@serfab/cadre-core 1.13.0 → 1.15.0

package/dist/control-database.d.ts

@@ -2,8 +2,8 @@ import { Database } from '@quereus/quereus';
 import type { SqlParameters } from '@quereus/quereus';
 import type { Libp2p } from '@libp2p/interface';
 import type { IRepo } from '@optimystic/db-core';
-import type { StrandRow, PendingJoinRow, PeerAddressRecord, CadrePeerRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow } from './types.js';
-import type { ControlTable, RevocableTable, ControlDomain, ControlAction } from './control-authorization.js';
+import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, SeedPeer, MachineRemovalResult } from './types.js';
+import type { ControlTable, RevocableTable, BoundControlDomain, ControlAction, CadreInviteSignedFields } from './control-authorization.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
 export type { ControlTable, RevocableTable, ControlDomain, ControlAction } from './control-authorization.js';
 /**
@@ -50,13 +50,15 @@ export declare class FormationAbortedError extends Error {
     });
 }
 /**
- * The invitation's seat budget is already spent: the count of recorded `FormationUsage` rows
- * for the token has reached `FormationInvite.TotalUses`, so this redemption cannot be given a
- * seat.
+ * The invitation's seat budget is already spent: the count of recorded usage rows for the
+ * invitation has reached its `TotalUses`, so this redemption cannot be given a seat. `token`
+ * is the `FormationInvite.Token` or the `CadreInvite.Key`, whichever table the caller
+ * redeemed against.
  *
  * Raised off the committed-count check ({@link ControlDatabase.assertSeatRemains}) ahead of
  * the write, inside {@link ControlDatabase.redeemInvitation} /
- * {@link ControlDatabase.recordFormationUsage}, and off the unlocked pre-check
+ * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
+ * ({@link ControlDatabase.redeemCadreInvite}), and off the unlocked pre-check
  * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
  * pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
@@ -73,6 +75,20 @@ export declare class InvitationExhaustedError extends Error {
     readonly totalUses: number;
     constructor(token: string, usesRecorded: number, totalUses: number);
 }
+/**
+ * {@link ControlDatabase.seatCadreInvite} was refused by `CadreInvite.AuthorizedInsert`: the
+ * row's `IssuerKey` is not an owner on THIS node, or its `IssuerSig` does not verify. The
+ * common cause is the first — the issuing owner's `OwnerKey` row has not replicated here yet,
+ * or that owner has since been removed — which is why the redemption protocol maps this to a
+ * retryable code; a tampered row fails the same way and simply never succeeds.
+ */
+export declare class CadreInviteIssuerUnknownError extends Error {
+    readonly inviteKey: string;
+    readonly issuerKey: string;
+    constructor(inviteKey: string, issuerKey: string, options?: {
+        cause?: unknown;
+    });
+}
 /**
  * What a recorded `FormationUsage` row came out as.
  *
@@ -84,20 +100,26 @@ export interface FormationUsageResult {
     /** The single-use nonce written to `UsageStampId` (the row's primary key) — the caller's, or a freshly minted one. */
     usageStampId: string;
 }
+/**
+ * Parse a nullable stored `datetime` column into epoch ms, mapping both "absent"
+ * and "unparseable" to null — i.e. "no expiry". Shared by every `ExpiresAt`
+ * reader so the NaN guard cannot drift between them.
+ */
+export declare function parseNullableStoredDatetimeMs(value: string | number | null | undefined): number | null;
 /**
  * Build the canonical authorization message that owner signatures are bound to.
  *
  * The message is a SINGLE framed SHA-256 digest over the ordered field vector from
  * {@link controlAuthorizationFields} (the crypto plugin's injective multi-field
  * encoding): two fixed literals — the domain tag naming the table rule and the action
- * tag — followed by the row fields in the schema's fixed order, with the single-use
- * StampId as the final field where the table has one:
+ * tag — then the party id, then the row fields in the schema's fixed order, with the
+ * single-use StampId as the final field where the table has one:
  *
- *   message = sha256(encodeFields([domain, action, field_1, ..., StampId]))   // raw digest bytes
+ *   message = sha256(encodeFields([domain, action, partyId, field_1, ..., StampId]))   // raw digest bytes
  *
  * ed25519 signs these raw digest bytes DIRECTLY (no second hash). The SQL constraints
  * verify the identical bytes with one variadic call
- * (`verify(digest('CadreControl.X', 'add', field_1, ...), context.Signature, A.Key, 'ed25519')`):
+ * (`verify(digest('CadreControl.X', 'add', party_id(), field_1, ...), context.Signature, A.Key, 'ed25519')`):
  * SQL `digest(...)` returns the base64url string of the same digest, which `verify`'s default
  * base64url input encoding decodes back to those raw bytes — so signer and verifier
  * operate on the same bytes. Every field is TEXT on both sides (the SQL columns are
@@ -105,11 +127,33 @@ export interface FormationUsageResult {
  * type tags agree. Binding the row contents closes captured-stamp replay; the leading
  * domain/action tags scope the signature to ONE table rule, so an approval minted for
  * one constraint can never satisfy another (e.g. a ValidationKey enrollment can no
- * longer double as an OwnerKey enrollment). Single source of truth: every signed writer
- * (and every test/harness signer) MUST build the message through this function with the
- * schema's tags and field order, or `verify` will reject the row.
+ * longer double as an OwnerKey enrollment); the party id scopes it to ONE party, so two
+ * parties sharing an owner key never accept each other's approvals. `partyId` is the
+ * party the signer is configured for, and the SQL side reads its own through the
+ * node-local `party_id()` ({@link registerPartyIdFunction}). Single source of truth:
+ * every signed writer (and every test/harness signer) MUST build the message through
+ * this function with the schema's tags and field order, or `verify` will reject the row.
+ */
+export declare function buildAuthorizationMessage(domain: BoundControlDomain, action: ControlAction, partyId: string, rowFields: string[]): Uint8Array;
+/**
+ * Register the zero-argument scalar `party_id()` on `db`: the party id this machine is
+ * configured for, which every party-bound `digest(...)` in the control schema puts third.
+ * Node-local by design — a `context` value would be the writer's choice (a cohort member
+ * that re-ran the statement would replay it as a literal), and a stored `Party` table would
+ * be replicated data the schema already treats as untrusted. A cohort member that re-runs a
+ * statement therefore evaluates its OWN party id, and the schema text stays identical for
+ * every party. Each `Database` carries its own registration, so a process serving two
+ * parties holds two.
+ *
+ * NOTE: flagged deterministic, so the planner may fold the call into a plan; plans are
+ * per `Database` today. If Quereus ever shares plans across `Database` instances, drop
+ * the DETERMINISTIC flag or one party's id would be folded into another's checks.
+ *
+ * `ControlDatabase.initialize` calls this before hydrating persisted schemas, because a
+ * warm restart parses the persisted CHECK text, which calls it. Exported for specs that
+ * build their own `Database` around a copy of a bound constraint.
  */
-export declare function buildAuthorizationMessage(domain: ControlDomain, action: ControlAction, rowFields: string[]): Uint8Array;
+export declare function registerPartyIdFunction(db: Database, partyId: string): void;
 /**
  * The exact bytes an outside approver signs to authorize ONE redemption of a
  * `ValidationUrl`-bearing `FormationInvite` — the TS mirror of the `'vouch'` digest in
@@ -125,6 +169,10 @@ export declare function buildAuthorizationMessage(domain: ControlDomain, action:
  * that same nonce, then pass BOTH the nonce and the signature to
  * {@link ControlDatabase.redeemInvitation} / {@link ControlDatabase.recordFormationUsage}:
  * signing one nonce and inserting another fails the CHECK.
