@serfab/cadre-core 1.16.0 → 1.17.0

package/src/cadre-node.ts

@@ -14,6 +14,8 @@ import type {
   StrandConfig,
   FoundStrandConfig,
   FoundStrandResult,
+  FoundStrandOptions,
+  FoundStrandBackgroundResult,
   SAppConfig,
   CadreNodeEvents,
   ControlNetworkSeed,
@@ -34,28 +36,38 @@ import type {
   DeviceTokenRecord,
   CadrePeerVoucherFields,
   CadrePeerRow,
-  OwnerKeyRow,
   RevocationRow,
   InvitationChain,
+  OwnerGrantChain,
   CadreInviteStatus,
   CadreMachine,
+  CadreOwnerKey,
   MachineRemovalPlan,
   MachineRemovalResult,
-  RemoveMachineOptions,
+  OwnerKeyDependents,
+  OwnerKeyRemovalPlan,
+  OwnerKeyRemovalResult,
+  RemoveOwnerOptions,
   CadreRemoval,
   CadreInvitationReach,
   CreateCadreInvitationOptions,
   CreateCadreInvitationResult,
   RedeemCadreInvitationOptions,
   RedeemCadreInvitationResult,
+  CreateOwnerGrantOptions,
+  CreateOwnerGrantResult,
+  OwnerGrantStatus,
+  RedeemOwnerGrantOptions,
+  RedeemOwnerGrantResult,
+  JoinWithOwnerGrantResult,
   PeerAddressRecord,
   ResolveDeviceTokenOpts,
   PendingJoin,
   PendingJoinStatus
 } from './types.js';
 import { controlClusterPolicy, CONTROL_REPLICATION_BREADTH, DEFAULT_CHECKIN_WINDOW_MS, DEFAULT_CONNECTION_MONITOR } from './types.js';
-import { generatePrivateKey, sign } from '@optimystic/quereus-plugin-crypto';
-import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64, type Ed25519KeyPair } from './ed25519-key.js';
+import { generatePrivateKey } from '@optimystic/quereus-plugin-crypto';
+import { ed25519KeyPairFromLibp2p, ed25519PublicKeyFromPrivate, requireEd25519PublicKeyB64 } from './ed25519-key.js';
 import { strandTransportKey } from './strand-transport-key.js';
 import {
   assertScopeKeyCharset,
@@ -70,6 +82,7 @@ import { MEMBERSHIP_INVITE_TTL_MS } from './strand-formation-manager.js';
 import { DEFAULT_IDENTITY_KEY_ID } from './key-store.js';
 import { loadOrCreateIdentityKey } from './identity-key.js';
 import { MemoryTrustedOwnerStore, type TrustedOwnerStore, type TrustSource } from './trusted-owner-store.js';
+import { softwareOwnerSigner, withinOwnerApproval, type OwnerSign, type OwnerSigner, type OwnerSigningRequest } from './owner-signer.js';
 import { MemoryBootstrapPeerStore, type BootstrapPeerStore } from './bootstrap-peer-store.js';
 import { MemoryStrandNetworkStateStore, type StrandNetworkStateStore } from './strand-network-state.js';
 import { MemoryEnrolledMachineStore, type EnrolledMachineStore } from './enrolled-machine-store.js';
@@ -85,7 +98,8 @@ import { mergePeerAddrs, groupAddrsByPeerId, type MergeAddrsResult } from './pee
 import { strandFretPeerAddrs } from './strand-fret-addrs.js';
 import { verifyCadrePeerVoucher, verifyInvitationAdmission, verifyRevocationSigner } from './peer-authorization.js';
 import { deriveOwnerAnchor } from './owner-anchor-sync.js';
-import { describeMachines, planMachineRemoval, revouchWithinPlan, MachineRemovalRefusedError } from './machine-removal.js';
+import { describeMachines, planMachineRemoval, MachineRemovalRefusedError } from './machine-removal.js';
+import { describeOwnerKeys, namedOwnerKey, planOwnerKeyRemoval, revouchWithinPlan, OwnerKeyAddRefusedError, OwnerKeyRemovalRefusedError } from './owner-keys.js';
 import { ed25519PublicKeyB64FromPeerId } from './ed25519-key.js';
 import {
   signPeerRecord,
@@ -124,7 +138,7 @@ import {
 import { ADMISSION_DECISION_TIMEOUT_MS, declaredCohortReadDeadlineMs, optimysticDialLimits, peerJoinPushBudget, relayReservationBudgetMs, relayedDialBudgetMs, relayedRequestBudgetMs, resolveLinkRoundTripMs } from './link-budget.js';
 import { EnrollmentService } from './enrollment.js';
 import { HibernationManager, type HibernationCallbacks } from './hibernation-manager.js';
-import { ControlDatabase, generateStampId, isPendingJoinConflict, isStrandIdConflict, pendingJoinId, type JoinRequestFields, type RevokedRowRef } from './control-database.js';
+import { ControlDatabase, generateStampId, isPendingJoinConflict, isStrandIdConflict, IssuedRowNotHereYetError, pendingJoinId, type JoinRequestFields, type RevokedRowRef } from './control-database.js';
 import {
   CadreInviteHandler,
   encodeCadreInvitation,
@@ -132,6 +146,16 @@ import {
   signRedeemRequest,
   type CadreInvitation
 } from './cadre-invite-protocol.js';
+import {
+  OwnerGrantHandler,
+  OwnerGrantRejectedError,
+  encodeOwnerGrant,
+  redeemOwnerGrantInPasses,
+  signOwnerGrantRequest,
+  type OwnerGrantBundle,
+  type OwnerGrantRedeemRequest,
+  type OwnerGrantRedemption
+} from './owner-grant-protocol.js';
 import { FormationPostApprovalError } from './strand-formation-rejection.js';
 import {
   PendingJoinRunner,
@@ -168,6 +192,8 @@ import {
   dueRelayAnnounces,
   prunePeerStrandKeys,
   peerStrandKey,
+  recordRelayRefusals,
+  relaysNotRefusing,
   type CircuitRelayTarget
 } from './delegate-admission.js';
 import { relayCircuitAddrs, resolveListenAddrs, resolveTransportOptions, RelayReservationFailedError } from './relay-addrs.js';
@@ -217,14 +243,32 @@ export const STRAND_PEER_ADDR_REFRESH_MS = 10 * 60 * 1000;
 export const STRAND_PEER_ADDR_RETRY_MS = 60 * 1000;
 
 /**
- * Default lifetime of an UNTARGETED, OWNER-GRANTING cadre invitation
- * ({@link CadreNode.createCadreInvitation}): whoever holds the bundle becomes an owner, so
- * it is a bearer credential for admin rights and lives only long enough to be pasted or
- * scanned by the device it was minted for.
+ * Default lifetime of an owner grant ({@link CadreNode.createOwnerGrant}): whoever holds the
+ * bundle can become an owner, so it is a bearer credential for admin rights and lives only
+ * long enough to be pasted or scanned by the device it was minted for. A backup grant is minted
+ * with no expiry, by explicit choice.
+ */
+export const OWNER_GRANT_DEFAULT_TTL_MS = 15 * 60 * 1000;
+
+/**
+ * Lifetime of the invitation {@link CadreNode.joinWithOwnerGrant} issues to itself: redeemed in
+ * the same call at the member that just wrote the grant, so the grant's short default is plenty,
+ * and a later call signs a fresh one.
+ */
+const SELF_INVITATION_TTL_MS = OWNER_GRANT_DEFAULT_TTL_MS;
+
+/** How often {@link CadreNode.joinWithOwnerGrant} asks again whether its own `OwnerKey` row has reached this node. */
+const OWNER_ROW_SYNC_RECHECK_MS = 2_000;
+
+/**
+ * Bound on that wait, the edge node's owner-step bound (`DEFAULT_OWNER_GENESIS_TIMEOUT_MS` in
+ * `edge-node/config.ts`): the join has already succeeded at the member, so past it the call
+ * returns with the key unwired rather than wait out a stalled sync.
  */
-export const OWNER_INVITATION_DEFAULT_TTL_MS = 15 * 60 * 1000;
+// eslint-disable-next-line no-restricted-syntax -- cuts off by design: the call goes on with the key unwired rather than wait out a stalled control sync; `wireOwnKeyIfOwner` wires it later
+const OWNER_ROW_SYNC_TIMEOUT_MS = 60_000;
 
