs started for a party founded elsewhere does: the phone kit's
+    // `runOwnerGenesis` (cadre-rn; only for a party its saved start does not record
+    // as joined, whose starts call `wireOwnKeyIfOwner` instead), the web reference
+    // app's start (`cadre-web.ts`) and `cadre start --owner`. Contained while the store does
+    // not replicate and such a node cannot mint: `createCadreInvitation` hands out
+    // the anchor as the device's pins, but the `CadreInvite` insert needs a live
+    // owner as issuer. If anything hands out the anchor without that check, gate
+    // this self-anchor on a live `OwnerKey` row instead. A non-owner needs no
+    // owner key to publish its own address record: once an owner or a redemption
+    // has written its `CadrePeer` row, `registerSelf` refreshes it with the
+    // identity key alone.
     if (this.trustedOwnerStore) {
       void this.trustedOwnerStore
         .trust(ed25519PublicKeyFromPrivate(ownerPrivateKey), 'genesis')
@@ -7253,9 +7871,8 @@ export class CadreNode implements SAppIdLookup {
     await this.installSeedBootstrapService(new SeedBootstrapService({
       partyId: this.config.controlNetwork.partyId,
       ownerPrivateKey,
-      inviteAddressResolver: () => this.resolveInviteAddresses(),
       ...this.seedServiceBudgets(),
-      trustPolicy: this.config.seedTrustPolicy,
+      trustPolicy: this.inboundSeedTrustPolicy(),
       // Seed trust anchors on the node-local store (seeded just above with this
       // node's own genesis key), never on the replicated OwnerKey table.
       ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
@@ -7341,6 +7958,11 @@ export class CadreNode implements SAppIdLookup {
    * {@link isMember}). Rows whose stamp is retired in `CadreControl.Revocation`
    * never reach here: {@link ControlDatabase.queryCadrePeers} excludes them, so a
    * revoked peer is not addressable either.
+   *
+   * NOTE: answers the whole `CadrePeerRow`, past the two fields declared; the integration
+   * harness (`owner-cli-node.ts`, `OwnerCliMemberRow.sig`) reads `sig` off it through the admin
+   * channel to tell a row another member seated from one the subject published itself. Narrow
+   * this to the declared fields only together with that reader.
    */
   async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
     if (!this.controlDatabase) {
@@ -7373,14 +7995,21 @@ export class CadreNode implements SAppIdLookup {
    *  1. it is not this node itself — a node publishes its own `CadrePeer` address
    *     row so its dialable address rides in seeds, but "self" is not a peer this
    *     node authorized;
-   *  2. its `CadrePeer` row carries a complete voucher (`StampId`, `VouchOwner`,
-   *     `VouchSig` all non-null);
+   *  2. its `CadrePeer` row carries a complete proof: EITHER an owner voucher
+   *     (`StampId`, `VouchOwner`, `VouchSig` all non-null) OR an invitation admission
+   *     (`VouchSig` null, `VouchUsage` naming a `CadreInviteUsage` row);
    *  3. `VouchOwner` is in the NODE-LOCAL trusted-owner anchor
-   *     ({@link getTrustedOwnerStore}) — never the replicated `OwnerKey` table,
-   *     which any stranger can genesis-pollute; and
-   *  4. `VouchSig` verifies as that owner's signature over the row's voucher
-   *     digest ({@link verifyCadrePeerVoucher}), so the anchored owner really
-   *     vouched THIS peer id under THIS row's nonce; and
+   *     ({@link getTrustedOwnerStore}), which follows the replicated `OwnerKey` table
+   *     only along chains that verify from this node's out-of-band keys
+   *     ({@link syncOwnerAnchor}) — never the table itself, which any stranger can
+   *     genesis-pollute; and
+   *  4. the proof verifies: for a voucher, `VouchSig` is that owner's signature over
+   *     the row's voucher digest ({@link verifyCadrePeerVoucher}), so the anchored
+   *     owner really vouched THIS peer id under THIS row's nonce; for an admission,
+   *     the chain row → usage → invitation → anchored issuer verifies link by link
+   *     ({@link verifyInvitationAdmission} — the issuer is `VouchOwner`, the invitation's
+   *     own owner signature, the holder's and the device's signatures, and the stored
+   *     peer key really is the key behind the peer id); and
    *  5. the row's `StampId` is NOT retired in `CadreControl.Revocation` — enforced
    *     upstream in {@link ControlDatabase.queryCadrePeers}, which drops retired rows
    *     before ANY reader (this predicate included) sees them, so a row resurrected
@@ -7389,18 +8018,26 @@ export class CadreNode implements SAppIdLookup {
    *     local rows) is still inert to every reader that has the tombstone.
    *
    * Fail-closed at every step: a missing anchor (pre-start), an empty anchor (a
-   * not-yet-enrolled node authorizes no one), a null/partial voucher, an
-   * unanchored `VouchOwner`, or a bad signature all yield "not authorized" —
-   * having an address row is NOT membership. The control-network wake and
-   * strand-address gates consult this set, NOT the addressable one.
+   * not-yet-enrolled node authorizes no one), a null/partial proof, an
+   * unanchored `VouchOwner`, a bad signature, or a usage or invitation row this node
+   * does not hold all yield "not authorized" — having an address row is NOT
+   * membership. The protocol guard admits wake and strand-address requests by this set,
+   * NOT the addressable one.
+   *
+   * The usage and invitation tables are read only when at least one row needs them,
+   * so a cadre with no invitation-admitted member stays at one read per call.
    *
    * NOTE (rotation): if a party owner rotates keys and only the NEW key is pinned
    * in the anchor, rows the OLD key vouched fail check 3 until re-vouched — a
    * legit member goes un-authorized on readers that only pin the new key. Full
    * rotation handling (re-vouch on rotate) is the
-   * `flip-strand-membership-rotation-known-gap` work, not this predicate's.
+   * `flip-strand-membership-rotation-known-gap` work, not this predicate's. The
+   * `OwnerKey` table differs: an owner the rotated-out (or removed) key vouched keeps
+   * its place in every anchor that had derived it ({@link syncOwnerAnchor}: a derived
+   * entry stays while its own row is live), and is only out of reach for a machine that
+   * never held it until a remaining owner re-adds it or an invitation pins it.
    *
-   * @param retry - Whether the underlying membership read may retry a transient cluster
+   * @param retry - Whether the underlying membership reads may retry a transient cluster
    *   failure. Only {@link refreshAuthorizedControlPeers} passes `false`, because it runs
    *   as the control database's membership listener with that database's write lock held;
    *   see its comment.
@@ -7409,10 +8046,36 @@ export class CadreNode implements SAppIdLookup {
     if (!this.controlDatabase) {
       throw new Error('CadreNode must be started before listing members');
     }
+    return await this.collectAuthorizedMembers(this.controlDatabase, retry, this.invitationChainSource(this.controlDatabase, retry));
+  }
+
+  /**
+   * The body of {@link listAuthorizedMembers}, with the invitation chain supplied as a
+   * source so the membership refresh can share one load with {@link syncOwnerAnchor}.
+   */
+  private async collectAuthorizedMembers(
+    controlDatabase: ControlDatabase,
+    retry: boolean,
+    loadChain: InvitationChainSource,
+  ): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+    const rows = await controlDatabase.queryCadrePeers(retry);
+    return this.authorizedAmong(rows, await this.chainFor(rows, loadChain));
+  }
+
+  /** The invitation chain, loaded only when some row in `rows` is invitation-admitted. */
+  private async chainFor(rows: readonly CadrePeerRow[], loadChain: InvitationChainSource): Promise<InvitationChain | null> {
+    return rows.some(isInvitationAdmitted) ? await loadChain() : null;
+  }
+
+  /**
+   * The authorized members among `rows`, already read: checks 1 to 4 of
+   * {@link listAuthorizedMembers}' predicate (check 5 is `queryCadrePeers`'s), so the membership
+   * refresh can judge the rows it has to read anyway for the hang-up of removed peers.
+   */
+  private authorizedAmong(rows: readonly CadrePeerRow[], chain: InvitationChain | null): Array<{ peerId: string; multiaddr: string | null }> {
     const selfPeerId = this.peerId?.toString();
-    const rows = await this.controlDatabase.queryCadrePeers(retry);
     const authorized = rows
-      .filter(row => row.peerId !== selfPeerId && this.hasAnchoredVoucher(row))
+      .filter(row => row.peerId !== selfPeerId && this.hasAnchoredProof(row, chain))
       .map(({ peerId, multiaddr }) => ({ peerId, multiaddr }));
     // A node whose anchor was never seeded (no invite pin, no operator pin, not a
     // founder) refuses every wake and strand-addr request, which from the outside
@@ -7426,9 +8089,168 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Checks 2–4 of the authorized-membership predicate (see
-   * {@link listAuthorizedMembers}) for one `CadrePeer` row: complete voucher,
-   * `VouchOwner` in the node-local anchor, signature valid over the row's
-   * (PeerId, StampId) voucher digest.