+ *
+ * No party id, unlike every owner digest: the approver is sent only these five fields
+ * (`formation-approval.ts`), and the `token` it binds is a random secret seated in one
+ * party's `FormationInvite` table (the schema's `FormationUsage.Authorized` comment).
  */
 export declare function formationVouchMessage(fields: {
     token: string;
@@ -149,7 +197,9 @@ export declare function formationVouchMessage(fields: {
  * the strand when it signs (a bound invite's host strand arrives only in the result
  * frame; an unbound strand is minted by the responder). The responder cannot
  * substitute one anyway — a bound invite is pinned to its own strand by `Authorized`,
- * and an unbound redemption mints a fresh strand, so there is no victim to name.
+ * and an unbound redemption mints a fresh strand, so there is no victim to name. The
+ * party id is absent for the same reason (it too arrives only in the result frame) and
+ * the `token` scopes the digest to one party instead, as for {@link formationVouchMessage}.
  */
 export declare function formationConsentMessage(fields: {
     token: string;
@@ -157,6 +207,37 @@ export declare function formationConsentMessage(fields: {
     peerKey: string;
     disclosure: string;
 }): Uint8Array;
+/**
+ * The exact bytes an owner signs to seat a `CadreInvite` row — the TS mirror of the `'add'`
+ * digest in `CadreInvite.AuthorizedInsert`, over the whole row in the schema's order with
+ * nullable columns as `''` (`cadreInviteRowFields`, shared with the base64url verifier
+ * `peer-authorization.ts`'s `cadreInviteAddDigest`). `expiresAt` must already be the stored
+ * canonical `datetime` string ({@link canonicalDatetime}), as {@link ControlDatabase.insertCadreInvite}
+ * produces it, or the signed segment will not match what the CHECK sees after coercion.
+ */
+export declare function cadreInviteAddMessage(partyId: string, row: CadreInviteSignedFields): Uint8Array;
+/** The fields both redemption signatures cover; see {@link cadreInviteRedeemMessage}. */
+export interface CadreInviteRedemptionFields {
+    inviteKey: string;
+    /** The single-use nonce the redeeming device minted for this redemption (`generateStampId`). */
+    usageStampId: string;
+    /** The redeeming device's own ed25519 public key (base64url). */
+    peerKey: string;
+}
+/**
+ * The exact bytes the HOLDER of a cadre invitation signs, with the invitation's private key,
+ * to redeem it once — the TS mirror of the `'redeem'` digest `CadreInviteUsage.InvitePossessed`
+ * verifies against the invitation's public key. Binding the device and the nonce means a
+ * captured redemption can admit no other device and spend no other use.
+ */
+export declare function cadreInviteRedeemMessage(partyId: string, fields: CadreInviteRedemptionFields): Uint8Array;
+/**
+ * The exact bytes the DEVICE signs, with its own key, to consent to being admitted by one
+ * redemption — the TS mirror of the `'consent'` digest `CadreInviteUsage.PeerConsented`
+ * verifies against `PeerKey`. Same fields as {@link cadreInviteRedeemMessage} under a
+ * distinct action tag, so neither signature can stand in for the other.
+ */
+export declare function cadreInviteConsentMessage(partyId: string, fields: CadreInviteRedemptionFields): Uint8Array;
 /** The control tables keyed by a strand id whose repeat insert a caller may treat as idempotent. */
 type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
 /**
@@ -176,8 +257,8 @@ type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
  */
 export declare function isStrandIdConflict(error: unknown, table: StrandIdTable): boolean;
 /**
- * Did {@link ControlDatabase.insertPendingJoin} fail because the party already holds a
- * `PendingJoin` row for this invitation? The caller adopts the existing row instead.
+ * Did {@link ControlDatabase.insertJoinRequest} fail because the party already holds a
+ * `JoinRequest` row for this invitation? The caller adopts the existing request instead.
  * Text-matched, failing closed, like {@link isStrandIdConflict}.
  *
  * NOTE: the existing row may be one {@link ControlDatabase.queryPendingJoin} hides (its stamp
@@ -186,22 +267,24 @@ export declare function isStrandIdConflict(error: unknown, table: StrandIdTable)
  */
 export declare function isPendingJoinConflict(error: unknown): boolean;
 /**
- * The `PendingJoin.Id` of an invitation: the base64url sha256 `digest` of its token. One row
+ * The `JoinRequest.Id` of an invitation: the base64url sha256 `digest` of its token. One row
  * per invitation, and the `Revocation` tombstone that names a removed row carries this, never
  * the bearer token itself.
  */
 export declare function pendingJoinId(token: string): string;
+/** A `JoinRequest` row as written: every column but the stamp, which each write mints. */
+export type JoinRequestFields = Omit<JoinRequestRow, 'StampId'>;
+/** A pending join as re-written: its request fields and its outcome, under a stamp the write mints. */
+export type PendingJoinFields = Omit<PendingJoin, 'StampId'>;
 /**
- * {@link ControlDatabase.replacePendingJoin} found that the live `PendingJoin` row is not the
- * incarnation the caller read: another write replaced or removed it first (a sibling machine
- * recorded an outcome, or the user dismissed the join). Nothing was written; the caller
- * re-reads and decides again. `liveStampId` is null when the row is gone.
+ * A pending-join write found that the live join is not the one the caller read: another write
+ * recorded an outcome, asked again or dismissed it first. Nothing was written; the caller
+ * decides again from `live`, which is null when the request is gone.
  */
 export declare class PendingJoinChangedError extends Error {
     readonly id: string;
-    readonly expectedStampId: string;
-    readonly liveStampId: string | null;
-    constructor(id: string, expectedStampId: string, liveStampId: string | null);
+    readonly live: PendingJoin | null;
+    constructor(id: string, live: PendingJoin | null);
 }
 /**
  * The one `CadreControl.Revocation` row that retires nothing, filed once by an owner
@@ -214,6 +297,24 @@ export declare const REVOCATION_LEDGER_MARKER: {
     readonly rowKey: "ledger";
     readonly stampId: "opened";
 };
+/**
+ * Project `CadrePeer` rows into the {@link SeedPeer} list a seed, or a cadre invitation
+ * redemption reply, carries.
+ *
+ * Owner identity is sourced from the `OwnerKey` table, not from the transport peer id. An
+ * Ed25519 libp2p peer id embeds its public key (identity multihash), so each peer's ed25519
+ * key is derivable from its `PeerId`; a peer is an owner iff that derived key is in
+ * `ownerKeys`. This makes any owner node markable — not just the local one. A non-Ed25519
+ * or unparsable id yields a non-owner rather than failing the whole projection.
+ *
+ * NOTE: this is the one owner lookup deliberately left on the REPLICATED table rather than
+ * the node-local anchor. `SeedPeer.isOwner` is a dial hint — the receiver dials owner-flagged
+ * peers first — not a trust decision, and the receiver re-derives real trust from its own
+ * anchor. So a polluted table costs at most a wasted dial, while anchoring here would
+ * silently drop legitimate co-owners this node never pinned. If `isOwner` ever gates
+ * anything the receiver TRUSTS, move it to the anchor.