-/** Default lifetime of every other cadre invitation: targeted, or granting membership only. */
+/** Default lifetime of a cadre invitation ({@link CadreNode.createCadreInvitation}): it admits a machine and grants nothing else, so it need not be short. */
 export const CADRE_INVITATION_DEFAULT_TTL_MS = 24 * 60 * 60 * 1000;
 
 type EventHandler<T> = (data: T) => void;
@@ -237,6 +281,43 @@ function relayStrandAddrPeer(relay: CircuitRelayTarget): StrandAddrPeer {
   return { peerId: relay.relayPeerId, addrs: [multiaddr(relay.relayAddr)] };
 }
 
+/**
+ * What the holder of an owner grant approves on the signer whose key it seats: one request for
+ * the whole action, naming the party (as every owner signing request does) and the grant.
+ */
+function ownerGrantApproval(bundle: OwnerGrantBundle, scope: 'redeem' | 'join' = 'redeem'): OwnerSigningRequest {
+  const grant = namedOwnerKey(bundle.grant.key, bundle.grant.label);
+  return {
+    partyId: bundle.partyId,
+    action: scope === 'join'
+      ? `Join the cadre with this device and make this key one of its owners, with the owner grant ${grant}`
+      : `Make this key an owner of the cadre, with the owner grant ${grant}`,
+  };
+}
+
+/**
+ * Run one of the local grant path's writes, refusing `conflict` (retryable) when the grant row
+ * the cadre holds is not readable here yet, as a member answers the same failure over the protocol.
+ */
+async function refusingUnsyncedGrant<T>(write: () => Promise<T>): Promise<T> {
+  try {
+    return await write();
+  } catch (error) {
+    if (error instanceof IssuedRowNotHereYetError) {
+      log('owner grant write refused until this node syncs: %s', error.message);
+      throw new OwnerGrantRejectedError('conflict', 'The cadre holds the grant, and this node has not synced it yet; try again shortly');
+    }
+    throw error;
+  }
+}
+
+/** `members` with the addresses naming `peerId` (by their trailing `/p2p/`) first, order otherwise kept; unchanged for a null `peerId`. */
+function addressesOfFirst(members: readonly string[], peerId: string | null): string[] {
+  if (peerId === null) return [...members];
+  const names = (addr: string): boolean => addr.endsWith(`/p2p/${peerId}`);
+  return [...members.filter(names), ...members.filter((addr) => !names(addr))];
+}
+
 /**
  * Whether a sibling actually answered a strand-addr RPC — with addresses or
  * without — as opposed to being unreachable, unavailable, or refusing us. Decides
@@ -270,11 +351,6 @@ function unionAddrs(primary: readonly string[], extra: readonly string[]): strin
   return out;
 }
 
-/**
- * Build the signing callback the `ControlDatabase` writers expect: they hand it the
- * canonical row-bound message BYTES (see `buildAuthorizationMessage`), and it ed25519-signs
- * them directly (no pre-hash) with the owner private key, returning a base64url signature.
- */
 /**
  * One membership refresh's invitation chain ({@link InvitationChain}), loaded at most once
  * and shared by the anchor sync (`OwnerKey` rows) and the membership read (`CadrePeer`
@@ -289,16 +365,15 @@ type InvitationChainSource = () => Promise<InvitationChain>;
  */
 type RevocationSource = () => Promise<RevocationRow[]>;
 
-/** Whether a `CadrePeer` or `OwnerKey` row's proof is an invitation admission rather than an owner voucher (`types.ts` → `CadrePeerRow`, `OwnerKeyRow`). */
-function isInvitationAdmitted(row: { vouchSig: string | null; vouchUsage: string | null }): boolean {
+/**
+ * Whether a `CadrePeer` or `OwnerKey` row's proof is a consent admission rather than an owner
+ * voucher (`types.ts` → `CadrePeerRow`, `OwnerKeyRow`): a machine invitation for a `CadrePeer`
+ * row, an owner grant for an `OwnerKey` row.
+ */
+function isConsentSeated(row: { vouchSig: string | null; vouchUsage: string | null }): boolean {
   return row.vouchSig === null && row.vouchUsage !== null;
 }
 
-function signMessageWith(privateKeyB64: string): (message: Uint8Array) => string {
-  return (message: Uint8Array): string =>
-    sign(message, privateKeyB64, 'ed25519', 'bytes', 'base64url', 'base64url') as string;
-}
-
 /**
  * Reject a blank identifier before it reaches the control database, where it would fail an
  * authorization CHECK as an opaque constraint error rather than an actionable message.
@@ -316,13 +391,13 @@ function requireNonBlank(value: string, label: string): string {
  * Is the live `Strand` row the one a publish of `desired` would have produced?
  *
  * "Identical content" means `(Type, MemberPrivateKey)` and deliberately NOT
- * `FounderOwnerKey`: that column is provenance (WHICH machine published the row), not
- * content. Two machines of one party racing to found the same id must keep resolving as
- * "the winner's row stands" — the loser adopts the row and, since the winner's key is on
- * it, correctly comes up as a joiner (see `launchStrand`'s founder derivation). Comparing
- * it here would turn that benign race into a hard throw. `Id` is the lookup key and
- * `StampId` is a single-use nonce, so the two compared columns are all the content there
- * is. A live row matching on both is, by construction, the state a repeat publish would
+ * `FounderOwnerKey` or `FounderPeerId`: those columns are provenance (WHICH owner signed the
+ * row and WHICH machine founds it), not content. Two machines of one party racing to found
+ * the same id must keep resolving as "the winner's row stands" — the loser adopts the row
+ * and, since the winner's peer id is on it, correctly comes up as a joiner (see
+ * `launchStrand`'s founder derivation). Comparing them here would turn that benign race
+ * into a hard throw. `Id` is the lookup key and `StampId` is a single-use nonce, so the two
+ * compared columns are all the content there is. A live row matching on both is, by construction, the state a repeat publish would
  * have reached, whichever branch of `Strand.AuthorizedInsert` seated it (owner-signed, or
  * the unsigned consent branch an invite redemption uses).
  *
@@ -478,6 +553,13 @@ export class CadreNode implements SAppIdLookup {
    * once that database is up, on every node.
    */
   private cadreInviteHandler: CadreInviteHandler | null = null;
+  /**
+   * Owner grant redemption handler (`/sereus/owner-grant/1.0.0`): a holder of a grant dials
+   * this machine and proves possession of the grant and of the key it seats; the handler seats
+   * the row and writes the `OwnerKey` row against this node's control database. Registered by
+   * {@link start} beside the invitation handler, on every node.
+   */
+  private ownerGrantHandler: OwnerGrantHandler | null = null;
   /**
    * Server-side push-wake fan-out. Constructed by {@link start} only when
    * `config.push` (an injected `PushNotifier` + policy) is present — without it
@@ -695,6 +777,26 @@ export class CadreNode implements SAppIdLookup {
    */
   private readonly delegateAnnounceAt = new Map<string, number>();
 