+   * {@link listAuthorizedMembers}) for one `CadrePeer` row, by the kind of proof it
+   * carries: an owner voucher ({@link hasAnchoredVoucher}) or an invitation admission
+   * ({@link verifyInvitationAdmission} over the usage and invitation rows in `chain`,
+   * loaded only when some row needs them). A row with a `VouchSig` is judged as a
+   * voucher even if it also names a usage — the signature is the stronger proof and the
+   * one an owner re-vouch leaves behind.
+   */
+  private hasAnchoredProof(row: CadrePeerVoucherFields, chain: InvitationChain | null): boolean {
+    if (!isInvitationAdmitted(row)) {
+      return this.hasAnchoredVoucher(row);
+    }
+    const usage = chain?.usages.get(row.vouchUsage!);
+    const invite = usage === undefined ? undefined : chain?.invites.get(usage.inviteKey);
+    if (usage === undefined || invite === undefined) {
+      return false;
+    }
+    return verifyInvitationAdmission(this.partyId, row, usage, invite, key => this.trustedOwnerStore?.has(key) ?? false);
+  }
+
+  /**
+   * Recompute the node-local trusted-owner anchor from the replicated `OwnerKey` table along
+   * verifiable chains (`owner-anchor-sync.ts` → {@link deriveOwnerAnchor}), as the first step
+   * of every membership refresh ({@link refreshAuthorizedControlPeers}) so the snapshot built
+   * in the same pass judges `CadrePeer` rows against the updated anchor. A key whose live
+   * row's stored proof verifies against a key already anchored enters under `chain` and
+   * stays while its row is live; a key an anchored owner's verifiable tombstone names
+   * leaves, base pins included — which is how a config pin of a removed key, re-anchored at
+   * every start ({@link initializeTrustedOwnerStore}), is removed again. The derivation
+   * refuses removals that would empty the anchor; they are logged here.
+   *
+   * With an EMPTY anchor the sync does nothing: there is no key to derive from, and a node
+   * waiting to be claimed ({@link isAwaitingClaim}: claim secret set, anchor empty) must
+   * stay empty until the claim anchors its claimant — the replicated table must never seat
+   * the first key. The early return below is the seam that rests on.
+   *
+   * Any read failure skips the whole pass and leaves the anchor as it was; the refresh then
+   * builds its snapshot against that anchor, which is also what its previous snapshot was
+   * judged against. Caught here rather than failing the refresh, because the membership read
+   * tolerates an unreachable `Revocation` block on an isolated node
+   * (`ControlDatabase.readRevokedStampRows`) and `queryRevocations` does not: failing the
+   * whole refresh on that would freeze such a node's gate snapshot.
+   * NOTE: on such a node the sync is skipped at every refresh until the block is held; if an
+   * isolated node ever has to derive owner additions while cut off, give `queryRevocations`
+   * the same cohort-unreachable fallback.
+   *
+   * NOTE: cost per membership refresh is one `OwnerKey` read and one `Revocation` read (the
+   * tombstone list, whose `OwnerKey` stamps are handed to `queryOwnerKeyRows` so it does not
+   * read the retired set again, and which the hang-up of removed peers shares through
+   * `loadTombstones`), plus the invitation chain when some owner row is
+   * invitation-admitted — shared with the membership read through `loadChain`; the memo
+   * suggestion on {@link loadInvitationChain} covers that part. Before the Revocation ledger
+   * marker is filed that one read is a cohort consult per refresh, which
+   * `control-founding-consult-budget.spec.ts` pins.
+   *
+   * @param retry - forwarded to every read; `false` on the refresh path, for the reason on
+   *   {@link refreshAuthorizedControlPeers}.
+   * @param loadTombstones - the refresh's shared tombstone read ({@link revocationSource}).
+   */
+  private async syncOwnerAnchor(reason: string, retry: boolean, loadChain: InvitationChainSource, loadTombstones: RevocationSource): Promise<void> {
+    const store = this.trustedOwnerStore;
+    const controlDatabase = this.controlDatabase;
+    if (!store || !controlDatabase) {
+      return;
+    }
+    const before = store.sources();
+    if (before.size === 0) {
+      return;
+    }
+    let target: ReadonlySet<string>;
+    try {
+      const tombstones = await loadTombstones();
+      const retired = new Set(tombstones.filter(tombstone => tombstone.tableName === 'OwnerKey').map(tombstone => tombstone.stampId));
+      const rows = await controlDatabase.queryOwnerKeyRows(retry, retired);
+      const chain = rows.some(isInvitationAdmitted) ? await loadChain() : null;
+      const derivation = deriveOwnerAnchor({ partyId: this.partyId, anchor: before, rows, tombstones, chain });
+      if (derivation.refusedRemovals.length > 0) {
+        log('syncOwnerAnchor(%s): refused %d owner removal(s) that would empty the anchor: %o', reason, derivation.refusedRemovals.length, derivation.refusedRemovals);
+      }
+      target = derivation.target;
+    } catch (error) {
+      log('syncOwnerAnchor(%s): read failed — anchor left as it was: %o', reason, error);
+      return;
+    }
+    await this.applyOwnerAnchor(store, before, target, reason);
+  }
+
+  /**
+   * Apply one pass's result: `chain` entries for the keys it newly derived, removal of the keys
+   * it started with that are outside `target` — base keys a verifiable tombstone named, and
+   * `chain` entries whose row is gone.
+   *
+   * Diffed against `before`, the snapshot the derivation was computed from, NOT the live store:
+   * the anchor is written out of band while the pass's reads are in flight (an invitation pin,
+   * the genesis anchor, a claim, a seed), and such a key is outside `target` only because the
+   * pass never saw it — judging the live store would remove it. Likewise a key removed
+   * meanwhile (a claim rollback) must not come back as `chain`. Both are judged by the next
+   * pass. Each change lands in memory synchronously (`TrustedOwnerStore.trust` / `remove`); a
+   * failed PERSIST is logged and does not stop the pass or fail the refresh, as
+   * `SeedBootstrapService.anchorAcceptedSigner` treats the same failure.
+   */
+  private async applyOwnerAnchor(
+    store: TrustedOwnerStore,
+    before: ReadonlyMap<string, TrustSource>,
+    target: ReadonlySet<string>,
+    reason: string,
+  ): Promise<void> {
+    for (const key of target) {
+      if (!before.has(key) && !store.has(key)) {
+        log('syncOwnerAnchor(%s): owner %s derived from the OwnerKey table', reason, key);
+        await store.trust(key, 'chain').catch(error => log('syncOwnerAnchor(%s): anchor persist failed for %s: %o', reason, key, error));
+      }
+    }
+    for (const key of before.keys()) {
+      if (!target.has(key) && store.has(key)) {
+        log('syncOwnerAnchor(%s): owner %s removed from the anchor', reason, key);
+        await store.remove(key).catch(error => log('syncOwnerAnchor(%s): anchor persist failed for %s: %o', reason, key, error));
+      }
+    }
+  }
+
+  /**
+   * A per-refresh {@link InvitationChainSource}: the first call loads the chain through
+   * {@link loadInvitationChain}, every later call shares that load.
+   */
+  private invitationChainSource(controlDatabase: ControlDatabase, retry: boolean): InvitationChainSource {
+    let loading: Promise<InvitationChain> | null = null;
+    return () => (loading ??= this.loadInvitationChain(controlDatabase, retry));
+  }
+
+  /** A per-refresh {@link RevocationSource}: one `queryRevocations` read, shared by every caller in the pass. */
+  private revocationSource(controlDatabase: ControlDatabase, retry: boolean): RevocationSource {
+    let loading: Promise<RevocationRow[]> | null = null;
+    return () => (loading ??= controlDatabase.queryRevocations(retry));
+  }
+
+  /**
+   * The usage and invitation rows {@link hasAnchoredProof} and {@link syncOwnerAnchor}
+   * resolve an invitation-admitted row through, keyed for lookup. Both reads honour `retry`
+   * for {@link listAuthorizedMembers}' reason.
+   *
+   * NOTE: once invitations are the only admission route (ticket
+   * `cadre-invitations-redeemable-by-any-member`), every cadre with a member not yet
+   * re-vouched pays these two whole-table reads and three ed25519 verifies per row on every
+   * membership refresh. Both tables are append-only and a verified chain never changes (expiry,
+   * use count and withdrawal are not re-checked), so if the gate's admission deadline ever
+   * shows this, memoise verified (row stamp → usage stamp) pairs per node and skip the reads
+   * when every admitted row is already memoised.