+ */
+export declare function projectSeedPeers(rows: readonly CadrePeerRow[], ownerKeys: ReadonlySet<string>): SeedPeer[];
 /**
  * Guarded tables a node may reap locally once their tombstone has committed — the
  * tables whose `AuthorizedDelete` carries the REAP branch (see the constraint comment on
@@ -222,15 +323,29 @@ export declare const REVOCATION_LEDGER_MARKER: {
  * secrets stored nowhere else (tickets/backlog/debt-strand-tombstone-reap.md owns any
  * future change). `JoinedStrand` also carries a `MemberPrivateKey` but IS reapable: that
  * secret is the joined strand's shared read key, which its founding party and every member
- * hold, so a reaped row is recoverable by re-forming. `PendingJoin` is reapable for the same
+ * hold, so a reaped row is recoverable by re-forming. `JoinRequest` is reapable for the same
  * reason: the inviting party and the user also hold its invitation. `OwnerKey` has no
  * production removal path and `MinOneOwner` makes an automated owner-key reap a
- * party-bricking hazard.
+ * party-bricking hazard. `CadreInvite` is never deleted at all (its tombstone is a
+ * withdrawal over a row that stays), so there is nothing to reap.
  */
-export declare const REAPABLE_TABLES: readonly ["CadrePeer", "DeviceToken", "ValidationKey", "JoinedStrand", "PendingJoin"];
+export declare const REAPABLE_TABLES: readonly ["CadrePeer", "DeviceToken", "ValidationKey", "JoinedStrand", "JoinRequest"];
 export type ReapableTable = (typeof REAPABLE_TABLES)[number];
+/** A `FormationInvite` row as {@link ControlDatabase.queryFormationInvite} reads it. */
+export interface FormationInviteRow {
+    token: string;
+    sAppId: string;
+    /** Parsed epoch ms of the stored `datetime`; null when the invitation never expires. */
+    expiresAtMs: number | null;
+    /** Null is unlimited. */
+    totalUses: number | null;
+    validationUrl: string | null;
+    /** A bound invitation's host strand; null on the responder-provisions path. */
+    strandId: string | null;
+}
 /**
- * Notified after a `CadreControl.CadrePeer` row write has COMMITTED.
+ * Notified after a membership write (a `CadreControl.CadrePeer` or `OwnerKey` row, see
+ * {@link ControlDatabase.mutateCadrePeer}) has COMMITTED.
  *
  * The one hook the party-membership snapshot a node admits control-DB traffic
  * against ({@link CadreNode.refreshMembershipGate}) hangs off, so that snapshot
@@ -240,19 +355,22 @@ export type ReapableTable = (typeof REAPABLE_TABLES)[number];
  */
 export type MembershipChangeListener = (reason: string) => Promise<void>;
 /**
- * Identity of the tombstone a committed guarded delete wrote — a
- * {@link RevocationRow} minus its `ReissuedAt` counter, which a fresh tombstone
- * always seats at 0 (`FreshTombstone`) and so carries no information.
+ * Identity of the tombstone a committed guarded delete wrote — the triple a
+ * {@link RevocationRow} is keyed and signed over. The counter is left out because a
+ * fresh tombstone always seats it at 0 (`FreshTombstone`), and the signer pair because
+ * the writer that files the row supplies it.
  */
-export type RevokedRowRef = Omit<RevocationRow, 'reissuedAt'>;
+export type RevokedRowRef = Pick<RevocationRow, 'tableName' | 'rowKey' | 'stampId'>;
+/** What {@link ControlDatabase.removeMachine} wrote: `CadreNode.removeMachine`'s result, less the re-vouches it made first. */
+export type MachineRemovalWrites = Pick<MachineRemovalResult, 'removedPeer' | 'removedOwnerKey' | 'removedDeviceToken' | 'withdrawnInvitations'>;
 /**
  * Notified after a guarded-table delete — and the `CadreControl.Revocation`
  * tombstone it writes in the same transaction — has COMMITTED.
  *
  * The seam the write-while-alone re-replication queue hangs off
- * ({@link CadreNode.noteGuardedDelete}): one listener covers all four guarded
- * tables (`CadrePeer` / `DeviceToken` / `Strand` / `ValidationKey`) because every
- * owner delete funnels through {@link deleteGuardedRow}. Synchronous — the
+ * ({@link CadreNode.noteGuardedDelete}): one listener covers every guarded table
+ * because every owner delete funnels through {@link deleteGuardedRow} (or the
+ * two-table `deleteStrandAndPartyKey`). Synchronous — the
  * handler only records the tombstone's identity; it must not throw (the notifier
  * swallows and logs anyway — a committed delete never fails because bookkeeping did).
  */
@@ -271,7 +389,12 @@ export type GuardedDeleteListener = (revocation: RevokedRowRef) => void;
  */
 export type ControlWriteAbandonedListener = (abandonment: ControlRetryAbandonment) => void;
 export interface ControlDatabaseConfig {
-    /** Party ID for the control network */
+    /**
+     * Party ID for the control network. Also the party every owner and peer signature over a
+     * control row binds ({@link buildAuthorizationMessage}), read on the SQL side through
+     * `party_id()` ({@link registerPartyIdFunction}). Must be non-empty: parties with an empty
+     * id would share approvals.
+     */
     partyId: string;
     /**
      * Optional path to the control schema file.
@@ -476,17 +599,19 @@ export declare class ControlDatabase {
     /** Single-row sibling of {@link queryJoinedStrands}: the joined strand with this id, or null. */
     queryJoinedStrand(strandId: string): Promise<StrandRow | null>;
     /**
-     * Every join this party asked for and has not dismissed (`CadreControl.PendingJoin`),
-     * pending or finished.
+     * Every join this party asked for and has not dismissed, pending or finished: each
+     * `CadreControl.JoinRequest` row with its `JoinSuccess` / `JoinFailure` row.
      *
-     * Rows whose `StampId` is retired in `Revocation` are dropped, as {@link queryCadrePeers}
-     * drops them: such a row is either a replaced or dismissed incarnation this node still
-     * holds until the reap sweep removes it, or one re-seated by a replayed approval on a node
-     * that had not yet seen the tombstone. Either way it must not bring a dismissed join back.
+     * A request whose `StampId` is retired in `Revocation` is dropped, as {@link queryCadrePeers}
+     * drops such rows: it is a re-asked or dismissed incarnation this node still holds until the
+     * reap sweep removes it, or one re-seated by a replayed approval on a node that had not yet
+     * seen the tombstone. Either way it must not bring a dismissed join back.
      */
-    queryPendingJoins(): Promise<PendingJoinRow[]>;
-    /** Single-row sibling of {@link queryPendingJoins}, with the same retired-stamp filter: the row with this id, or null. */
-    queryPendingJoin(id: string): Promise<PendingJoinRow | null>;
+    queryPendingJoins(): Promise<PendingJoin[]>;
+    /** Single-row sibling of {@link queryPendingJoins}, with the same retired-stamp filter: the join with this id, or null. */
+    queryPendingJoin(id: string): Promise<PendingJoin | null>;
+    /** The raw read behind {@link queryPendingJoin}, with no retired-stamp filter. `retry: false` inside a locked write body. */
+    private readPendingJoin;
     /**
      * Count rows in a CadreControl table as seen by THIS database instance.
      *
@@ -506,6 +631,9 @@ export declare class ControlDatabase {
     /**
      * Check whether any owner key exists in the control database.