+  /**
+   * Relay peerIds whose protocol negotiation refused the delegate announcement
+   * (strand-addr outcome `unsupported`), recorded and cleared by
+   * {@link recordDelegateAnnounces} from every announce pass's outcomes. Only a
+   * party-run relay has a membership gate that needs a grant, and it serves
+   * strand-addr, so a refusal marks a dedicated relay: {@link circuitRelayTargets}
+   * leaves it out of the founding/resume and periodic announcements, which would
+   * otherwise spend a protocol negotiation on it every time (gotchoices/sereus#49). Not
+   * pruned: one entry per relay this node ever named.
+   *
+   * {@link announceDelegateToRelay} still asks every relay, remembered or not, and
+   * its reply is what clears an entry. A party-run relay registers its strand-addr
+   * handler late in its own `start()`, after its libp2p node and relay server are
+   * up, so an announcement landing in that window is refused by a relay that serves
+   * the protocol a moment later. If the re-drive hook skipped remembered relays too,
+   * that relay would stay skipped until this node restarts and its gate would deny
+   * every reservation through it.
+   */
+  private readonly relaysRefusingStrandAddr = new Set<string>();
+
   /**
    * When each connected sibling is next due a strand-addr RPC for each running
    * strand, keyed `peerStrandKey(siblingControlPeerId, strandId)` → epoch ms; a
@@ -827,7 +929,7 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Dial targets learned out of band, keyed by peer id, valued by the multiaddr
    * strings this node was handed (parsed lazily, at dial time). Two writers:
-   * {@link recordSeedBootstrapPeers} retains the owner-flagged peers of every seed
+   * {@link recordSeedBootstrapPeers} retains the preferred peers of every seed
    * this node applies, and {@link addDrone} retains the addresses of every node
    * this node adds. Two readers: {@link dialColdStartBootstrap} dials every entry
    * while the control database still has no siblings, and
@@ -1368,11 +1470,22 @@ export class CadreNode implements SAppIdLookup {
       // After the control database is up, since the handler seats and redeems against it.
       this.cadreInviteHandler = new CadreInviteHandler({
         partyId: this.config.controlNetwork.partyId,
+        peerId: this.controlNode.peerId.toString(),
         store: this.controlDatabase,
         admitDevice: (peerId) => this.admitRedeemingDevice(peerId),
       });
       await this.cadreInviteHandler.register(this.controlNode);
 