+   */
+  private async loadInvitationChain(controlDatabase: ControlDatabase, retry: boolean): Promise<InvitationChain> {
+    const [usages, invites] = await Promise.all([
+      controlDatabase.queryCadreInviteUsages(retry),
+      controlDatabase.queryCadreInvites(retry),
+    ]);
+    return {
+      usages: new Map(usages.map(usage => [usage.usageStampId, usage])),
+      invites: new Map(invites.map(invite => [invite.key, invite])),
+    };
+  }
+
+  /**
+   * The owner-voucher half of {@link hasAnchoredProof}: complete voucher, `VouchOwner` in
+   * the node-local anchor, signature valid over the row's (PeerId, StampId) voucher digest.
    *
    * NOTE: verifies the ed25519 signature on every call (no memo of already-
    * verified (peerId, stampId, vouchSig) triples). Cadres are a handful of
@@ -7443,13 +8265,13 @@ export class CadreNode implements SAppIdLookup {
     if (!this.trustedOwnerStore?.has(row.vouchOwner)) {
       return false;
     }
-    return verifyCadrePeerVoucher(row.peerId, row.stampId, row.vouchOwner, row.vouchSig);
+    return verifyCadrePeerVoucher(this.partyId, row.peerId, row.stampId, row.vouchOwner, row.vouchSig);
   }
 
   /**
    * Probe whether a given peer is an AUTHORIZED party member (see
-   * {@link listAuthorizedMembers}) — the gate the control-network wake and
-   * strand-address responders consult, NOT {@link isMember} (the addressable
+   * {@link listAuthorizedMembers}) — the check the protocol guard runs ahead of the
+   * control-network wake and strand-address handlers, NOT {@link isMember} (the addressable
    * surface). Deliberately scans the full membership (one `CadrePeer` query)
    * rather than adding a single-row read path: cadres are small, and one code
    * path keeps the predicate impossible to drift from the list.
@@ -7466,14 +8288,16 @@ export class CadreNode implements SAppIdLookup {
    * record (via {@link resolvePeerAddrs}, signaling/relay first — so a NAT'd peer
    * is reachable through its circuit-relay address), dials `WAKE_PROTOCOL`, sends
    * the {@link WakeRequest}, and returns the peer's {@link WakeAck}. The receiver
-   * gates the request on cadre membership and only resumes a strand it already
-   * participates in; it acks once it has decided, before the strand is up. The
-   * dial deadlines derive from this node's `network.linkRoundTripMs`.
+   * only resumes a strand it already participates in; it acks once it has decided,
+   * before the strand is up. The dial deadlines derive from this node's
+   * `network.linkRoundTripMs`.
    *
    * @param targetPeerId - The hibernating cadre peer to wake.
    * @param strandId - The strand the caller knows has pending activity.
    * @param reason - Optional cause hint, e.g. `"activity"` or `"manual"`.
-   * @throws if the node is not started or the target has no dialable address.
+   * @throws if the node is not started, the target has no dialable address, or no
+   *   attempt got an ack — including when the receiver does not count this node as an
+   *   authorized member, since its protocol guard resets the stream without a reply.
    */
   async pushWake(targetPeerId: string, strandId: string, reason?: string): Promise<WakeAck> {
     if (!this.controlNode) {
@@ -7490,7 +8314,8 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Enable the seed listener for receiving seeds via the /sereus/seed/1.0.0 protocol.
    * This is for drone nodes that need to receive seeds without being an owner.
-   * Does not require an owner key.
+   * Does not require an owner key. Idempotent; a node started with `config.claim`
+   * calls it itself inside {@link start}, so an embedder's own call is a no-op.
    */
   async enableSeedListener(): Promise<void> {
     if (!this.controlNode || !this.controlDatabase) {
@@ -7506,9 +8331,8 @@ export class CadreNode implements SAppIdLookup {
     await this.installSeedBootstrapService(new SeedBootstrapService({
       partyId: this.config.controlNetwork.partyId,
       // No owner key - this node only receives seeds
-      inviteAddressResolver: () => this.resolveInviteAddresses(),
       ...this.seedServiceBudgets(),
-      trustPolicy: this.config.seedTrustPolicy,
+      trustPolicy: this.inboundSeedTrustPolicy(),
       // A listener-only node accepts a wire-delivered seed solely against this
       // anchor (there is no per-call override on the inbound handler): with no
       // genesis/invite/operator pin it authorizes nobody, which is the point.
@@ -7577,6 +8401,18 @@ export class CadreNode implements SAppIdLookup {
     };
   }
 
+  /**
+   * The node-wide default trust policy for INBOUND seeds, the one value every
+   * {@link SeedBootstrapService} this node constructs is given — the owner service,
+   * the listener, and `applySeed`'s temp service — so the three cannot drift. The
+   * claim policy when the node was started with `config.claim` (the two are refused
+   * together at start, so there is nothing to merge), otherwise the configured
+   * `seedTrustPolicy`, and `undefined` for the service's anchored default.
+   */
+  private inboundSeedTrustPolicy(): SeedTrustPolicy | undefined {
+    return this.claimTrustPolicy ?? this.config.seedTrustPolicy;
+  }
+
   /**
    * Re-materialize the authorized-peer snapshot that the fail-closed per-stream
    * control-DB gate ({@link authorizeInboundControlStream}) judges against.
@@ -7714,6 +8550,10 @@ export class CadreNode implements SAppIdLookup {
    * Remove a previously-authorized peer from the cadre.
    * Signs the peer ID with the owner key and deletes the CadrePeer row.
    *
+   * Removes the `CadrePeer` row only. The call that removes a machine completely (its owner
+   * key, its push token and the invitations it could come back through, in one transaction)
+   * is {@link removeMachine}.
+   *
    * @param peerId - The peer ID to remove
    */
   async removePeer(peerId: string): Promise<void> {
@@ -7734,6 +8574,212 @@ export class CadreNode implements SAppIdLookup {
     });
   }
 
+  /**
+   * Seat another owner key, signed by this node's owner key (the signed-add branch of
+   * `OwnerKey.Authorized`; the row stores the vouching pair). The write notifies the
+   * membership hub, so the refresh it triggers has run by the time this resolves.
+   *
+   * @param ownerPublicKeyB64 - the new owner's ed25519 public key (base64url).
+   * @returns `true` when the row was seated, `false` when the key is already a live owner.
+   */
+  async addOwner(ownerPublicKeyB64: string): Promise<boolean> {
+    if (!this.seedBootstrapService) {
+      throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+    }
+    const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
+    const added = await this.seedBootstrapService.addOwner(key);
+    // NOTE: an OwnerKey add committed alone is local-only and nothing re-issues it (no
+    // update branch to re-touch, unlike CadrePeer), so it is only logged;
+    // tickets/backlog/debt-owner-key-add-while-alone-has-no-reissue.md owns the fix.
+    if (added && this.committedAlone()) {
+      log('addOwner(%s) committed while ALONE (0 control connections): the new owner row is ' +
+        'local-only and is not re-issued on cohort growth, so other machines may never see it.', key);
+    }
+    return added;
+  }
+
+  /**
+   * Remove an owner key, signed by this node's owner key (which must be a different owner):
+   * the delete and its `Revocation` tombstone commit together. Refused by name when the key
+   * is this node's own or the only live owner. The write notifies the membership hub; the
+   * tombstone rides the committed-delete seam ({@link noteGuardedDelete}), so one committed
+   * while alone is re-issued on cohort growth like every other removal.
+   *
+   * Removes the `OwnerKey` row only. The call that removes a machine completely, its owner key
+   * included, is {@link removeMachine}.
+   *
+   * @param ownerPublicKeyB64 - the owner's ed25519 public key (base64url).
+   * @returns `true` when the row was removed, `false` when the key is not a live owner here.
+   */
+  async removeOwner(ownerPublicKeyB64: string): Promise<boolean> {
+    if (!this.seedBootstrapService) {
+      throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+    }
+    const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
+    return await this.seedBootstrapService.removeOwner(key);
+  }
+
+  /**
+   * The cadre's machines as an app lists them ({@link CadreMachine}): one entry per live
+   * `CadrePeer` row, judged by this node's membership predicate, plus one per live `OwnerKey`
+   * whose key names a machine with no row (`describeMachines` in `machine-removal.ts`).
+   * Unlocked reads with the default retry.