      * Used to decide whether a fresh-party genesis insert is required.
+     *
+     * Deliberately RAW (no retired-stamp filter, unlike {@link getOwnerKeys}): the genesis
+     * insert is refused by the schema whenever any physical row exists, so this must see one.
      */
     hasOwnerKey(): Promise<boolean>;
     /**
@@ -521,8 +649,41 @@ export declare class ControlDatabase {
      * trusted only if it is already enrolled here (see `SeedTrustPolicy`). It is
      * also the owner-identity source for `queryPeers`, decoupling owner
      * status from the libp2p transport peer ID.
-     */
-    getOwnerKeys(): Promise<Set<string>>;
+     *
+     * Rows whose `StampId` is retired in `CadreControl.Revocation` are excluded, as
+     * {@link queryCadrePeers} excludes them: `OwnerKey` is never reaped (`MinOneOwner` makes
+     * an automated reap able to empty the table), so a node that received the tombstone
+     * without the delete (a removal committed while the remover was alone, re-issued on growth)
+     * keeps the removed owner's physical row next to it. Without the filter a removed owner
+     * would still count as an owner in every membership snapshot and seed-trust read, still
+     * read as the issuer of a live invitation and still be preferred as a dial target. The
+     * write side filters for itself: every owner lookup in the schema disqualifies a row whose
+     * stamp is retired (`schemas/control.qsql` header), so a removed owner cannot sign here
+     * once its tombstone has arrived, row or no row.
+     *
+     * `retry: false` from a caller that reads under the write lock, for the reason on
+     * {@link queryCadrePeers}.
+     */
+    getOwnerKeys(retry?: boolean): Promise<Set<string>>;
+    /**
+     * Every live `OwnerKey` row with its persisted proof ({@link OwnerKeyRow}) — what the
+     * trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`). Rows whose
+     * `StampId` is retired in `CadreControl.Revocation` are excluded here, as
+     * {@link queryCadrePeers} excludes them and for the reason on {@link getOwnerKeys}, which
+     * reads through this. A row with no stamp (the schema permits it; no writer produces one)
+     * is dropped too: no proof can bind to it, so no reader could ever derive it.
+     *
+     * `retry: false` from the membership-gate refresh, which runs as the control database's
+     * membership listener with that database's write lock held — the reason on
+     * {@link queryCadrePeers}; both reads here take the flag.
+     *
+     * @param retired - the retired `OwnerKey` stamps, when the caller has already read the
+     *   tombstones (`CadreNode.syncOwnerAnchor` reads {@link queryRevocations} for their
+     *   signers); omitted, they are read here. Before the ledger marker is filed every
+     *   `Revocation` read is a cohort consult, so the sync passing its own set keeps the
+     *   membership refresh at one such read for the anchor.
+     */
+    queryOwnerKeyRows(retry?: boolean, retired?: ReadonlySet<string>): Promise<OwnerKeyRow[]>;
     /**
      * Enumerate the CadrePeer rows (cadre membership) for admin/membership reads.
      * Includes the persisted voucher columns, which
@@ -560,6 +721,17 @@ export declare class ControlDatabase {
      * lock is the same defect.
      */
     queryCadrePeers(retry?: boolean): Promise<CadrePeerRow[]>;
+    /**
+     * The cadre's peers as a seed or a redemption reply carries them: every live `CadrePeer`
+     * row with its addresses, each flagged `isOwner` when the key behind its peer id is in
+     * the replicated `OwnerKey` table ({@link projectSeedPeers}).
+     *
+     * Read through {@link queryCadrePeers}, never a raw `CadrePeer` select, so a removed
+     * member's addresses are never packed into a seed or handed to a redeeming device as a
+     * dial hint: a revoked peer is off the addressable surface everywhere, and this is one of
+     * its exits.
+     */
+    querySeedPeers(): Promise<SeedPeer[]>;
     /**
      * Every approver public key currently enrolled in `CadreControl.ValidationKey` — the
      * set a `ValidationUrl` redemption's approval signature must be signed by (see
@@ -689,19 +861,22 @@ export declare class ControlDatabase {
      */
     private readRevokedStampRows;
     /**
-     * Every locally-held `CadreControl.Revocation` tombstone — identity triple plus its
-     * `ReissuedAt` counter. Consumed by the cohort-growth re-issue sweep, which
-     * enumerates what this node holds before {@link reissueRevocations} re-broadcasts
-     * it, and by the reap sweep ({@link reapRevokedRows}). Plain scan with no `where`, so
-     * the composite-primary-key point-lookup hazard (see the statement comment in
+     * Every locally-held `CadreControl.Revocation` tombstone — identity triple, its
+     * `ReissuedAt` counter and the stored signer pair. Consumed by the cohort-growth re-issue
+     * sweep, which enumerates what this node holds before {@link reissueRevocations}
+     * re-broadcasts it, and by the reap sweep ({@link reapRevokedRows}). Plain scan with no
+     * `where`, so the composite-primary-key point-lookup hazard (see the statement comment in
      * {@link reissueRevocations}) does not arise. Unlocked, like every other read.
      *
      * Skips the ledger marker ({@link REVOCATION_LEDGER_MARKER}): it retires nothing, so
      * neither sweep may reap or re-sign it, and skipping it keeps `RevocationRow.tableName`
      * a {@link RevocableTable}. Filtered on `TableName` alone, in TypeScript: `RowIsGone`
      * admits no other row under `'Revocation'`.
+     *
+     * `retry: false` from a caller that reads under the write lock, for the reason on
+     * {@link queryCadrePeers}.
      */
-    queryRevocations(): Promise<RevocationRow[]>;
+    queryRevocations(retry?: boolean): Promise<RevocationRow[]>;
     /**
      * Read a single peer's address record (the full `CadrePeer` row) by PeerId.
      *
@@ -775,6 +950,99 @@ export declare class ControlDatabase {
      * Insert the initial owner key (bootstrap - no existing owners required)
      */
     insertOwnerKey(key: string): Promise<void>;
+    /**
+     * Owner-signed INSERT of a further `OwnerKey` row, notifying the membership listener once
+     * it has committed. The signed-add branch of `OwnerKey.Authorized`: the signer must be an
+     * owner in the pre-transaction snapshot, its signature covers the `'add'` digest over
+     * (Key, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a reader
+     * can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
+     *
+     * Through {@link mutateCadrePeer}, the membership hub. The liveness read, the stamp and the
+     * signature all sit inside the locked body: a {@link lockedWithRetry} re-run starts over a
+     * rolled-back attempt with a fresh stamp, as {@link redeemCadreInvite} does.
+     *
+     * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
+     * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
+     * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
+     * would collide on the primary key. Re-add from the machine that removed the key, or any
+     * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
+     * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
+     *
+     * @returns `true` when this call seated the row, `false` when `key` is already a live owner
+     *   here (nothing written).
+     * @throws when this node holds `key`'s row under a retired stamp (above), or when the
+     *   schema refuses the signer.
+     */
+    insertOwnerKeyVouched(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    /**
+     * Owner-signed removal of one `OwnerKey` row plus the `Revocation` tombstone retiring its
+     * stamp, notifying the membership listener once it has committed. The remove branch of
+     * `OwnerKey.Authorized` requires a signer other than the removed key, and `MinOneOwner`
+     * keeps the table from emptying; both are refused by name here first, read from this
+     * node's live owners ({@link getOwnerKeys}), so a caller gets a clear error rather than a
+     * constraint failure. The schema stays the authority: a concurrent removal elsewhere can
+     * make the local count wrong in either direction, and then `MinOneOwner` or the tombstone's
+     * primary key decides (see the NOTE on {@link deleteGuardedRow}).