+      // Answer owner grant redemptions likewise: a holder dials any member and proves possession
+      // of the grant and of the key it seats; no machine is admitted, so the holder's identity
+      // is not checked.
+      this.ownerGrantHandler = new OwnerGrantHandler({
+        partyId: this.config.controlNetwork.partyId,
+        store: this.controlDatabase,
+        admitDevice: (peerId) => this.admitRedeemingDevice(peerId),
+      });
+      await this.ownerGrantHandler.register(this.controlNode);
+
       // A node waiting to be claimed listens for its claim seed from the start: nobody
       // else will turn the listener on, and a node no seed can reach cannot be claimed.
       // Before `control:connected`, so an embedder that reports "awaiting claim" on that
@@ -1577,7 +1690,7 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Construct (or adopt) the node-local trusted-owner anchor and seed the
    * out-of-band pinned keys from `config.trustedOwners`. The anchor's BASE comes
-   * only from out of band — genesis self-trust ({@link initializeSeedBootstrap}),
+   * only from out of band — genesis self-trust ({@link useOwnerSigner}),
    * config pins (here), runtime enrollment pins ({@link trustOwnerKeys}) and a
    * claim; everything else in it is derived from that base along verifiable
    * chains through the replicated `OwnerKey` table ({@link syncOwnerAnchor}),
@@ -1887,12 +2000,13 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Persist out-of-band-established owner keys into the node-local anchor —
-   * the runtime enrollment seam: {@link redeemCadreInvitation} calls it with the
-   * cadre invitation's `ownerKeys` BEFORE dialing a member (so the anchor already
-   * holds the pins when the reply and the rows that follow are judged), and an
+   * the runtime enrollment seam: {@link redeemCadreInvitation} and
+   * {@link redeemOwnerGrant} call it with their bundle's `ownerKeys` BEFORE dialing
+   * a member (so the anchor already holds the pins when the reply and the rows
+   * that follow are judged), and an
    * embedder calls it with an operator-supplied pin. Idempotent. ('genesis'
    * provenance is reserved for the node's own founding key, seeded internally by
-   * {@link initializeSeedBootstrap}; 'chain' is written only by {@link syncOwnerAnchor}.)
+   * {@link useOwnerSigner}; 'chain' is written only by {@link syncOwnerAnchor}.)
    *
    * Validates every key's shape before trusting any of them (all-or-nothing):
    * a malformed entry anywhere in `keys` rejects the whole call before a
@@ -2333,10 +2447,18 @@ export class CadreNode implements SAppIdLookup {
    *     own strand node, so a NAT'd member's strand node can hold a
    *     circuit-relay reservation here (see `delegate-admission.ts`).
    *     Connection only: the per-stream gate below never honors a grant;
-   *  3. the authorized-member set is empty — cold start: the rows that would
+   *  3. the peer is a device whose invitation or owner-grant redemption this
+   *     node has verified and is writing ({@link admittingDevices}): its
+   *     connection carries the exchange, which must not be cut at the
+   *     provisional deadline. A LIVE OWNER GRANT does not count as expecting a
+   *     stranger the way check 7's invitation does: a backup grant has no
+   *     expiry, and counting it would admit every stranger outright for the
+   *     party's life, so the holder rides the provisional admission until its
+   *     redemption verifies, then this;
+   *  4. the authorized-member set is empty — cold start: the rows that would
    *     authorize anyone arrive by replication over these very connections;
-   *  4. the peer IS an authorized member; or
-   *  5. an open invitation is OUTSTANDING — at least one unexpired,
+   *  5. the peer IS an authorized member; or
+   *  6. an open invitation is OUTSTANDING — at least one unexpired,
    *     not-fully-consumed invitation this node minted or persisted (see
    *     `StrandSolicitationService.hasOutstandingInvitation`). A formation
    *     initiator is another party's peer by design and its token is only
@@ -2344,19 +2466,19 @@ export class CadreNode implements SAppIdLookup {
    *     "does this node expect a stranger at all?". REGISTERING the responder
    *     does not count: every node registers one at {@link start}, and
    *     registering mints no invitation; or
-   *  6. a LIVE cadre invitation exists — a `CadreInvite` row this node holds
+   *  7. a LIVE cadre invitation exists — a `CadreInvite` row this node holds
    *     that is not withdrawn, unexpired, has uses left and whose issuer is
    *     still an owner (`ControlDatabase.hasLiveCadreInvite`). The device that
    *     redeems it is a stranger until the redemption writes its row, and its
    *     proof of possession is only checkable inside `/sereus/cadre-invite/1.0.0`;
-   *     same reasoning as check 5, and the same expectation-of-a-stranger key.
+   *     same reasoning as check 6, and the same expectation-of-a-stranger key.
    *
    * Ordering is semantically free (the checks are OR'd) but decides who pays:
-   * checks 1-2 are in-memory, 3/4 share one control-DB read, and only a peer
-   * that is otherwise headed for a provisional admission reaches check 5's and
-   * 6's invitation lookups.
+   * checks 1-3 are in-memory, 4/5 share one control-DB read, and only a peer
+   * that is otherwise headed for a provisional admission reaches check 6's and
+   * 7's invitation lookups.
    *
-   * Caveats of check 5:
+   * Caveats of check 6:
    *  - the in-memory mint registry dies with the process, so after a restart
    *    only invitations persisted as `FormationInvite` rows still hold the
    *    window open (re-mint otherwise);
@@ -2367,8 +2489,8 @@ export class CadreNode implements SAppIdLookup {
    * When every check falls through: `'admit-provisionally'`, on every node,
    * relay server or not. The gate sees only a peer id, so it cannot tell an
    * outsider from a device whose invitation row this node has not received yet
-   * (it redeems here by seating the row from its bundle, after which check 6
-   * admits) or from a sibling whose membership row is still replicating (check 4
+   * (it redeems here by seating the row from its bundle, after which check 7
+   * admits) or from a sibling whose membership row is still replicating (check 5
    * admits once it lands; if it has not landed by the deadline, the connection
    * is closed and either side's next reconcile dial re-forms it, since outbound
    * dials are never gated). The protocol guard refuses all of them every
@@ -2376,12 +2498,12 @@ export class CadreNode implements SAppIdLookup {
    * {@link admitControlRelayReservation} disarms the deadline (see
    * `membership-connection-gater.ts` → "The relay-reservation seam").
    *
-   * NOTE: check 3/4 runs a control-DB read per inbound connection
+   * NOTE: check 4/5 runs a control-DB read per inbound connection
    * (`listAuthorizedMembers`); connections are rare and cadres small, and this
    * layer is fail-open behind `ADMISSION_DECISION_TIMEOUT_MS`, so the live
    * read is safe here — unlike the per-stream gate, which must consult the
    * materialized {@link authorizedControlPeers} snapshot instead.
-   * NOTE: checks 5 and 6 add two more control reads (`hasOutstandingFormationInvite`,
+   * NOTE: checks 6 and 7 add two more control reads (`hasOutstandingFormationInvite`,
    * `hasLiveCadreInvite`) for a stranger with no locally minted invitation in play, on
    * every node, and a provisional connection's deadline runs the whole decision once
    * more. If stranger connections ever arrive fast enough for those reads — on arrival
@@ -2398,6 +2520,9 @@ export class CadreNode implements SAppIdLookup {
     if (this.delegateAdmission.has(remotePeerId)) {
       return 'admit';
     }
+    if (this.admittingDevices.has(remotePeerId)) {
+      return 'admit';
+    }
     const authorized = await this.listAuthorizedMembers();
     if (authorized.length === 0) {
       return 'admit';
@@ -2644,18 +2769,18 @@ export class CadreNode implements SAppIdLookup {
    *
    * The trusted-owner anchor sync ({@link syncOwnerAnchor}) runs FIRST, so the snapshot
    * built here judges `CadrePeer` rows against the anchor as the `OwnerKey` table now
-   * has it. The invitation chain both reads may need, and the tombstone list the sync and
-   * the two end-of-refresh checks ({@link hangUpRevokedControlPeers}, then
-   * {@link noteOwnRemoval}) read, are each loaded at most once per refresh.
+   * has it. The tombstone list the sync and the two end-of-refresh checks
+   * ({@link hangUpRevokedControlPeers}, then {@link noteOwnRemoval}) read is loaded at most
+   * once per refresh, as is the invitation chain the membership read may need.
    */
   private async refreshAuthorizedControlPeers(reason: string): Promise<void> {
     if (!this._running || !this.controlDatabase) {
       return;
     }
     try {
-      const loadChain = this.invitationChainSource(this.controlDatabase, false);
       const loadTombstones = this.revocationSource(this.controlDatabase, false);
-      await this.syncOwnerAnchor(reason, false, loadChain, loadTombstones);
+      await this.syncOwnerAnchor(reason, false, loadTombstones);
+      const loadChain = this.invitationChainSource(this.controlDatabase, false);
       const rows = await this.controlDatabase.queryCadrePeers(false);
       const members = this.authorizedAmong(rows, await this.chainFor(rows, loadChain));
       this.authorizedControlPeers = new Set(members.map((m) => m.peerId));
@@ -2947,14 +3072,15 @@ export class CadreNode implements SAppIdLookup {
       list: () => database().queryJoinedStrands(),
       names: async (strandId) => (await database().queryStrand(strandId)) !== null
         || (await database().queryJoinedStrand(strandId)) !== null,
-      canSign: async () => (await this.enrolledOwnerSigningKey()) !== null,
+      canSign: async () => (await this.enrolledOwnerSigner()) !== null,
       publish: async (record) => {
-        const signingKey = await this.enrolledOwnerSigningKey();
-        if (!signingKey) {
+        const signer = await this.enrolledOwnerSigner();
+        if (!signer) {
           throw new Error(`Cannot publish joined strand ${record.Id}: this machine is not an enrolled owner`);
         }
         try {
-          await database().insertJoinedStrand(record, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+          await signer.approve({ partyId: this.partyId, action: `Record the joined strand ${record.Id} for the whole cadre` },
+            (sign) => database().insertJoinedStrand(record, signer.publicKey, sign));
         } catch (error) {
           // Another machine of the party published this join first; its row wins.
           if (!isStrandIdConflict(error, 'JoinedStrand')) {
@@ -2963,9 +3089,10 @@ export class CadreNode implements SAppIdLookup {
         }
       },
       remove: async (strandId) => {
-        const signingKey = await this.enrolledOwnerSigningKey();
-        if (signingKey) {
-          return database().deleteJoinedStrand(strandId, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+        const signer = await this.enrolledOwnerSigner();
+        if (signer) {
+          return await signer.approve({ partyId: this.partyId, action: `Leave the joined strand ${strandId} for the whole cadre` },
+            (sign) => database().deleteJoinedStrand(strandId, signer.publicKey, sign));
         }
         if (await database().queryJoinedStrand(strandId)) {
           throw new Error(
@@ -2980,42 +3107,49 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * This machine's owner signing key when it can make owner-gated control writes: its seed
-   * bootstrap holds an owner key (`SeedBootstrapService.canAuthorize`) and the party's
-   * `OwnerKey` table enrolls it. A phone that ran self-genesis after another machine
-   * founded the party passes the first test and not the second (`runOwnerGenesis` in the
-   * reference apps), and a write it signed would only be refused.
+   * This machine's owner signer when it can make owner-gated control writes: one is wired
+   * ({@link useOwnerSigner}) and the party's `OwnerKey` table enrolls its key. A phone that
+   * ran self-genesis after another machine founded the party passes the first test and not
+   * the second (`runOwnerGenesis` in the reference apps), and a write it signed would only
+   * be refused.
    */
-  private async enrolledOwnerSigningKey(): Promise<Ed25519KeyPair | null> {
-    const signingKey = this.ownerSigningKeyCandidate();
-    if (!signingKey || !this.controlDatabase) {
+  private async enrolledOwnerSigner(): Promise<OwnerSigner | null> {
+    const signer = this.getOwnerSigner();
+    if (!signer || !this.controlDatabase) {
       return null;
     }
-    return (await this.controlDatabase.getOwnerKeys()).has(signingKey.publicKeyB64) ? signingKey : null;
+    return (await this.controlDatabase.getOwnerKeys()).has(signer.publicKey) ? signer : null;
   }
 
   /**
-   * Whether this node can act as an owner of its cadre: its identity key is wired as its
-   * owner signing key ({@link initializeSeedBootstrap}) and enrolled in the live `OwnerKey`
-   * set ({@link enrolledOwnerSigningKey}). What the owner-only flows (`createCadreInvitation`,
-   * `claimNode`, `rentNode`) need; false before `start()`, and on a machine that joined as a
-   * member. The reference apps' "is this device an owner" check.
+   * Whether this node can act as an owner of its cadre: an owner signer is wired
+   * ({@link useOwnerSigner}) and its key is in the live `OwnerKey` set. What the owner-only
+   * flows (`createCadreInvitation`, `claimNode`, `rentNode`) need; false before `start()`,
+   * and on a machine that joined as a member. The reference apps' "is this device an owner"
+   * check.
    */
   async isOwner(): Promise<boolean> {
-    return (await this.enrolledOwnerSigningKey()) !== null;
+    return (await this.enrolledOwnerSigner()) !== null;
   }
 