+   */
+  async listMachines(): Promise<CadreMachine[]> {
+    if (!this.controlDatabase) {
+      throw new Error('CadreNode must be started before listing machines');
+    }
+    return (await this.readMachines(this.controlDatabase)).machines;
+  }
+
+  /**
+   * What {@link removeMachine} would do for `peerId`, read without writing, for an app's
+   * confirmation step ({@link MachineRemovalPlan}): whether this node may remove it, whether its
+   * owner key goes with it, which rows that key vouched (so the app can offer to keep them by
+   * re-vouching), which invitations it could come back through, and whether this node's own
+   * rows depend on it (`planMachineRemoval` in `machine-removal.ts`).
+   */
+  async planMachineRemoval(peerId: string): Promise<MachineRemovalPlan> {
+    if (!this.controlDatabase) {
+      throw new Error('CadreNode must be started before planning a machine removal');
+    }
+    return (await this.planMachineRemovalWith(this.controlDatabase, peerId)).plan;
+  }
+
+  /**
+   * Remove a machine from the cadre completely, signed by this node's owner key: its
+   * `CadrePeer` row, its `OwnerKey` row when its key is an owner, its `DeviceToken` row (a
+   * removed phone must not be push-woken) and a withdrawal of every live invitation it could
+   * redeem to come back, in ONE transaction ({@link ControlDatabase.removeMachine}), with a
+   * `Revocation` tombstone per row so the removal holds on every machine
+   * ("Deletes made while alone" in docs/architecture.md).
+   *
+   * Steps: re-plan ({@link planMachineRemoval}) and throw {@link MachineRemovalRefusedError} on a
+   * refusal; check `options.revouch` against the plan's dependents and throw before any write
+   * when it names anything else; **re-vouch first**, under this node's key, the dependents the
+   * caller chose to keep (`ControlDatabase.revouchOwnerKey`, `reauthorizePeer`), so they are
+   * never untrusted in between, and stop before the removal if one fails (re-vouches already
+   * made stay, harmlessly); then the removal transaction. Afterwards this node forgets the
+   * machine as a dial target, and the refresh the write notifies hangs up its control
+   * connection ({@link hangUpRevokedControlPeers}) before this resolves.
+   *
+   * Not undone by this call: the machine keeps every row and strand block it already synced
+   * and the party's strand member keys (`tickets/blocked/decide-removed-machine-strand-access`).
+   * A fresh invitation re-admits it later under fresh stamps.
+   *
+   * @returns what was written ({@link MachineRemovalResult}); all false when no live row names
+   *   the machine here (already removed elsewhere).
+   * @throws {MachineRemovalRefusedError} `'not-an-owner'`, `'self'` or `'last-owner'`.
+   */
+  async removeMachine(peerId: string, options: RemoveMachineOptions = {}): Promise<MachineRemovalResult> {
+    const service = this.seedBootstrapService;
+    if (!service || !this.controlDatabase) {
+      throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+    }
+    const { plan, rows } = await this.planMachineRemovalWith(this.controlDatabase, peerId);
+    if (plan.refusal !== null) {
+      throw new MachineRemovalRefusedError(peerId, plan.refusal);
+    }
+    const revouch = revouchWithinPlan(plan, options.revouch);
+    if (plan.machine === null) {
+      log('removeMachine(%s): no live row names it here; nothing to remove', peerId);
+      return { removedPeer: false, removedOwnerKey: false, removedDeviceToken: false, withdrawnInvitations: [], revouched: { owners: [], peers: [] } };
+    }
+    await this.revouchDependents(service, revouch, rows);
+    const writes = await service.removeMachine({
+      peerId,
+      ownerKey: plan.removesOwnerKey ? plan.machine.publicKey : null,
+      inviteKeys: plan.invitations,
+    });
+    if (writes.removedPeer) {
+      // Track + loudly flag a delete that committed local-only (security-relevant).
+      this.noteControlWrite(peerId, 'remove');
+    }
+    // As removePeer: a removed machine is no longer a dial target, however this node learned
+    // its address. A persist failure only lets the entry reappear after a restart.
+    void this.bootstrapPeerStore?.forget(peerId).catch((error: unknown) => {
+      log('removeMachine: persisting the removal of dial target %s failed (forgotten in memory): %o', peerId, error);
+    });
+    log('removeMachine(%s): peer=%s ownerKey=%s deviceToken=%s invitations=%d revouched owners=%d peers=%d', peerId,
+      writes.removedPeer, writes.removedOwnerKey, writes.removedDeviceToken, writes.withdrawnInvitations.length,
+      revouch.owners.length, revouch.peers.length);
+    return { ...writes, revouched: revouch };
+  }
+
+  /**
+   * The reads behind {@link listMachines}: the live `CadrePeer` and `OwnerKey` rows and the
+   * machines projected from them, with this node's membership predicate as the `trusted` test.
+   */
+  private async readMachines(controlDatabase: ControlDatabase): Promise<{ machines: CadreMachine[]; rows: CadrePeerRow[]; owners: OwnerKeyRow[] }> {
+    const [rows, owners] = await Promise.all([controlDatabase.queryCadrePeers(), controlDatabase.queryOwnerKeyRows()]);
+    const chain = await this.chainFor(rows, this.invitationChainSource(controlDatabase, true));
+    const selfPeerId = this.peerId?.toString() ?? null;
+    const machines = describeMachines({
+      partyId: this.partyId,
+      selfPeerId,
+      rows,
+      owners,
+      trusted: (row) => row.peerId !== selfPeerId && this.hasAnchoredProof(row, chain),
+    });
+    return { machines, rows, owners };
+  }
+
+  /** {@link planMachineRemoval} with the rows it was judged from, which {@link removeMachine} re-vouches dependents by. */
+  private async planMachineRemovalWith(controlDatabase: ControlDatabase, peerId: string): Promise<{ plan: MachineRemovalPlan; rows: CadrePeerRow[] }> {
+    const { machines, rows, owners } = await this.readMachines(controlDatabase);
+    const [invites, usages] = await Promise.all([controlDatabase.listCadreInviteStatuses(), controlDatabase.queryCadreInviteUsages()]);
+    const plan = planMachineRemoval({
+      peerId,
+      machines,
+      rows,
+      owners,
+      selfPeerId: this.peerId?.toString() ?? null,
+      selfOwnerKey: this.ownerSigningKeyEnrolledIn(new Set(owners.map((owner) => owner.key)))?.publicKeyB64 ?? null,
+      invites,
+      usages,
+    });
+    return { plan, rows };
+  }
+
+  /**
+   * The re-vouch step of {@link removeMachine}: every chosen dependent row is rebound to this
+   * node's key BEFORE the removal, so no reader ever judges it against an owner that is gone.
+   * Owners through `ControlDatabase.revouchOwnerKey` (a delete-and-re-add under a fresh stamp,
+   * the only rebinding `OwnerKey.NoUpdate` allows); peers through the owner re-touch
+   * (`reauthorizePeer`), which rewrites `VouchOwner`/`VouchSig` and clears `VouchUsage`.
+   *
+   * The peer re-touch keeps the row's `UpdatedAt` where it is. The owner branch of
+   * `CadrePeer.AuthorizedUpdate` does not require a bump, and bumping a self-published row
+   * would leave its `Sig` unverifiable, so unresolvable and unlisted as self-published, until
+   * the machine's next heartbeat (the NOTE on that constraint); the write-while-alone drain
+   * bumps because it re-issues an otherwise unchanged row, whereas here the voucher itself
+   * changes. A row never self-published carries no stamp to keep and gets the clock.
+   *
+   * A failure rethrows and stops the call before the removal; re-vouches already made stay
+   * (the row is only re-signed by a current owner) and the caller retries. An owner re-vouch
+   * committed alone is not re-issued on growth (the add half has no re-issue path,
+   * `tickets/backlog/debt-owner-key-add-while-alone-has-no-reissue`), so it is logged as
+   * {@link addOwner} logs it; the peer re-touches are re-issued by the existing drain.
+   */
+  private async revouchDependents(
+    service: SeedBootstrapService,
+    revouch: MachineRemovalPlan['dependents'],
+    rows: readonly CadrePeerRow[],
+  ): Promise<void> {
+    for (const key of revouch.owners) {
+      await service.revouchOwner(key);
+      if (this.committedAlone()) {
+        log('removeMachine: re-vouch of owner %s committed while ALONE (0 control connections): the re-added ' +
+          'owner row is local-only and is not re-issued on cohort growth, so other machines may never see it.', key);
+      }
+    }
+    for (const dependent of revouch.peers) {
+      const row = rows.find((candidate) => candidate.peerId === dependent);
+      const updatedAt = row !== undefined && row.updatedAt > 0 ? row.updatedAt : Date.now();
+      await service.reauthorizePeer(dependent, updatedAt);
+    }
+  }
+
   /**
    * Create a seed from the current control network state.
    * The seed contains peer information and is signed by an owner.