+     *
+     * Through {@link mutateCadrePeer}, the membership hub, which notifies whenever the body
+     * resolves, the absent-key answer included.
+     *
+     * @returns `true` when the row was removed, `false` when `key` is not a live owner here
+     *   (nothing written, no tombstone).
+     * @throws when `key` is `ownerKey`, or is the only live owner.
+     */
+    deleteOwnerKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    /**
+     * Re-vouch a live `OwnerKey` row under this owner's signature: in ONE transaction, the
+     * current row's guarded delete plus tombstone ({@link deleteOwnerKey}'s body) and an insert
+     * of the same key under a fresh stamp, signed by `ownerKey` ({@link insertOwnerKeyVouched}'s
+     * body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
+     * this is the only way to rebind a row's voucher; the anchor derivation lets the re-add
+     * under a fresh stamp beat the older tombstone (`deriveOwnerAnchor`). For
+     * {@link removeMachine}: the owners a machine being removed had added keep their anchor
+     * place everywhere once their row stands on a remaining owner's signature.
+     *
+     * Through {@link mutateCadrePeer}, the membership hub. The stamp read runs inside the locked
+     * body; a row whose stamp is already retired (held without its delete) is reported as absent
+     * rather than tombstoned twice.
+     *
+     * @returns `true` when the row was re-vouched, `false` when `key` is not a live owner here.
+     * @throws when `key` is `ownerKey` (an owner cannot sign its own row's removal).
+     */
+    revouchOwnerKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    /**
+     * Remove one machine completely, in ONE transaction: its `CadrePeer` row, its `OwnerKey`
+     * row when `target.ownerKey` names one, its `DeviceToken` row when it has one, each with
+     * the `Revocation` tombstone retiring its stamp ({@link deleteGuardedRow}'s statement pair,
+     * composed bare as {@link deleteStrandAndPartyKey} composes it), plus a withdrawal tombstone
+     * for every `CadreInvite` in `target.inviteKeys` that is still live here
+     * ({@link withdrawCadreInvite}'s body). One transaction so no reader sees the machine half
+     * removed: a row gone but its push token resolvable, or its owner key gone but an invitation
+     * it could redeem again still open.
+     *
+     * Through {@link mutateCadrePeer}, the membership hub. Every stamp is read inside the locked
+     * body, and a row whose stamp is already retired (held without its delete) is skipped rather
+     * than tombstoned twice. The by-name owner refusals of {@link deleteOwnerKey} apply to the
+     * owner-key arm. Nothing to remove writes nothing and returns all false.
+     *
+     * The caller decides WHAT to remove, which owner key is the machine's and which invitations
+     * it could use, from its plan (`CadreNode.planMachineRemoval`); this method only refuses to
+     * write an inconsistent set.
+     *
+     * @throws when `target.ownerKey` is `ownerKey`, or is the only live owner here.
+     */
+    removeMachine(target: {
+        peerId: string;
+        ownerKey: string | null;
+        inviteKeys: readonly string[];
+    }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<MachineRemovalWrites>;
+    /**
+     * The guarded removals {@link removeMachine} runs, signed over each row's current stamp:
+     * the `CadrePeer` row, the `OwnerKey` row when named, the `DeviceToken` row when present.
+     * Inside the locked body (every read `retry: false`); one `Revocation` scan serves the
+     * retired-stamp check for all three tables and the last-owner refusal.
+     */
+    private signMachineRemovals;
     /**
      * Insert a strand into the control database using an owner signature.
      *
@@ -887,45 +1155,62 @@ export declare class ControlDatabase {
      */
     deleteJoinedStrand(strandId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
     /**
-     * Record, party-wide, a join this party asked for (`PendingJoin` row), using an owner
-     * signature over every column of the row (see {@link pendingJoinAddFields}). Returns the
-     * row as written, with the fresh `StampId` a later {@link replacePendingJoin} names.
+     * Record, party-wide, a join this party asked for: a `JoinRequest` row under a fresh stamp,
+     * owner-signed over every column. Returns the pending join as written.
      *
-     * Fails with a `PendingJoin.Id` uniqueness violation when the party already holds a row for
-     * this invitation; {@link isPendingJoinConflict} identifies that case.
+     * Fails with a `JoinRequest.Id` uniqueness violation when the party already holds a request
+     * for this invitation; {@link isPendingJoinConflict} identifies that case.
      */
-    insertPendingJoin(row: Omit<PendingJoinRow, 'StampId'>, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoinRow>;
+    insertJoinRequest(request: JoinRequestFields, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
     /**
-     * Replace the live `PendingJoin` row `next.Id` with `next`, under a fresh stamp — the only way
-     * an outcome is written, since the table refuses updates. Returns the row as written.
+     * Record the outcome of the pending join `expected`: its owner-signed `JoinSuccess` /
+     * `JoinFailure` row, keyed by the request's stamp. A join recorded over a failure deletes the
+     * failure row in the same transaction (the schema authorizes that delete by the join, and
+     * leaves the one-outcome rule in that direction to this writer). Returns the pending join as
+     * written.
      *
-     * One locked transaction deletes the row (owner-signed `'remove'` digest, with its
-     * `Revocation` tombstone) and inserts its successor, so no reader ever sees the id missing in
-     * between. The live row must still be the incarnation the caller read: when its `StampId` is
-     * not `expectedStampId`, or the row is gone, this throws {@link PendingJoinChangedError} and
-     * writes nothing. That check is local; a sibling machine's replacement or removal that lands
-     * between it and the commit fails the transaction instead (its tombstone for the same stamp,
-     * or its successor row, collides on a primary key), and the caller re-reads either way.
+     * The live join must still be what the caller read: the same request incarnation with the
+     * same outcome kind. Otherwise this throws {@link PendingJoinChangedError} and writes nothing.
+     * That check is local; a sibling machine's write landing between it and the commit fails the
+     * transaction instead (its outcome row collides on the primary key, or its tombstone retires
+     * the stamp), and the caller re-reads either way.
+     */
+    recordJoinOutcome(expected: PendingJoin, outcome: JoinOutcome, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
+    /**
+     * Re-write the pending join `next` (request and outcome) under a fresh stamp, retiring the
+     * live request incarnation `expectedStampId`: how a finished request is asked for again, and
+     * how a join written while this machine was alone is re-broadcast. One locked transaction
+     * deletes the outcome row and the request (owner-signed `'remove'` digest, with its
+     * `Revocation` tombstone) and inserts the successors, so no reader ever sees the id missing in
+     * between. Throws {@link PendingJoinChangedError} and writes nothing when the live request is
+     * not `expectedStampId`.
      *
      * Signatures and the new stamp are minted before the lock, so a retried attempt re-presents
      * the same signed messages (the contract on {@link withWriteLock}). A retry after an attempt
-     * that committed but reported failure throws {@link PendingJoinChangedError} whose
-     * `liveStampId` is the returned row's own stamp, so a caller that re-reads finds its write.
+     * that committed but reported failure throws {@link PendingJoinChangedError} whose live join
+     * carries the returned stamp, so a caller that re-reads finds its write.