-  /** {@link enrolledOwnerSigningKey} judged against an owner set the caller has already read. */
-  private ownerSigningKeyEnrolledIn(ownerKeys: ReadonlySet<string>): Ed25519KeyPair | null {
-    const signingKey = this.ownerSigningKeyCandidate();
-    return signingKey !== null && ownerKeys.has(signingKey.publicKeyB64) ? signingKey : null;
+  /** {@link enrolledOwnerSigner} judged against an owner set the caller has already read. */
+  private ownerSignerEnrolledIn(ownerKeys: ReadonlySet<string>): OwnerSigner | null {
+    const signer = this.getOwnerSigner();
+    return signer !== null && ownerKeys.has(signer.publicKey) ? signer : null;
   }
 
-  /** This machine's identity key as an owner signing key, when its seed bootstrap is wired to sign; enrollment not yet checked. */
-  private ownerSigningKeyCandidate(): Ed25519KeyPair | null {
-    return this.seedBootstrapService?.canAuthorize() ? this.getSelfSigningKey() : null;
+  /**
+   * The owner signer {@link useOwnerSigner} wired, or null: every owner signature this node
+   * makes goes through it. Enrollment is not checked ({@link isOwner} does). A caller that
+   * makes several owner writes as one action opens one `approve` on it and hands the
+   * resulting `sign` to the methods that take one (`publishStrand`, `ensureStrandPartyKey`,
+   * `publishFormationInvite`), as `adoptStrandBundle` does.
+   */
+  getOwnerSigner(): OwnerSigner | null {
+    return this.seedBootstrapService?.ownerSigner ?? null;
   }
 
+
   /**
    * Schedule the node's initial self-record publish + ongoing refresh shortly
    * after start (non-blocking). {@link registerSelf} is idempotent and safely
@@ -3292,54 +3426,16 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Does the `Strand` row name THIS machine as its founder — i.e. is its
-   * `FounderOwnerKey` this node's own owner key (the key behind its PeerId)?
-   * A null/absent column (a consent-seated strand, or a hand-built row) and a
-   * node with no owner key both derive `false`: without a positive match this
-   * machine must attach, never bootstrap. Pure key derivation, no I/O — cheap
-   * enough for {@link launchStrand}'s tracked-instance early return.
-   *
-   * NOTE: reads "one owner key per machine" — the reference model, where the owner
-   * key IS the key behind the PeerId. Two machines running the SAME identity key
-   * would both derive `true` and each bootstrap on its own replica, which is the
-   * double-`Header` hazard this derivation exists to avoid. Unreachable today: that
-   * configuration also gives both machines one PeerId, which already breaks control
-   * networking well before any strand launches. Revisit if machines ever share an
-   * owner key while holding distinct transport identities — the derivation would
-   * then need a per-machine discriminator (the `CadrePeer` PeerId) on the row.
+   * Does the `Strand` row name THIS machine as its founder — is its `FounderPeerId` this
+   * node's peer id? A null column (a consent-seated strand, or a hand-built row) derives
+   * `false`: without a positive match this machine must attach, never bootstrap. A peer id
+   * rather than an owner key, so two machines holding one owner key never both bootstrap
+   * (the double-`Header` hazard), and a node derives it before any owner signer is wired.
+   * Pure comparison, no I/O — cheap enough for {@link launchStrand}'s tracked-instance
+   * early return.
    */
   private isSelfFoundedRow(strand: StrandRow): boolean {
-    if (strand.FounderOwnerKey == null) {
-      return false;
-    }
-    return strand.FounderOwnerKey === this.getSelfSigningKey()?.publicKeyB64;
-  }
-
-  /**
-   * The owner keypair (base64url Ed25519) derived from this node's resolved
-   * identity key. In the single-key reference model the owner signing key is
-   * *derived from* the node identity (see {@link ed25519KeyPairFromLibp2p}), so the
-   * same key material protected in a secure enclave backs both.
-   *
-   * Exposed so the hosting app retains control of owner genesis: cadre-core
-   * resolves + protects the identity, then the app sources this pair to drive
-   * `ensureOwnerKey(pub)` + `initializeSeedBootstrap(priv)` itself — cadre-core
-   * never silently runs genesis. A future separate-owner slot would return a
-   * distinct key here instead of the identity-derived one.
-   *
-   * @returns The base64url seed/public-key owner pair.
-   * @throws If called before {@link start} has resolved the identity, or when the
-   *   node runs on an ephemeral libp2p key (no `keyStore`/`privateKey` configured),
-   *   since that key is internal to libp2p and not exposed.
-   */
-  getIdentityOwnerKey(): Ed25519KeyPair {
-    if (!this.identityKey) {
-      throw new Error(
-        'getIdentityOwnerKey: node identity not resolved — call start() first, and ' +
-        'configure `keyStore` or `privateKey` (an ephemeral libp2p identity exposes no owner key)'
-      );
-    }
-    return ed25519KeyPairFromLibp2p(this.identityKey);
+    return strand.FounderPeerId !== null && strand.FounderPeerId === this.peerId?.toString();
   }
 
   /**
@@ -3860,23 +3956,14 @@ export class CadreNode implements SAppIdLookup {
       return { dialed: [] };
     }
 
-    // 2. Classify backbone (owner) members and select a bounded dial set.
-    // NOTE: deliberately the REPLICATED table, not the node-local anchor — this
-    // only *prefers* owner peers as dial targets, so pollution costs a wasted
-    // dial while anchoring would drop legitimate co-owners this node never
-    // pinned. Same call as `SeedPeer.isOwner` in seed-bootstrap.ts. Move it to
-    // the anchor if owner status here ever gates something trusted.
-    const ownerKeys = await this.controlDatabase.getOwnerKeys();
-    if (!this._running || !this.controlNode) {
-      return { dialed: [] };
-    }
+    // 2. Classify backbone (always-on) members and select a bounded dial set.
     const targetDegree = this.config.network?.controlCohort?.targetDegree
       ?? DEFAULT_CONTROL_COHORT_TARGET_DEGREE;
-    const { dials, cappedNonOwner } = selectControlCohortDials(siblings, ownerKeys, targetDegree);
-    if (cappedNonOwner > 0) {
+    const { dials, cappedNonBackbone } = selectControlCohortDials(siblings, targetDegree);
+    if (cappedNonBackbone > 0) {
       // Don't silently bound coverage — surface what the out-degree cap dropped.
-      log('reconcileControlCohort: capped %d non-owner sibling(s) at targetDegree=%d',
-        cappedNonOwner, targetDegree);
+      log('reconcileControlCohort: capped %d non-backbone sibling(s) at targetDegree=%d',
+        cappedNonBackbone, targetDegree);
     }
 