@@ -7749,10 +8795,12 @@ export class CadreNode implements SAppIdLookup {
    * Apply a seed to populate the peer cache and enable connections.
    *
    * Validates the seed signature, then evaluates a trust anchor for the signer
-   * key (see `SeedTrustPolicy`). An enrollment caller can pass a per-seed
-   * `trustPolicy` override — e.g. a `pinnedKeyTrustPolicy` built from a
-   * `CadreInvite.ownerKeys` — so a cold-start node can accept its first
-   * seed without reconfiguring the service.
+   * key (see `SeedTrustPolicy`). An operator-driven caller can pass a per-seed
+   * `trustPolicy` override — e.g. a `pinnedKeyTrustPolicy` built from a pinned
+   * owner key — so a cold-start node can accept its first seed without
+   * reconfiguring the service. The override wins on a node started with
+   * `config.claim` as well: the claim secret is the node's default inbound policy,
+   * not a lock on its local operator, who already controls the process.
    */
   async applySeed(
     seed: ControlNetworkSeed,
@@ -7766,13 +8814,13 @@ export class CadreNode implements SAppIdLookup {
       //
       // This temp service is discarded after the call, so it must NOT own the shared
       // node's inbound seed handler: pass { registerHandler: false }. That keeps
-      // repeated service-less applySeed/dialInvite idempotent (no handler leak, no
+      // repeated service-less applySeed idempotent (no handler leak, no
       // DuplicateProtocolHandlerError). The temp service still applies this seed; a
       // node that wants to RECEIVE inbound seeds needs a persistent service
       // (enableSeedListener / initializeSeedBootstrap) to own the handler.
       const tempService = new SeedBootstrapService({
         partyId: seed.partyId,
-        trustPolicy: this.config.seedTrustPolicy,
+        trustPolicy: this.inboundSeedTrustPolicy(),
         ...this.seedServiceBudgets(),
         // The anchor is node-scoped, not service-scoped: a throwaway service
         // must consult (and persist an accepted signer into) the SAME store the
@@ -7815,12 +8863,23 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Deliver a seed directly to a peer via the /sereus/seed/1.0.0 protocol.
+   *
+   * `target` is a multiaddr string, or a peer id with its addresses (the form a phone
+   * uses for a node it scanned), which are dialed one at a time before the request
+   * (`SeedBootstrapService.deliverSeed`). `options.claimProof` rides beside the seed when
+   * the target is a brand-new node being claimed (`claim-proof.ts`).
+   *
+   * @throws {PeerUnreachableError} for a peer id with addresses, when no connection to it formed.
    */
-  async deliverSeed(targetMultiaddr: string, seed: ControlNetworkSeed): Promise<{ accepted: boolean; reason?: string }> {
+  async deliverSeed(
+    target: SeedDeliveryTarget,
+    seed: ControlNetworkSeed,
+    options?: { claimProof?: string },
+  ): Promise<SeedAckMessage> {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
-    return await this.seedBootstrapService.deliverSeed(targetMultiaddr, seed);
+    return await this.seedBootstrapService.deliverSeed(target, seed, options);
   }
 
   /**
@@ -7893,32 +8952,63 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Create an invite for a phone to join the cadre.
-   * Use when a server wants to invite a NAT'd phone.
+   * Claim a node that was started with a claim secret (`CadreNodeConfig.claim`), from
+   * the peer id, addresses and secret its host showed (the QR code): mint a seed, prove
+   * possession of the secret beside it (`claim-proof.ts`), deliver it, and on acceptance
+   * vouch the node into this cadre and keep its addresses as a dial target. The owner
+   * side of the claim-secret entry in the Seed Delivery Protocol (`docs/architecture.md`).
+   *
+   * Requires the seed service with an owner key ({@link initializeSeedBootstrap}), as
+   * {@link addDrone} does. The order is the REVERSE of `addDrone`'s: seed first, row
+   * second. A refused claim or a failed delivery therefore leaves no `CadrePeer` row and
+   * no retained dial target behind on this node — a phone that typed the wrong secret,
+   * or scanned a node someone else already owns, has nothing to clean up.
+   *
+   * A failure is one of three kinds a caller can tell apart:
+   *
+   * - `ClaimRefusedError` — the node was reached and refused, with its refusal code when
+   *   its policy gave one.
+   * - `PeerUnreachableError` — no connection to the node formed from any of its addresses,
+   *   so nothing was sent. Each address is dialed in turn on its own limit, so this can
+   *   take up to the per-peer dial limit plus the seed request's (114.5 s at the default
+   *   declared link) when none answers.
+   * - anything else — the node was reached and the exchange failed, or a local step failed
+   *   (a malformed secret or address among them). Repeating the claim with the same secret
+   *   is safe (see below).
+   *
+   * Idempotent for the same owner: a second call after a dropped response is accepted
+   * by the node (its anchored branch), the row insert is a no-op on an existing row
+   * (`ControlDatabase.insertCadrePeer`), and the dial target is replaced, not duplicated.
+   *
+   * The first dial is kicked (not awaited) so it happens now rather than on the next
+   * timed reconcile pass; a caller that wants to wait for the connection awaits
+   * {@link reconcileControlCohort} itself, with `addDrone`'s caveat that a pass already
+   * in flight is joined rather than restarted. The claimed node dials this one back too,
+   * from the seed's owner list, when this node has a listen or relay address; a phone
+   * with neither is reached by its own reconcile pass alone.
+   *
+   * @throws {ClaimRefusedError} when the node was reached and refused the claim.
+   * @throws {PeerUnreachableError} when the node was never reached.
    */
-  async createInvite(token?: string, expiresIn?: number): Promise<InviteResult> {
+  async claimNode(target: { peerId: string; multiaddrs: string[]; secret: string }): Promise<void> {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
-    const result = await this.seedBootstrapService.createInvite(token, expiresIn);
-    // The invitee dials this node BEFORE it is authorized (dialInvite →
-    // acceptPhone), so hold the inbound connection gate open for strangers for
-    // the invite's validity (or a bounded default when it never expires).
-    this.openEnrollmentWindow(result.invite.expiresAt ?? Date.now() + DEFAULT_ENROLLMENT_WINDOW_MS);
-    return result;
-  }
-
-  /**
-   * Accept a phone connection using an invite.
-   * Call this when a phone dials in with an invite token.
-   */
-  async acceptPhone(options: AddPhoneOptions, issuedInvite?: CadreInvite): Promise<void> {
-    if (!this.seedBootstrapService) {
-      throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+    const secret = parseClaimSecret(target.secret);
+    const seed = await this.seedBootstrapService.createSeed();
+    const proof = claimProof(secret, target.peerId, seed.signerKey, seedDigest(seed));
+    const ack = await this.seedBootstrapService.deliverSeed(
+      { peerId: target.peerId, multiaddrs: target.multiaddrs }, seed, { claimProof: proof });
+    if (!ack.accepted) {
+      throw new ClaimRefusedError(target.peerId, ack.reason ?? 'no reason given', ack.code);
     }
-    // The just-accepted phone opens control-DB streams next; its `CadrePeer` insert
-    // notifies the membership hub, so it is already admitted when this resolves.
-    await this.seedBootstrapService.acceptPhone(options, issuedInvite);
+    log('claimNode: %s accepted the claim; vouching it into the cadre', target.peerId);
+    // The wrapper queues the write for re-replication: a phone claiming its first
+    // always-on node has no control connection yet, so the insert commits local-only.
+    await this.authorizePeer(target.peerId, target.multiaddrs);
+    this.retainDialTarget(target.peerId, target.multiaddrs, 'claimNode');
+    void this.reconcileControlCohort().catch((error) =>
+      log('claimNode: reconcile kick after claiming %s failed: %o', target.peerId, error));
   }
 
   /**
@@ -7936,47 +9026,261 @@ export class CadreNode implements SAppIdLookup {
     return await this.seedBootstrapService.addPhoneWithRelay(phonePeerId);
   }
 
+  // ============================================================================
+  // Cadre Invitation API (redeemable at any member, `/sereus/cadre-invite/1.0.0`)
+  // ============================================================================
+
   /**
-   * Encode an invite for out-of-band delivery (QR, link, etc.).
+   * Where a device could redeem a cadre invitation minted now from, once this machine is gone
+   * ({@link CadreInvitationReach}): the same member selection {@link createCadreInvitation}
+   * makes, judged without minting anything. `rentNode` reads it to choose between inviting a
+   * provider's container and claiming it; `local-network` counts as not reachable there, since
+   * the container is never on a member's LAN. Requires a started node.