      */
-    replacePendingJoin(expectedStampId: string, next: Omit<PendingJoinRow, 'StampId'>, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoinRow>;
+    rewritePendingJoin(expectedStampId: string, next: PendingJoinFields, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
     /**
-     * Owner-signed removal of one `PendingJoin` row, as {@link deleteJoinedStrand} removes its
-     * row: `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same
-     * transaction. A no-op (no throw, no tombstone) when the row does not exist — `false` then,
-     * `true` when a row was actually removed.
+     * Owner-signed removal of one pending join, as {@link deleteJoinedStrand} removes its row:
+     * `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same transaction,
+     * and the request's outcome row with it. A no-op (no throw, no tombstone) when there is no
+     * request — `false` then, `true` when one was actually removed.
      */
     deletePendingJoin(id: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
     /**
-     * Mint a fresh stamp for `row` and the owner signature `PendingJoin.AuthorizedInsert`
-     * verifies, returning the row as it will be written and the parameters of
-     * {@link PENDING_JOIN_INSERT_SQL}.
+     * Mint a fresh stamp for `request` and the owner signature `JoinRequest.AuthorizedInsert`
+     * verifies, returning the row as it will be written and its insert.
+     */
+    private signJoinRequestInsert;
+    /**
+     * Remove the outcome row of the request incarnation `requestStampId`, whichever table holds
+     * it. Unsigned: the schema authorizes the delete by the tombstone retiring that stamp, filed
+     * in the same transaction or already committed (a reap).
      */
-    private signPendingJoinInsert;
+    private deleteJoinOutcomes;
+    /** One unsigned outcome delete (see {@link deleteJoinOutcomes}; a failure's is also authorized by the join superseding it). */
+    private deleteJoinOutcome;
     /**
      * Insert a validation key into the control database using an owner signature.
      *
@@ -1000,6 +1285,7 @@ export declare class ControlDatabase {
         multiaddr: string;
         updatedAt: number;
         sig: string | null;
+        profile: NodeProfile | null;
     }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
     /**
      * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
@@ -1011,7 +1297,8 @@ export declare class ControlDatabase {
      * local-only (its block's cluster ≤1 at insert) is pushed to the cohort once it grows, by
      * re-issuing this monotonic bump. It is an UPDATE (not the original INSERT) because the row
      * already exists locally; a re-INSERT would hit the `PeerId` PK. Only the freshness stamp
-     * and voucher change — `PublicKey` / `Multiaddr` / `Sig` are left intact — so it is safe
+     * and voucher change — `PublicKey` / `Multiaddr` / `Sig` / `Profile` are left intact (the
+     * owner branch requires them kept: they are the machine's own claim) — so it is safe
      * over a row whose peer has not self-published (`Sig` null); the caller must skip a row
      * that already carries a self-`Sig` (that row is the owning peer's to refresh, and bumping
      * `UpdatedAt` without re-signing would invalidate its self-signature).
@@ -1033,6 +1320,11 @@ export declare class ControlDatabase {
      * change the member set. Keeping the rule uniform ("every CadrePeer mutator notifies")
      * beats a per-method exception the next reader has to relearn.
      *
+     * Also clears `VouchUsage`: a row carries exactly one proof (the owner branch of
+     * `AuthorizedUpdate` requires it null), so re-vouching an invitation-admitted row moves it
+     * onto the signature and its invitation is no longer consulted for it — the way an owner
+     * retires a device's dependency on an invitation it may later withdraw.
+     *
      * NOTE: this rebinds VouchOwner to the CALLING owner's key, and the authorized-membership
      * predicate (`CadreNode.listAuthorizedMembers`) now judges rows by that column against each
      * reader's node-local anchor. Benign today because the only caller — the write-while-alone
@@ -1089,15 +1381,9 @@ export declare class ControlDatabase {
      * Owner-signed delete of one guarded row plus the `Revocation` tombstone retiring its
      * stamp, in ONE transaction. The single body behind EVERY guarded delete —
      * {@link deleteStrand}, {@link deleteValidationKey}, {@link deleteCadrePeer},
-     * {@link deleteDeviceToken}; see any of them for the per-table security rationale. Each
-     * of those is a thin named wrapper, so callers never pass a table name and this
-     * generic shape stays off the public surface.
-     *
-     * `OwnerKey` is excluded from `table` only because no owner-key removal path exists in
-     * production yet — the schema has the `'remove'` branch (`OwnerKey.Authorized`, which
-     * requires a DIFFERENT owner as signer) and `control-revocation-replay.spec.ts` drives
-     * it with hand-rolled SQL. Widen this and add a wrapper when that path lands; the body
-     * needs no change.
+     * {@link deleteDeviceToken}, {@link deleteOwnerKey}; see any of them for the per-table
+     * security rationale. Each of those is a thin named wrapper, so callers never pass a
+     * table name and this generic shape stays off the public surface.
      *
      * The row's CURRENT stamp is read first and signed over, so the remove digest binds to
      * this exact row instance. A no-op (no throw, no tombstone) when the row is absent —
@@ -1105,6 +1391,9 @@ export declare class ControlDatabase {
      * second read (e.g. {@link CadreNode.unpublishStrand}'s committed-while-alone warning,
      * which must not fire for a no-op).
      *
+     * `alongside`, when given, runs inside the transaction before the removal, for a table whose
+     * row has dependants the schema requires removed with it ({@link deletePendingJoin}).
+     *
      * NOTE: the stamp read is outside the transaction. A concurrent writer that removes
      * the row in between makes the signature bind a stamp that is no longer live; the
      * delete then matches nothing and the tombstone insert collides with the other
@@ -1119,7 +1408,7 @@ export declare class ControlDatabase {
     /**
      * Delete the row incarnation `removal` names and file its tombstone — the statement pair
      * every owner removal of a guarded row runs ({@link deleteGuardedRow},
-     * {@link deleteStrandAndPartyKey}, {@link replacePendingJoin}). The caller supplies the
+     * {@link deleteStrandAndPartyKey}, {@link rewritePendingJoin}). The caller supplies the
      * transaction: the schema's `RevocationRecorded` check refuses the delete unless the
      * tombstone commits with it.
      *
@@ -1130,6 +1419,21 @@ export declare class ControlDatabase {
      * come from closed literal unions — no caller-supplied string reaches the statement.
      */
     private execGuardedRemoval;
+    /**
+     * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
+     * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of a
+     * `CadreInvite` withdrawal ({@link withdrawCadreInvite}), whose row stays — or the ledger
+     * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
+     * lock and, where one is needed, the transaction.
+     *
+     * `ReissuedAt` is named explicitly at 0 (the only value `FreshTombstone` accepts) rather
+     * than leaning on the column default — the seat-at-zero rule is load-bearing for
+     * {@link reissueRevocations}' monotonic bump, so state it at the write site.
+     *
+     * `SignerKey` / `SignerSig` store the context pair (`Revocation.Authorized` pins them
+     * equal), so a node that receives the row by replication can tell which owner filed it.
+     */
+    private execTombstone;
     /**
      * Fire the guarded-delete listener for one committed tombstone, swallowing (and
      * logging) a listener throw — a committed delete never fails because bookkeeping did.
@@ -1218,9 +1522,9 @@ export declare class ControlDatabase {
      *   a retired stamp, and which a revoked drone cannot produce at all. The trade is
      *   recurring failure noise every cycle against removing the one stale row nobody else
      *   reads from this node (every other node already filters it by tombstone). A revoked
-     *   node therefore keeps its own copy of its own row; "a node that learns it has been
-     *   revoked should shut itself down" is a distinct behaviour and its own ticket.