     // 3. Warm the libp2p address book with EVERY sibling's verified addresses,
@@ -4234,8 +4321,8 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Retain a just-applied seed's owner-flagged peers as cold-start bootstrap
-   * dial targets (see {@link bootstrapPeerStore}).
+   * Retain a just-applied seed's preferred peers (`SeedPeer.preferred`) as cold-start
+   * bootstrap dial targets (see {@link bootstrapPeerStore}).
    *
    * Called for every seed this node accepts, on BOTH intake paths — the
    * {@link applySeed} wrapper (which may run on a throwaway service, so the
@@ -4243,7 +4330,7 @@ export class CadreNode implements SAppIdLookup {
    * `/sereus/seed/1.0.0` handler via `onSeedApplied`. Peers with no address are
    * skipped: there is nothing to dial.
    *
-   * `isOwner` is the seed's own claim about its peers, exactly as
+   * `preferred` is the seed's own claim about its peers, exactly as
    * `SeedBootstrapService.applySeed` uses it to choose its dial targets. That is
    * sound here for the same reason it is sound there — the whole seed is
    * signature-checked against a trust-anchored signer before this runs, and the
@@ -4253,7 +4340,7 @@ export class CadreNode implements SAppIdLookup {
    */
   private recordSeedBootstrapPeers(seed: ControlNetworkSeed): void {
     for (const peer of seed.peers) {
-      if (peer.isOwner) {
+      if (peer.preferred) {
         this.retainDialTarget(peer.peerId, peer.multiaddrs, 'recordSeedBootstrapPeers');
       }
     }
@@ -4297,12 +4384,12 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * Cold-start branch of the reconcile pass: re-dial every retained out-of-band
-   * dial target (see {@link bootstrapPeerStore}) — in practice the owner peers of
-   * the seeds this node applied — while the control database still has no
+   * dial target (see {@link bootstrapPeerStore}) — in practice the preferred peers
+   * of the seeds this node applied — while the control database still has no
    * siblings to dial.
    *
-   * `SeedBootstrapService.applySeed` dials those owners exactly ONCE, best-effort.
-   * When that single dial fails — owner momentarily down, relay reservation not
+   * `SeedBootstrapService.applySeed` dials those peers exactly ONCE, best-effort.
+   * When that single dial fails — peer momentarily down, relay reservation not
    * up yet, NAT traversal lost the race — the joining node has an empty
    * `CadrePeer` table and no connection, and the steady-state pass above cannot
    * help: it dials only siblings enumerated from that very table. Retrying here
@@ -4312,9 +4399,10 @@ export class CadreNode implements SAppIdLookup {
    * gated by "the control database has no siblings", so it stops the moment the
    * node is actually in the party, and a node that is stranded MUST keep trying —
    * a give-up rule would turn a transient outage into a permanent one. The steady
-   * cost is one dial per bootstrap peer per pass (seeds nominate one or a few
-   * owners), each failing fast against an unreachable address.
-   * NOTE: if seeds ever carry many owner peers, or the reconcile cadence tightens
+   * cost is one dial per bootstrap peer per pass (a seed prefers its minter and the
+   * party's always-on machines, a few at most), each failing fast against an
+   * unreachable address.
+   * NOTE: if seeds ever carry many preferred peers, or the reconcile cadence tightens
    * well below its 15 s default, add per-peer backoff here.
    *
    * Best-effort per peer, exactly like {@link dialControlSibling}: one dead
@@ -4616,9 +4704,9 @@ export class CadreNode implements SAppIdLookup {
    */
   private async drainPendingRevocations(): Promise<void> {
     const sweep = !this.reissuedHeldRevocations;
-    // A removed machine's owner key went with its row (`removeMachine`), so the schema's
-    // live-owner clause refuses every re-issue it could sign; reconstructAuthoredMembership
-    // and drainPendingPeerWrites stop on the same test.
+    // A removed machine is no longer a member, whatever owner key it holds: the others hang up
+    // on it and refuse its control streams, so a re-issue it signs reaches no one.
+    // reconstructAuthoredMembership and drainPendingPeerWrites stop on the same test.
     if (this.removal !== null || (!sweep && this.pendingRevocations.size === 0)) {
       return;
     }
@@ -4645,8 +4733,8 @@ export class CadreNode implements SAppIdLookup {
         this.pendingRevocations.delete(row.stampId);
       }
     } catch (error) {
-      // NOTE: an owner whose key alone was removed (`removeOwner`, its machine still a member,
-      // so not a removal this node reports) keeps running these drains, and every attempt
+      // NOTE: a machine whose owner key was removed (`removeOwner`; the machine stays a member,
+      // so this is not a removal it reports) keeps running these drains, and every attempt
       // fails the schema's live-owner clause and lands here on each growth edge. Noise, not
       // harm; if it shows up, gate the drains on this node's key being a live owner.
       log('drain: revocation re-issue failed; leaving queued for next growth: %o', error);
@@ -5244,11 +5332,15 @@ export class CadreNode implements SAppIdLookup {
       this.strandAddrService = null;
     }
 
-    // Unregister the cadre invitation redemption handler, for the same reason.
+    // Unregister the two redemption handlers, for the same reason.
     if (this.cadreInviteHandler && this.controlNode) {
       await this.cadreInviteHandler.unregister(this.controlNode);
     }
     this.cadreInviteHandler = null;
+    if (this.ownerGrantHandler && this.controlNode) {
+      await this.ownerGrantHandler.unregister(this.controlNode);
+    }
+    this.ownerGrantHandler = null;
 
     // Tear down the push-wake fan-out (releases the notifier's APNs HTTP/2 session).
     if (this.pushFanoutService) {
@@ -5283,9 +5375,11 @@ export class CadreNode implements SAppIdLookup {
     // Drop delegate-admission state: the grants are scoped to the session that
     // recorded them, so a stop()/start() cycle on this object must not keep
     // admitting delegates announced under the previous one, nor carry stale
-    // announce timestamps that would suppress the next session's refresh.
+    // announce timestamps or relay refusals that would suppress the next
+    // session's announcements.
     this.delegateAdmission.clear();
     this.delegateAnnounceAt.clear();
+    this.relaysRefusingStrandAddr.clear();
 
     // Control backfill first — before the database closes and the control node
     // stops — so no NEW catch-up push is issued against a torn-down transport.
@@ -5646,7 +5740,7 @@ export class CadreNode implements SAppIdLookup {
    * `Strand` row. A joiner (the row arrived over the control network) wants exactly this; a
    * FOUNDER wants {@link foundStrand}, which publishes and attaches in one resumable call.
    * With no explicit `founder` flag, founder-ness is derived from the row's
-   * `FounderOwnerKey` (see {@link StrandConfig.founder}) — so attaching a row THIS machine
+   * `FounderPeerId` (see {@link StrandConfig.founder}) — so attaching a row THIS machine
    * published (e.g. re-attaching its own orphan after a restart) founds it, and attaching
    * anyone else's row joins, without the caller needing to know which it is.
    *
@@ -5692,7 +5786,7 @@ export class CadreNode implements SAppIdLookup {
     // A row this node offered itself came from the control table or is already a
     // remembered join, and a row this node founds is not a join, so only a joined row
     // from elsewhere can be a new join to remember. A founded row recorded here would
-    // come back after a restart with `FounderOwnerKey: null` and relaunch as a joiner.
+    // come back after a restart with null founder columns and relaunch as a joiner.
     // Captured before the backlog delete below.
     const rememberable = founder !== true && !this.discoveredStrands.has(strandRow.Id);
 