    */
-  encodeInvite(invite: CadreInvite): string {
-    const json = JSON.stringify(invite);
-    return uint8ArrayToString(new TextEncoder().encode(json), 'base64url');
+  async invitationReach(): Promise<CadreInvitationReach> {
+    if (!this.controlNode) {
+      throw new Error('CadreNode must be started before judging invitation reach');
+    }
+    return (await this.selectInvitationMembers()).reach;
+  }
+
+  /**
+   * The `members` a cadre invitation minted now would name, and how far they reach: one
+   * selection behind both {@link createCadreInvitation} and {@link invitationReach}, so the
+   * two cannot disagree.
+   */
+  private async selectInvitationMembers(): Promise<{ members: string[]; reach: CadreInvitationReach }> {
+    const { siblings, connected } = await this.resolveInvitationSiblings();
+    const members = selectCadreInvitationMembers(await this.resolveInviteAddresses(), siblings, connected);
+    return { members, reach: cadreInvitationReach(members, this.controlNode!.peerId.toString()) };
+  }
+
+  /**
+   * Mint an owner-signed cadre invitation that a device can redeem at ANY member machine of
+   * this party, the owner offline included ({@link redeemCadreInvitation}). Requires the
+   * owner key ({@link initializeSeedBootstrap}).
+   *
+   * The invitation is an ed25519 keypair: the public half is the `CadreInvite` row's key,
+   * the private half rides in the returned bundle as the proof of possession. Whoever holds
+   * the bundle can redeem it, so an UNTARGETED, OWNER-GRANTING invitation — a bearer
+   * credential for admin rights — defaults to a 15-minute lifetime; every other kind to 24
+   * hours. One use unless `uses` says otherwise. The bundle carries the signed row (so a
+   * member that has not received it by replication seats it from the bundle), this node's
+   * anchored owner keys — every current owner this node has verified, the out-of-band ones
+   * and those derived along verifiable chains ({@link syncOwnerAnchor}) — (the device pins
+   * them and checks the member's reply against them; sourced from the node-local anchor
+   * only, never the raw replicated `OwnerKey` table, because the device anchors whatever
+   * arrives and a stranger's genesis-inserted key must not ride an invitation into a fresh
+   * node's anchor; an empty anchor is refused because a reply could not be checked), and
+   * at most six addresses: this machine's first ({@link resolveInviteAddresses}, which
+   * honours pushed NAT addresses), then two each of up to three other members
+   * (`selectCadreInvitationMembers`), so the encoded text fits a QR code.
+   *
+   * The result's `reach` says where a device could redeem it from once this machine is gone
+   * (`cadreInvitationReach`, judged on the other members' addresses only), so an app can warn
+   * before handing over an invitation only it could answer.
+   *
+   * The row commits locally and replicates like any other control write; minted while
+   * alone (a phone with no connection), it reaches the other members through the
+   * peer-join block catch-up on the next connection. The device can redeem at any member it
+   * reaches meanwhile: a member that does not hold the row yet admits the device's connection
+   * provisionally ({@link admitInboundControlConnection}) and seats the row from the bundle.
+   *
+   * @throws when no owner key is wired, the anchor is empty, `uses` is not a positive
+   *   integer, or neither this machine nor any other member has an address.
+   */
+  async createCadreInvitation(options: CreateCadreInvitationOptions): Promise<CreateCadreInvitationResult> {
+    const service = this.seedBootstrapService;
+    if (!service?.canAuthorize()) {
+      throw new Error('Seed bootstrap service not initialized with an owner key. Call initializeSeedBootstrap() first.');
+    }
+    const ownerKeys = Array.from(this.trustedOwnerStore?.all() ?? []);
+    if (ownerKeys.length === 0) {
+      throw new Error('createCadreInvitation: this node anchors no owner key, and an invitation without owner keys cannot be verified by the device that redeems it');
+    }
+    const uses = options.uses ?? 1;
+    if (!Number.isInteger(uses) || uses < 1) {
+      throw new Error(`createCadreInvitation: uses must be a positive integer (received ${String(options.uses)})`);
+    }
+    const { members, reach } = await this.selectInvitationMembers();
+    if (members.length === 0) {
+      throw new Error('createCadreInvitation: neither this machine nor any other machine of the party has an address a device could dial');
+    }
+    const expiresInMs = options.expiresInMs
+      ?? (options.grantsOwner && !options.peerId ? OWNER_INVITATION_DEFAULT_TTL_MS : CADRE_INVITATION_DEFAULT_TTL_MS);
+    const invitePrivateKey = generatePrivateKey('ed25519', 'base64url') as string;
+    const row = await service.insertCadreInvite({
+      key: ed25519PublicKeyFromPrivate(invitePrivateKey),
+      peerId: options.peerId ?? null,
+      grantsOwner: options.grantsOwner,
+      expiresAtMs: Date.now() + expiresInMs,
+      totalUses: uses,
+    });
+    const invitation: CadreInvitation = {
+      v: 1,
+      partyId: this.config.controlNetwork.partyId,
+      invitePrivateKey,
+      invite: row,
+      ownerKeys,
+      members,
+    };
+    log('Cadre invitation minted: %s (peer=%s owner=%s uses=%d, %d member address(es), reach=%s)',
+      row.key, row.peerId ?? 'any', row.grantsOwner, uses, members.length, reach);
+    return { invitation, encoded: encodeCadreInvitation(invitation), reach };
   }
 
   /**
-   * Decode an invite from base64url encoding.
+   * Every cadre invitation this node holds — minted here or replicated in — with its
+   * standing ({@link CadreInviteStatus}: live, withdrawn, redemptions recorded).
    */
-  decodeInvite(encoded: string): CadreInvite {
-    const bytes = uint8ArrayFromString(encoded, 'base64url');
-    const json = new TextDecoder().decode(bytes);
-    return JSON.parse(json) as CadreInvite;
+  async listCadreInvitations(): Promise<CadreInviteStatus[]> {
+    if (!this.controlDatabase) {
+      throw new Error('CadreNode must be started before listing cadre invitations');
+    }
+    return await this.controlDatabase.listCadreInviteStatuses();
   }
 
   /**
-   * Dial an owner from an invite (for phone joining via invite).
+   * Withdraw a cadre invitation: an owner-signed `Revocation` tombstone over its row, which
+   * stays as the proof of membership for every device it admitted. No further redemption
+   * succeeds anywhere the tombstone reaches, and a member holding it refuses the bundle's
+   * copy of the row. A withdrawal committed while alone is re-issued on cohort growth like
+   * any other tombstone.
+   *
+   * @returns `true` when this call filed the tombstone, `false` when the row is not held
+   *   here or was already withdrawn.
    */
-  async dialInvite(invite: CadreInvite): Promise<void> {
+  async withdrawCadreInvitation(key: string): Promise<boolean> {
     if (!this.seedBootstrapService) {
-      // Create a temporary service that only dials the invite. It is discarded after
-      // the call, so it does NOT own the shared node's inbound seed handler:
-      // initialize with { registerHandler: false }. This temp dialInvite never
-      // applies a seed itself — a node that wants to RECEIVE an inbound seed back
-      // must have a persistent service (enableSeedListener / initializeSeedBootstrap)
-      // own the /sereus/seed/1.0.0 handler. trustPolicy is therefore effectively dead
-      // on this dial-only path; it is kept for symmetry with the applySeed temp site.
-      const tempService = new SeedBootstrapService({
-        partyId: invite.partyId,
-        trustPolicy: this.config.seedTrustPolicy,
-        ...this.seedServiceBudgets(),
-      });
-      if (this.controlNode && this.controlDatabase) {
-        await tempService.initialize(this.controlNode, this.controlDatabase, { registerHandler: false });
-      }
-      await tempService.dialInvite(invite);
-      return;
+      throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+    }
+    return await this.seedBootstrapService.withdrawCadreInvite(key);
+  }
+
+  /**
+   * Join the cadre an invitation names by redeeming it at one of the member machines it
+   * lists, the owner that minted it offline or not. Needs a started node with a stable
+   * identity (`keyStore` or `privateKey`): the redemption is signed with the key behind
+   * this node's peer id, and the member checks that the two match.
+   *
+   * Steps: refuse an invitation for another party; pin its `ownerKeys` into the node-local
+   * anchor (`'invite'` provenance — the pin sticks even if the redemption then fails, as it
+   * does for a seed invite, so a later attempt or seed from the same owner is anchored);
+   * sign the request; dial the listed members in order (`redeemAtMembers`); on
+   * acceptance verify the reply against the pinned keys, merge its dial hints into the peer
+   * store, retain the answering member as a cold-start dial target, refresh the membership
+   * gate and start a cohort reconcile pass. This node then syncs the control database over
+   * the connection it already holds, the same unified behaviour as after a seed.
+   *
+   * A device that is already a member (a restart with the invitation still configured) is
+   * answered as accepted by the member's idempotent redemption, with no second usage row.