-     *   `ValidationKey`, `JoinedStrand` and `PendingJoin` have no self notion and are not
+     *   node therefore keeps its own copy of its own row; learning that it was removed is a
+     *   separate behaviour (`CadreNode.removedFromCadre`, the `cadre:removed` event).
+     *   `ValidationKey`, `JoinedStrand` and `JoinRequest` have no self notion and are not
      *   special-cased.
      *
      * A per-row failure is logged and skipped rather than aborting the sweep: an abort would
@@ -1362,15 +1666,18 @@ export declare class ControlDatabase {
      */
     setControlWriteAbandonedListener(listener: ControlWriteAbandonedListener | null): void;
     /**
-     * Run a `CadrePeer` row mutation and notify the membership listener once it has
+     * Run a membership-relevant mutation and notify the membership listener once it has
      * COMMITTED.
      *
-     * EVERY `CadrePeer` writer goes through here, with one documented exception
-     * ({@link updateSelfPeerRecord}, which cannot change the snapshot) — that is what makes
-     * the party-membership snapshot refresh automatic rather than a caller obligation. A
+     * Covers every write that can change who is a member or an owner: EVERY `CadrePeer`
+     * writer, with one documented exception ({@link updateSelfPeerRecord}, which cannot
+     * change the snapshot), the `OwnerKey` writers ({@link insertOwnerKeyVouched},
+     * {@link deleteOwnerKey}) and the invitation redemption ({@link redeemCadreInvite}),
+     * which seats both. That is what makes the party-membership snapshot refresh automatic
+     * rather than a caller obligation. The name predates the `OwnerKey` writers. A
      * writer necessarily holds the target node's ControlDatabase (the `SeedBootstrapService`'s
-     * event callbacks are NOT a viable seam: the temp services `CadreNode.applySeed`/
-     * `dialInvite` build, and services constructed outside `CadreNode` entirely, never get
+     * event callbacks are NOT a viable seam: the temp service `CadreNode.applySeed`
+     * builds, and services constructed outside `CadreNode` entirely, never get
      * callbacks wired), so this is the one point on the write path that cannot be bypassed.
      *
      * `body` owns its own transaction if it needs one and must COMMIT before returning, so
@@ -1707,14 +2014,13 @@ export declare class ControlDatabase {
      * locked write body — same per-call opt-out, and for the same reason, as
      * {@link queryStampId}'s. Every unlocked caller keeps the default retried path.
      */
-    queryFormationInvite(token: string, retry?: boolean): Promise<{
-        token: string;
-        sAppId: string;
-        expiresAtMs: number | null;
-        totalUses: number | null;
-        validationUrl: string | null;
-        strandId: string | null;
-    } | null>;
+    queryFormationInvite(token: string, retry?: boolean): Promise<FormationInviteRow | null>;
+    /**
+     * Every `FormationInvite` row, expired and spent ones included, in the shape
+     * {@link queryFormationInvite} returns one. Read by a strand move
+     * (`exportStrandBundle`), which decides per row what is still redeemable.
+     */
+    queryFormationInvites(): Promise<FormationInviteRow[]>;
     /**
      * Count `FormationUsage` rows recorded against a token (uses consumed so far).
      *
@@ -1769,6 +2075,197 @@ export declare class ControlDatabase {
      * unlimited-use invite anywhere in the scan short-circuits all of them.
      */
     hasOutstandingFormationInvite(nowMs?: number): Promise<boolean>;
+    /**
+     * Mint and insert an owner-signed `CadreInvite`: an invitation to join THIS cadre that any
+     * member machine can later redeem on the owner's behalf ({@link redeemCadreInvite}).
+     *
+     * The owner signs the whole row ({@link cadreInviteAddMessage}) — `ExpiresAt` through
+     * {@link canonicalDatetime} so the signed segment byte-matches the stored `datetime`, as
+     * {@link insertFormationInvite} does — and the stored `IssuerKey`/`IssuerSig` are pinned to
+     * that signer by `CadreInvite.AuthorizedInsert`. The signature is part of the row because
+     * the row travels: the returned {@link CadreInviteRow} is what the invitation bundle
+     * carries to the holder, and {@link seatCadreInvite} re-inserts it verbatim on a member
+     * that has not received it by replication.
+     *
+     * `key` is the invitation's ed25519 PUBLIC key; the caller minted the pair and hands the
+     * private half to the invitee out of band. It is never stored here (`Strand.Invite` has the
+     * same shape).
+     *
+     * @param invite.key - the invitation public key (base64url ed25519), the row's primary key
+     * @param invite.peerId - the device the invitation is for, or null for whoever redeems first
+     * @param invite.grantsOwner - whether redemption also seats an `OwnerKey` row for the device
+     * @param invite.expiresAtMs - epoch ms after which it cannot be redeemed; omit for never
+     * @param invite.totalUses - how many redemptions it allows; omit for unlimited
+     * @returns the row as stored, `expiresAt` in its canonical form
+     */
+    insertCadreInvite(invite: {
+        key: string;
+        peerId?: string | null;
+        grantsOwner: boolean;
+        expiresAtMs?: number | null;
+        totalUses?: number | null;
+    }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<CadreInviteRow>;
+    /**
+     * Seat an owner-signed `CadreInvite` row received inside an invitation bundle, under its own
+     * stored `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, so a member that
+     * already holds the row (by replication, or from an earlier redemption attempt) is a no-op.
+     *
+     * @returns `true` when this call inserted the row, `false` when it was already present.
+     * @throws {CadreInviteIssuerUnknownError} when `CadreInvite.AuthorizedInsert` refuses it: the
+     *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
+     *   not verify. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     */
+    seatCadreInvite(row: CadreInviteRow): Promise<boolean>;
+    /** Bare `CadreInvite` insert shared by {@link insertCadreInvite} and {@link seatCadreInvite}; the caller holds the lock. */
+    private execCadreInviteInsert;
+    /**
+     * Read one `CadreInvite` row by key, or null when absent. Withdrawn rows are returned too —
+     * the row is the holder's proof and never goes away; liveness is {@link hasLiveCadreInvite}'s
+     * question, and `CadreInviteUsage.Authorized`'s at redemption.
+     *
+     * `retry: false` is passed by {@link redeemCadreInvite}, which reads INSIDE its locked write
+     * body — the same per-call opt-out, for the same reason, as {@link queryStampId}'s.
+     */
+    queryCadreInvite(key: string, retry?: boolean): Promise<CadreInviteRow | null>;
+    /**
+     * Every `CadreInvite` row this node holds, withdrawn and expired ones included (see
+     * {@link queryCadreInvite}). Read by the membership predicate when at least one `CadrePeer`
+     * row is invitation-admitted; `retry: false` is forwarded from
+     * {@link CadreNode.listAuthorizedMembers} on the membership-gate refresh path for
+     * {@link queryCadrePeers}' reason.
+     */
+    queryCadreInvites(retry?: boolean): Promise<CadreInviteRow[]>;
+    /**
+     * Every `CadreInviteUsage` row this node holds — the redemption records the membership
+     * predicate verifies invitation-admitted rows against. Same `retry` contract as
+     * {@link queryCadreInvites}.