@@ -5713,7 +5807,7 @@ export class CadreNode implements SAppIdLookup {
     }
 
     // An unset `founder` is DERIVED from the row inside launchStrand (this node founds
-    // iff the row's FounderOwnerKey is its own owner key); an explicit flag wins — the
+    // iff the row's FounderPeerId is its own peer id); an explicit flag wins — the
     // formation/responder flows pass one deliberately, since their consent-seated rows
     // carry a null column. See StrandConfig.founder. Same rule for the explicit
     // partyMemberPrivateKey: it wins over the StrandPartyKey control-row read.
@@ -5736,7 +5830,7 @@ export class CadreNode implements SAppIdLookup {
       // from the row and arguments passed here — so a caller that enriched either (a
       // synthetic `MemberPrivateKey`, an explicit `founder` or `partyMemberPrivateKey`)
       // is retried with less than it asked for. Inert today: founder-ness re-derives from
-      // `FounderOwnerKey`, the party key re-reads from `StrandPartyKey`, and the row's
+      // `FounderPeerId`, the party key re-reads from `StrandPartyKey`, and the row's
       // shared `MemberPrivateKey` is read only by the founder bootstrap. If a joiner
       // launch ever starts depending on that key, gate this hand-back on the passed row
       // matching the control one.
@@ -5811,11 +5905,11 @@ export class CadreNode implements SAppIdLookup {
    * fresh publish also clears it for an OPEN strand, but is destructive for a closed one
    * (the key exists nowhere else). No app-data wipe is needed for either.
    *
-   * The insert is signed with the ed25519 key behind this node's PeerId — which
-   * {@link ed25519KeyPairFromLibp2p} also exposes as the node's owner keypair,
-   * so peer identity and owner key are one and the same. That key is also persisted on the
-   * row as `FounderOwnerKey` (the schema pins the column to the verified signer), which is
-   * what later lets any launch derive "this machine is the founder" from the row alone.
+   * The insert is signed through this node's owner signer ({@link getOwnerSigner}), in one
+   * approval with a closed strand's party-key mint. The signer's key is persisted on the row
+   * as `FounderOwnerKey` (the schema pins the column to the verified signer), and this node's
+   * peer id as `FounderPeerId` (bound into the signature), which is what later lets any
+   * launch derive "this machine is the founder" from the row alone.
    * The key must be enrolled in `OwnerKey` (e.g. via {@link ControlDatabase.ensureOwnerKey}
    * at genesis) or the schema's `Strand.AuthorizedInsert` constraint rejects the write.
    * Failing loudly here is intentional: a silently-unpublished strand would run
@@ -5831,16 +5925,18 @@ export class CadreNode implements SAppIdLookup {
    *   {@link addStrand}).
    * @param type - `'o'` for open (default) or `'c'` for closed.
    * @param memberPrivateKey - Optional shared membership (read) key for a closed strand.
+   * @param sign - The `sign` of an owner approval the caller already holds
+   *   ({@link getOwnerSigner}), so a larger action asks once; omitted, this asks for its own.
    * @returns The live `Strand` row — the one just inserted, or the matching one already
    *   there. A closed strand's caller should carry THIS row's `MemberPrivateKey` forward:
    *   on a repeat it is the stored key, not the argument.
-   * @throws if the node is not started, exposes no owner signing key, the id is blank or
+   * @throws if the node is not started, has no owner signer wired, the id is blank or
    *   unusable as a storage scope key (`InvalidStrandIdError` — see `storage-scope.ts`), a
    *   row with the same id holds different content, or the control DB rejects the
    *   (unauthorized) insert.
    */
-  async publishStrand(strandId: string, type: 'o' | 'c' = 'o', memberPrivateKey?: string): Promise<StrandRow> {
-    const signingKey = this.requireOwnerSigningKey(`publish strand ${strandId}`);
+  async publishStrand(strandId: string, type: 'o' | 'c' = 'o', memberPrivateKey?: string, sign?: OwnerSign): Promise<StrandRow> {
+    const signer = this.requireOwnerSigner(`publish strand ${strandId}`);
     // Trim/reject here so the id that lands matches the one unpublishStrand looks up: it
     // trims too, and an untrimmed row would be unreachable by the same string.
     const trimmed = requireNonBlank(strandId, 'strand id');
@@ -5849,13 +5945,14 @@ export class CadreNode implements SAppIdLookup {
     // a storage scope key would otherwise reach the whole party's control database and be
     // declined once per member. Asserted after the trim so the id checked is the id stored.
     assertStrandScopeKey(trimmed);
-    // FounderOwnerKey records THIS machine as the row's publisher (the schema pins it to
-    // the signing owner), which is what later lets a relaunch derive founder-ness.
+    // FounderPeerId records THIS machine as the founder, which is what later lets a relaunch
+    // derive founder-ness; ControlDatabase.insertStrand writes the same id (its own node's).
     const desired: StrandRow = {
       Id: trimmed,
       Type: type,
       MemberPrivateKey: memberPrivateKey ?? null,
-      FounderOwnerKey: signingKey.publicKeyB64,
+      FounderOwnerKey: signer.publicKey,
+      FounderPeerId: this.controlNode!.peerId.toString(),
     };
 
     // Read first rather than leaning on the insert's collision for BOTH readings. The
@@ -5880,19 +5977,24 @@ export class CadreNode implements SAppIdLookup {
       // is a read-only no-op and a publish interrupted between the row insert and the
       // mint heals here. A row another machine published is that machine's to mint for.
       if (type === 'c' && this.isSelfFoundedRow(matched)) {
-        await this.ensureStrandPartyKey(trimmed);
+        await this.ensureStrandPartyKey(trimmed, undefined, sign);
       }
       return matched;
     }
 