+   *
+   * One pass over the listed members by default. With `options.waitForMember` the call keeps
+   * making passes while every answer is retryable — for a device redeeming while no
+   * always-on member is up — until a member accepts, one refuses finally, the invitation
+   * expires (thrown as the `invite-spent` refusal) or `options.signal` aborts
+   * (`redeemInPasses`). The request is signed once, before the first pass, and every pass
+   * sends it: its `usageStampId` keys the usage row, so a member that admitted this node on a
+   * pass whose reply was lost answers the next as already a member. `options.onProgress`
+   * reports each pass and pause.
+   *
+   * When the invitation grants ownership, the member seats this node's key as an `OwnerKey`
+   * row by consent. The caller still has to wire that key for signing afterwards, with
+   * {@link wireOwnKeyIfOwner}; never `ensureOwnerKey`, the row is already there. Other
+   * machines derive this node's key into their anchors from the row's stored proof on their
+   * next membership refresh ({@link syncOwnerAnchor}).
+   *
+   * Limit: the reply check ({@link verifyRedeemReply}) does not authenticate the member. A
+   * forged bundle, or a legitimate one whose addresses were swapped, dials a machine that
+   * can echo the owner-signed row it was just sent; that is what pasting an attacker's
+   * invitation means. What protects this node afterwards is its anchor: every row it then
+   * syncs is judged against the pinned owner keys, so a machine that is not a member of the
+   * cadre the invitation names can admit nobody this node will trust.
+   *
+   * @throws `CadreInviteRejectedError` on a final refusal, `CadreInviteReplyInvalidError` on
+   *   an acceptance that fails the reply check, `CadreInviteUnreachableError` when every
+   *   listed address was tried without an acceptance (one pass only), the signal's reason on
+   *   an abort, and a plain `Error` for the preconditions above.
+   */
+  async redeemCadreInvitation(invitation: CadreInvitation, options: RedeemCadreInvitationOptions = {}): Promise<RedeemCadreInvitationResult> {
+    const controlNode = this.controlNode;
+    if (!controlNode || !this.controlDatabase || !this._running) {
+      throw new Error('CadreNode must be started before redeeming a cadre invitation');
+    }
+    if (invitation.partyId !== this.config.controlNetwork.partyId) {
+      throw new Error(`Cadre invitation is for party ${invitation.partyId}; this node serves ${this.config.controlNetwork.partyId}`);
+    }
+    const signer = this.getSelfSigningKey();
+    if (!signer) {
+      throw new Error('redeemCadreInvitation: this node runs on an ephemeral identity; configure `keyStore` or `privateKey` so its key can sign the redemption');
+    }
+    await this.trustOwnerKeys(invitation.ownerKeys, 'invite');
+    const pinned = new Set(invitation.ownerKeys);
+    const request = signRedeemRequest(
+      invitation,
+      { peerKey: signer.publicKeyB64, peerPrivateKey: signer.privateKeyB64 },
+      generateStampId(controlNode.peerId.toString()),
+      await this.resolveInviteAddresses()
+    );
+    const { reply, memberPeerId, memberAddr } = await redeemInPasses(controlNode, {
+      invitation,
+      request,
+      isTrustedIssuer: (ownerKey) => pinned.has(ownerKey),
+      linkRoundTripMs: this.config.network?.linkRoundTripMs,
+      waitForMember: options.waitForMember ?? false,
+      ...(options.signal ? { signal: options.signal } : {}),
+      ...(options.onProgress ? { onProgress: options.onProgress } : {}),
+    });
+    log('Cadre invitation %s redeemed at %s (owner=%s)', invitation.invite.key, memberAddr, reply.invite.grantsOwner);
+
+    const selfPeerId = controlNode.peerId.toString();
+    await mergeSeedPeers(controlNode, reply.peers.filter((peer) => peer.peerId !== selfPeerId));
+    if (memberPeerId !== null) {
+      // Every address the bundle gave the answering member, so a restart has the same choices.
+      const memberAddrs = this.parseMultiaddrs(invitation.members)
+        .filter((addr) => trailingPeerId(addr) === memberPeerId)
+        .map((addr) => addr.toString());
+      this.retainDialTarget(memberPeerId, memberAddrs, 'redeemCadreInvitation');
     }
-    await this.seedBootstrapService.dialInvite(invite);
+    // The pins above flip nothing yet (this node holds no rows), but the rows about to
+    // replicate in are judged against them; refresh so the snapshot is not stale when they land.
+    await this.refreshMembershipGate('invitation-redeemed');
+    void this.reconcileControlCohort().catch((error) =>
+      log('redeemCadreInvitation: the post-redemption reconcile pass failed: %o', error));
+    return { peerId: memberPeerId, grantsOwner: reply.invite.grantsOwner, redeemedAt: new Date().toISOString() };
+  }
+
+  /**
+   * If this node's identity key is a live `OwnerKey` here, wire it for signing
+   * ({@link initializeSeedBootstrap}) and return true; otherwise change nothing and return
+   * false. For a machine that joined someone else's cadre by invitation: after an
+   * owner-granting redemption, and on every later start. A redemption seats the request's
+   * `peerKey`, the key behind this node's peer id, so the identity key is the one to look for.
+   *
+   * Unlike `ensureOwnerKey` it never inserts an `OwnerKey` row, so a machine that joined a
+   * cadre can never genesis-insert itself into it, and a non-owner never anchors its own key.
+   * An owner whose key is already wired (an earlier call) is answered true with nothing redone.
+   *
+   * NOTE: a node running the listener-only seed service ({@link enableSeedListener}) cannot be
+   * wired this way: libp2p takes one seed handler, and {@link initializeSeedBootstrap} would
+   * register a second. Nothing that joins by invitation enables the listener today; if one
+   * does, replace the listener here rather than beside it.
+   *
+   * @throws when the node is not started.
+   */
+  async wireOwnKeyIfOwner(): Promise<boolean> {
+    if (!this.controlDatabase || !this._running) {
+      throw new Error('CadreNode must be started before wiring its owner key');
+    }
+    const signingKey = this.getSelfSigningKey();
+    if (!signingKey || !(await this.controlDatabase.getOwnerKeys()).has(signingKey.publicKeyB64)) {
+      log('wireOwnKeyIfOwner: this node\'s key is not an owner here; not wiring it');
+      return false;
+    }
+    if (!this.seedBootstrapService?.canAuthorize()) {
+      await this.initializeSeedBootstrap(signingKey.privateKeyB64);
+    }
+    return true;
   }
 
   // ============================================================================
@@ -8122,18 +9426,28 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Addresses of the party's other machines for an invitation's bootstrap list
-   * ({@link selectInvitationSiblingAddrs} picks which). The source is each authorized
-   * member's signed `CadrePeer` record ({@link resolvePeerRecord}), so a machine whose record
-   * is missing, stale or untrusted is left out; live connections only order them.
+   * Addresses of the party's other machines for an open strand invitation's bootstrap list
+   * ({@link createOpenInvitation}); {@link selectInvitationSiblingAddrs} picks which.
+   */
+  private async siblingInvitationAddrs(): Promise<string[]> {
+    const { siblings, connected } = await this.resolveInvitationSiblings();
+    return selectInvitationSiblingAddrs(siblings, connected);
+  }
+
+  /**
+   * The party's other machines an invitation may name — an open strand invitation
+   * ({@link siblingInvitationAddrs}) or a cadre invitation ({@link createCadreInvitation}) —
+   * and which of them this node is connected to. The source is each authorized member's
+   * signed `CadrePeer` record ({@link resolvePeerRecord}), so a machine whose record is
+   * missing, stale or untrusted is left out; live connections only order them.
    *
    * Best-effort: a failed read leaves the invitation naming this machine alone, which is what
    * it named before siblings were added.
    */
-  private async siblingInvitationAddrs(): Promise<string[]> {
+  private async resolveInvitationSiblings(): Promise<{ siblings: InvitationSibling[]; connected: ReadonlySet<string> }> {
     const controlNode = this.controlNode;
     if (!controlNode || !this.controlDatabase) {
-      return [];
+      return { siblings: [], connected: new Set() };
     }
     try {
       const siblings: InvitationSibling[] = [];
@@ -8143,11 +9457,10 @@ export class CadreNode implements SAppIdLookup {
           siblings.push({ peerId, updatedAt: resolved.updatedAt, addrs: resolved.addrs.map(String) });
         }
       }
-      const connected = new Set(controlNode.getConnections().map((c) => c.remotePeer.toString()));
-      return selectInvitationSiblingAddrs(siblings, connected);
+      return { siblings, connected: new Set(controlNode.getConnections().map((c) => c.remotePeer.toString())) };
     } catch (error) {
-      log('createOpenInvitation: resolving the other machines failed; the invitation names only this one: %o', error);
-      return [];
+      log('siblingInvitationAddrs: resolving the other machines failed; the invitation names only this one: %o', error);
+      return { siblings: [], connected: new Set() };
     }
   }
 
@@ -8178,7 +9491,7 @@ export class CadreNode implements SAppIdLookup {
       disclosure,
       this.controlNode
     );
-    await this.recordFormationStrandAddrs(result.strandId, result.strandAddrs);
+    await this.recordFormationStrandAddrs(result.strandId, result.strandAddrs, 'formStrand');
     // A closed host strand's approval carries the joiner's own membership invitation —
     // persist this party's identity key and stage the invitation for bring-up to redeem.