+     */
+    queryCadreInviteUsages(retry?: boolean): Promise<CadreInviteUsageRow[]>;
+    /**
+     * How many times a cadre invitation has been redeemed (its `CadreInviteUsage` rows), served
+     * through the `CadreInviteUsageByInvite` index. As {@link countFormationUsage}: a permissive
+     * PRE-check, not the cap — the cap is `CadreInviteUsage.Authorized`'s own committed count.
+     *
+     * `retry: false` is passed by {@link assertCadreInviteSeatRemains}, inside the locked body.
+     */
+    countCadreInviteUsage(key: string, retry?: boolean): Promise<number>;
+    /**
+     * Is any cadre invitation still redeemable — not withdrawn, unexpired, with uses below its
+     * `TotalUses`, and issued by a current owner? The conditions `CadreInviteUsage.Authorized`
+     * applies, read ahead of time so the control-network connection gate can answer "does this
+     * node expect a stranger?" with no key to ask about, exactly as
+     * {@link hasOutstandingFormationInvite} answers it for strand formation. The expiry
+     * comparison is `expiresAtMs <= now`, so an invitation the redemption would refuse never
+     * holds the gate open.
+     *
+     * Withdrawal is read through {@link queryRevokedStamps}, the per-table retired-stamp seam
+     * every other revocation-aware reader uses (and the one an isolated node can still answer).
+     */
+    hasLiveCadreInvite(nowMs?: number): Promise<boolean>;
+    /**
+     * Is this one cadre invitation still redeemable here — the conditions
+     * {@link hasLiveCadreInvite} applies, for one invitation? The row judged is the one this node
+     * holds under `invite.key`; when it holds none, `invite` itself (a bundle's copy, not seated
+     * yet), but only if its issuer signature verifies, because an unsigned copy would otherwise be
+     * judged by whichever owner it names as issuer. A permissive pre-check like
+     * {@link countCadreInviteUsage}: {@link seatCadreInvite} and the redemption's own write are
+     * what enforce every condition.
+     */
+    isCadreInviteLive(invite: CadreInviteRow, nowMs?: number): Promise<boolean>;
+    /**
+     * Every `CadreInvite` row this node holds with its standing: how many redemptions are
+     * recorded, whether it is withdrawn, and whether it is still redeemable — the same
+     * conditions {@link hasLiveCadreInvite} applies, answered per row for an owner's listing
+     * rather than short-circuited. One usage count per row, so this is the owner's
+     * occasional read, not a gate's.
+     */
+    listCadreInviteStatuses(nowMs?: number): Promise<CadreInviteStatus[]>;
+    /**
+     * Owner-signed WITHDRAWAL of a cadre invitation: file the `Revocation` tombstone retiring its
+     * stamp, with the row kept. The row stays because every device the invitation admitted
+     * proves its membership through it (`CadrePeer.AuthorizedInsert`'s consent branch,
+     * `verifyInvitationAdmission`); `CadreInvite.NoDelete` refuses a delete, and
+     * `Revocation.RowIsGone` admits a `'CadreInvite'` tombstone while the row lives. Afterwards
+     * `CadreInviteUsage.Authorized` refuses every further redemption, and `CadreInvite.NotRevoked`
+     * refuses re-seating the row from the holder's signed copy on any node holding the
+     * tombstone.
+     *
+     * Idempotent: a no-op (no throw, nothing written) when the row is absent locally or already
+     * withdrawn — `false` then, `true` when this call filed the tombstone. The owner must hold the
+     * row to withdraw it, since the tombstone names the row's stamp.
+     *
+     * Fires the guarded-delete listener like a removal does, so a withdrawal committed while the
+     * node was alone is queued for re-issue on cohort growth ({@link CadreNode.noteGuardedDelete}).
+     */
+    withdrawCadreInvite(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    /**
+     * The withdrawal tombstones for the `CadreInvite` rows among `keys` that are held here and
+     * not yet withdrawn, signed and ready for {@link execTombstone}: the body
+     * {@link withdrawCadreInvite} files one of and {@link removeMachine} files several of in one
+     * transaction. Inside the locked body (every read `retry: false`); an absent or already
+     * withdrawn key is logged and left out.
+     */
+    private signCadreInviteWithdrawals;
+    /**
+     * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member and,
+     * when the invitation grants ownership, as an owner — with NO owner signature. One
+     * transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`), the
+     * `OwnerKey` row when granted (consent branch of `Authorized`), and last the
+     * `CadreInviteUsage` row that authorizes both; the usage row's own checks (`PeerExists`,
+     * `OwnerExists`) read the rows back, so the three are mutually bound to this exact
+     * redemption and none can be held in reserve. The invitation must already be committed
+     * ({@link seatCadreInvite}): every consent branch reads `committed.CadreInvite`.
+     *
+     * The two signatures are the holder's and the device's, minted on the device over
+     * {@link cadreInviteRedeemMessage} / {@link cadreInviteConsentMessage}; this machine only
+     * verifies them (by writing the row). `peerId` must be the identity multihash of `peerKey`:
+     * the schema cannot derive it, so a writer asserts the pair and every reader re-derives it
+     * (`verifyInvitationAdmission`) — a mismatched pair is written and then never trusted.
+     *
+     * Idempotent for a retry after a dropped reply: when the device's row is already present
+     * (and its `OwnerKey` row too, when granted) nothing is written and no seat is spent —
+     * `alreadyMember: true`. A present row whose `OwnerKey` row is missing under an
+     * owner-granting invitation is completed: the usage row then names the existing peer stamp.
+     * The seat check ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a
+     * single-use redemption is answered `alreadyMember` rather than refused as exhausted.
+     *
+     * Through {@link mutateCadrePeer}, so the membership hub is notified; inside the locked body
+     * every read passes `retry: false` and every stamp is minted per attempt, so a
+     * {@link lockedWithRetry} re-run starts clean.
+     *
+     * @throws {InvitationExhaustedError} when the invitation's seats are all spent (by name,
+     *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains}).
+     */
+    redeemCadreInvite(params: {
+        inviteKey: string;
+        peerId: string;
+        /** The device's ed25519 public key (base64url); `peerId` is its identity multihash. */
+        peerKey: string;
+        /** The device's dialable addresses, if known; stored comma-joined as `authorizePeer` does. */
+        multiaddrs?: string[];
+        /** Single-use nonce minted by the device; both signatures cover it. */
+        usageStampId: string;
+        /** The holder's signature with the invitation private key over the `'redeem'` digest. */
+        inviteSig: string;
+        /** The device's signature with its own key over the `'consent'` digest. */
+        peerSig: string;
+        nowMs?: number;
+    }): Promise<CadreInviteRedemptionResult>;
+    /**
+     * The rows a redemption would seat that are already present: the device's `CadrePeer`
+     * stamp, and — only when the invitation grants ownership — its `OwnerKey` stamp. Raw stamp
+     * reads ({@link queryStampId}), so a physically present row counts; inside the locked
+     * body, so never retried.
+     */
+    private readSeatedAdmission;
+    /**
+     * Refuse a redemption that would consume a seat the cadre invitation does not have, by
+     * name ({@link InvitationExhaustedError}) — the cadre-invitation twin of
+     * {@link assertSeatRemains}, for the same reason: the schema's cap clause refuses as a
+     * generic `Authorized` failure a caller would otherwise report as retryable. Reads the
+     * committed count inside the locked body, so on a same-node race the loser is refused here.
+     */
+    private assertCadreInviteSeatRemains;
     /**
      * Close the database and cleanup resources.
      *