     // Runs AFTER the addr recording so a persistence failure (which throws — see the
@@ -8194,7 +9507,7 @@ export class CadreNode implements SAppIdLookup {
    * Ask to join through `invitation` and have the party keep trying until the join works, the
    * invitation is used up or expires, or the request is dismissed: across restarts, and from
    * any owner machine of the party (`docs/strands.md` → "Joining while the inviter is
-   * offline"). Records a party-wide `PendingJoin` row, runs one attempt on this machine at
+   * offline"). Records a party-wide `JoinRequest` row, runs one attempt on this machine at
    * once, and returns the status after it: `'joined'` when the inviter answered yes, `'waiting'`
    * when it was unreachable or not ready, `'failed'` when it refused for good.
    *
@@ -8269,17 +9582,17 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Write a join request's row, or adopt the party's existing row for the same invitation: a
-   * pending one as it is, a finished one replaced by `requested` (the user asked again).
+   * Write a join request, or adopt the party's existing request for the same invitation: a
+   * pending one as it is, a finished one rewritten as `requested` (the user asked again).
    */
   private async recordJoinRequest(
     database: ControlDatabase,
-    requested: PendingJoinFields,
+    requested: JoinRequestFields,
     { ownerKey, signMessage }: { ownerKey: string; signMessage: (message: Uint8Array) => string }
-  ): Promise<PendingJoinRow> {
-    let written: PendingJoinRow;
+  ): Promise<PendingJoin> {
+    let written: PendingJoin;
     try {
-      written = await database.insertPendingJoin(requested, ownerKey, signMessage);
+      written = await database.insertJoinRequest(requested, ownerKey, signMessage);
     } catch (error) {
       if (!isPendingJoinConflict(error)) {
         throw error;
@@ -8292,12 +9605,12 @@ export class CadreNode implements SAppIdLookup {
           { cause: error }
         );
       }
-      if (existing.Outcome === null) {
+      if (existing.outcome === null) {
         return existing;
       }
-      written = await database.replacePendingJoin(existing.StampId, requested, ownerKey, signMessage);
+      written = await database.rewritePendingJoin(existing.StampId, { ...requested, outcome: null }, ownerKey, signMessage);
     }
-    this.pendingJoinRunner?.noteWritten(written);
+    this.pendingJoinRunner?.noteWritten(written, 'request');
     return written;
   }
 
@@ -8315,15 +9628,19 @@ export class CadreNode implements SAppIdLookup {
       selfId: this.controlNode!.peerId.toString(),
       linkRoundTripMs: this.config.network?.linkRoundTripMs,
       isOwner: async () => (await this.enrolledOwnerSigningKey()) !== null,
-      // NOTE: one owner-key read and one `PendingJoin` read per pass (30 s); for a party that never
-      // asked for a join the second reads a never-written block, which consults the cohort. If it
-      // shows up in a device profile, poll more slowly while the table reads empty.
+      // NOTE: one owner-key read and one pending-join read (three tables) per pass (30 s); for a
+      // party that never asked for a join the second reads never-written blocks, which consults
+      // the cohort. If it shows up in a device profile, poll more slowly while the tables read empty.
       readRows: () => database().queryPendingJoins(),
       readRow: (id) => database().queryPendingJoin(id),
-      attempt: (row) => this.formStrand(this.pendingJoinInvitation(row), parseStoredDisclosure(row)),
-      replace: async (expectedStampId, next) => {
+      attempt: (join) => this.formStrand(this.pendingJoinInvitation(join), parseStoredDisclosure(join)),
+      record: async (expected, outcome) => {
+        const { ownerKey, signMessage } = await outcomeSigner();
+        return database().recordJoinOutcome(expected, outcome, ownerKey, signMessage);
+      },
+      rewrite: async (expectedStampId, next) => {
         const { ownerKey, signMessage } = await outcomeSigner();
-        return database().replacePendingJoin(expectedStampId, next, ownerKey, signMessage);
+        return database().rewritePendingJoin(expectedStampId, next, ownerKey, signMessage);
       },
       remove: async (id) => {
         const { ownerKey, signMessage } = await outcomeSigner();
@@ -8337,33 +9654,33 @@ export class CadreNode implements SAppIdLookup {
     this.pendingJoinRunner.start();
   }
 
-  /** The invitation a `PendingJoin` row stores. A failure names the row, never the invitation, which is a bearer credential. */
-  private pendingJoinInvitation(row: PendingJoinRow): OpenInvitation {
+  /** The invitation a `JoinRequest` row stores. A failure names the row, never the invitation, which is a bearer credential. */
+  private pendingJoinInvitation(join: PendingJoin): OpenInvitation {
     try {
-      return this.decodeInvitation(row.Invitation);
+      return this.decodeInvitation(join.Invitation);
     } catch {
-      throw new Error(`PendingJoin ${row.Id}: the stored invitation does not decode`);
+      throw new Error(`JoinRequest ${join.Id}: the stored invitation does not decode`);
     }
   }
 
-  private pendingJoinSAppId(row: PendingJoinRow): string {
+  private pendingJoinSAppId(join: PendingJoin): string {
     try {
-      return this.decodeInvitation(row.Invitation).sAppId;
+      return this.decodeInvitation(join.Invitation).sAppId;
     } catch {
-      log('PendingJoin %s: the stored invitation does not decode; reporting no sApp', row.Id);
+      log('JoinRequest %s: the stored invitation does not decode; reporting no sApp', join.Id);
       return '';
     }
   }
 
   /**
-   * Stage the membership invitation of each `joined` row this process has not staged yet, so a
+   * Stage the membership invitation of each joined request this process has not staged yet, so a
    * closed strand joined on another owner machine is seated by whichever machine launches it
    * first; the party key it admits is the replicated `StrandPartyKey` row the finishing machine
    * seated. A strand that already has an invitation staged keeps it, for the reconciler to
    * settle first.
    */
-  private stageMembershipInvitesFromPendingJoins(rows: readonly PendingJoinRow[]): void {
-    for (const { rowId, strandId, invite } of membershipInvitesToStage(rows, this.stagedMembershipInviteKeys, Date.now())) {
+  private stageMembershipInvitesFromPendingJoins(joins: readonly PendingJoin[]): void {
+    for (const { rowId, strandId, invite } of membershipInvitesToStage(joins, this.stagedMembershipInviteKeys, Date.now())) {
       this.stagedMembershipInviteKeys.add(invite.inviteKey);
       if (this.pendingMembershipInvites.has(strandId)) {
         continue;
@@ -8643,16 +9960,16 @@ export class CadreNode implements SAppIdLookup {
    * Nothing else would deliver them: the seed is read only at launch and resume, and the
    * refresh pass skips a peer FRET already holds a record for — the stale one, here.
    */
-  private async recordFormationStrandAddrs(strandId: string, strandAddrs: readonly string[]): Promise<void> {
+  private async recordFormationStrandAddrs(strandId: string, strandAddrs: readonly string[], caller: string): Promise<void> {
     const attributed = [...groupAddrsByPeerId([...strandAddrs]).values()]
       .flatMap((peerAddrs) => peerAddrs.map((addr) => addr.toString()));
     if (attributed.length === 0) {
-      log('formStrand: responder disclosed no usable strand addrs for %s (%d carried) — cross-party seed unchanged',
-        strandId, strandAddrs.length);
+      log('%s: no usable strand addrs for %s (%d carried) — cross-party seed unchanged',
+        caller, strandId, strandAddrs.length);
       return;
     }
     this.formationStrandAddrs.set(strandId, attributed);
-    log('formStrand: kept %d of %d cross-party strand addr(s) for %s', attributed.length, strandAddrs.length, strandId);
+    log('%s: kept %d of %d cross-party strand addr(s) for %s', caller, attributed.length, strandAddrs.length, strandId);
     const runningNode = this.strandManager.getInstance(strandId)?.libp2pNode;
     if (runningNode) {
       await this.mergeStrandPeerAddrs(runningNode, attributed, strandId);