+    return await withinOwnerApproval(signer, { partyId: this.partyId, action: `Publish the strand ${trimmed} to the cadre` }, sign,
+      (approved) => this.insertStrandRow(desired, signer, approved));
+  }
+
+  /**
+   * The write half of {@link publishStrand}: insert `desired`, adopting a matching row a
+   * concurrent founder landed first, then mint a closed strand's party key, all under one
+   * owner approval's `sign`.
+   */
+  private async insertStrandRow(desired: StrandRow, signer: OwnerSigner, sign: OwnerSign): Promise<StrandRow> {
+    const { Id: trimmed, Type: type } = desired;
     try {
-      await this.controlDatabase!.insertStrand(
-        trimmed,
-        type,
-        signingKey.publicKeyB64,
-        signMessageWith(signingKey.privateKeyB64),
-        memberPrivateKey
-      );
+      await this.controlDatabase!.insertStrand(trimmed, type, signer.publicKey, sign, desired.MemberPrivateKey ?? undefined);
     } catch (error) {
       // Only the uniqueness collision is a candidate for the idempotent reading; every
       // other rejection (unauthorized signer, retired stamp) must keep surfacing.
@@ -5909,14 +6011,14 @@ export class CadreNode implements SAppIdLookup {
       log('publishStrand(%s): lost a concurrent founding race; re-read the landed row', trimmed);
       return requireMatchingStrandRow(landed, desired, 'landed concurrently from another founder');
     }
-    log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signingKey.publicKeyB64);
+    log('Published strand %s (type %s) to control DB under owner %s', trimmed, type, signer.publicKey);
     // A closed strand's publish also mints this party's own membership identity key
     // (StrandPartyKey) — the key the founder bootstrap derives Member/Manager from,
-    // deliberately distinct from the shared memberPrivateKey argument above. A failure
+    // deliberately distinct from the row's shared MemberPrivateKey read secret. A failure
     // here surfaces (the strand row has already committed, so a retried publish takes
     // the idempotent branch and heals the mint; so does the next founder launch).
     if (type === 'c') {
-      await this.ensureStrandPartyKey(trimmed);
+      await this.ensureStrandPartyKey(trimmed, undefined, sign);
     }
     return desired;
   }
@@ -5937,7 +6039,7 @@ export class CadreNode implements SAppIdLookup {
    *   attempt (as the reference apps do) would otherwise present a key that does not match
    *   the membership already seated in the strand.
    * - **instance already running** → the tracked instance is returned, and — because the
-   *   `Strand` row records its publishing machine (`FounderOwnerKey`) — a founder request
+   *   `Strand` row records its founding machine (`FounderPeerId`) — a founder request
    *   against an instance that was first launched as a joiner now runs the (idempotent,
    *   insert-if-absent) founder bootstrap on it rather than silently skipping it
    *   ({@link StrandInstanceManager.foundExistingStrand}). So a strand that something else
@@ -5946,7 +6048,7 @@ export class CadreNode implements SAppIdLookup {
    *   `resolveCohortSeed` window — still ends up with its `Strand.Header` written.
    *
    * Founder-ness is resolved FROM THE ROW, not assumed: this machine founds iff the
-   * resolved row's `FounderOwnerKey` is its own owner key. A fresh publish records this
+   * resolved row's `FounderPeerId` is its own peer id. A fresh publish records this
    * machine, so the common path founds; a machine that lost a concurrent founding race to
    * a sibling adopts the sibling's row and ATTACHES instead — deliberately, since two
    * machines bootstrapping the same strand on separate replicas is the double-`Header`
@@ -5955,20 +6057,66 @@ export class CadreNode implements SAppIdLookup {
    * `Type` is compared, not adopted: a stored row of the other type means the caller and
    * the control plane disagree about what this strand IS, so it throws.
    *
+   * **Returning after the publish.** `foundStrand(config, { background: true })` resolves
+   * once the row is published and continues the local start in
+   * {@link FoundStrandBackgroundResult.ready}, for a caller that needs only the row (an
+   * invitation reads just its id and membership key). Publish errors still reject the call
+   * itself. A joiner that redeems an invitation to a closed strand before its start finishes
+   * is refused with the retryable `host-strand-unavailable` and the token stays unspent:
+   * {@link requestJoin} retries that on its backoff, while {@link formStrand} throws it to its
+   * caller once every machine the invitation names has refused.
+   *
    * @returns The instance AND the row the strand actually runs under — read the membership
    *   key from the returned row, not from a freshly minted one ({@link FoundStrandResult}).
    * @throws if the node is not started, the id is blank, a published row of the same id has
    *   a different `Type`, or either half rejects.
    */
-  async foundStrand(config: FoundStrandConfig): Promise<FoundStrandResult> {
-    const { strandId, type = 'o', memberPrivateKey, sAppConfig, awaitFirstSync } = config;
+  foundStrand(config: FoundStrandConfig): Promise<FoundStrandResult>;
+  /**
+   * Publish the strand's row as {@link foundStrand} does, and resolve once it is published;
+   * the local start continues in {@link FoundStrandBackgroundResult.ready}.
+   *
+   * @throws as the default form does for the publish half; the start's own failure rejects
+   *   `ready` instead.
+   */
+  foundStrand(config: FoundStrandConfig, options: FoundStrandOptions): Promise<FoundStrandBackgroundResult>;
+  async foundStrand(
+    config: FoundStrandConfig,
+    options?: FoundStrandOptions
+  ): Promise<FoundStrandResult | FoundStrandBackgroundResult> {
+    const tTotal = performance.now();
+    const published = await this.publishFoundingRow(config);
+    const { strandRow, founded } = published;
+    const logTotal = () => timing(`[foundStrand:${strandRow.Id}] total: ${Math.round(performance.now() - tTotal)}ms`);
+    if (options?.background) {
+      const ready = this.attachFoundingRow(published, config);
+      // Without a handler here, a caller that only wanted the row would get an unhandled
+      // rejection. The caller still sees the rejection on `ready` itself.
+      void ready.catch((error: unknown) => {
+        log('foundStrand(%s): background start did not complete; the strand stays published: %o',
+          strandRow.Id, error);
+      });
+      logTotal();
+      return { strandRow, founded, ready };
+    }
+    const instance = await this.attachFoundingRow(published, config);
+    logTotal();
+    return { instance, strandRow, founded };
+  }
+
+  /**
+   * The publish half of {@link foundStrand}: adopt the stored row or publish a new one, and
+   * derive whether this machine founds it. Every check that can refuse the founding is here,
+   * so both forms of `foundStrand` reject on it before returning.
+   */
+  private async publishFoundingRow(config: FoundStrandConfig): Promise<Pick<FoundStrandResult, 'strandRow' | 'founded'>> {
+    const { strandId, type = 'o', memberPrivateKey } = config;
     if (!this._running || !this.controlDatabase) {
       throw new Error(`CadreNode must be started before attempting to found strand ${strandId}`);
     }
     const controlDatabase = this.controlDatabase;
     const trimmed = requireNonBlank(strandId, 'strand id');
     const timed = <T>(step: string, op: () => Promise<T>) => timedStep('foundStrand', trimmed, step, op);
-    const tTotal = performance.now();
     const published = await timed('queryStrand', () => controlDatabase.queryStrand(trimmed));
     const strandRow = published
       ? this.adoptPublishedStrand(published, type, memberPrivateKey)
@@ -5977,14 +6125,24 @@ export class CadreNode implements SAppIdLookup {
     // machine runs the bootstrap — this one must attach or it would write a second Header.
     const founded = this.isSelfFoundedRow(strandRow);
     if (!founded) {
-      log('foundStrand(%s): the stored row was published by a different machine ' +
-        '(FounderOwnerKey is not this node\'s owner key) — attaching as a joiner; ' +
-        'the founder bootstrap runs on the publishing machine', trimmed);
+      log('foundStrand(%s): the stored row names a different machine as founder ' +
+        '(FounderPeerId is not this node\'s peer id) — attaching as a joiner; ' +
+        'the founder bootstrap runs on that machine', trimmed);
     }
-    const instance = await timed('addStrand',
+    return { strandRow, founded };
+  }
+
+  /**
+   * The start half of {@link foundStrand}. Its timing lines (`addStrand: start`, then the
+   * duration or `failed after`) are logged when the start settles, also in the background
+   * form, so a start that hangs still shows as a start line with no end line.
+   */
+  private attachFoundingRow(
+    { strandRow, founded }: Pick<FoundStrandResult, 'strandRow' | 'founded'>,
+    { sAppConfig, awaitFirstSync }: FoundStrandConfig
+  ): Promise<StrandInstance> {
+    return timedStep('foundStrand', strandRow.Id, 'addStrand',
       () => this.addStrand({ strandRow, sAppConfig, founder: founded, awaitFirstSync }));
-    timing(`[foundStrand:${trimmed}] total: ${Math.round(performance.now() - tTotal)}ms`);
-    return { instance, strandRow, founded };
   }
 
   /**
@@ -6066,20 +6224,18 @@ export class CadreNode implements SAppIdLookup {
    * step, not a widening of this method.
    *
    * @param strandId - The `Strand` row id to remove (as passed to {@link publishStrand}).
-   * @throws if the node is not started, exposes no owner signing key, the id is blank, or
+   * @throws if the node is not started, has no owner signer wired, the id is blank, or
    *   the signer is not an enrolled owner (the schema's `Strand.AuthorizedDelete` rejects
    *   the write and the row survives). A rejection does NOT imply the row survived: the
    *   local stop runs after the control-plane delete has already committed, so a failure
    *   there throws over a completed removal.
    */
   async unpublishStrand(strandId: string): Promise<void> {
-    const signingKey = this.requireOwnerSigningKey(`unpublish strand ${strandId}`);
+    const signer = this.requireOwnerSigner(`unpublish strand ${strandId}`);
     const trimmed = requireNonBlank(strandId, 'strand id');
-    const removed = await this.controlDatabase!.deleteStrand(
-      trimmed,
-      signingKey.publicKeyB64,
-      signMessageWith(signingKey.privateKeyB64)
-    );
+    // One approval: the strand delete and its party key's, each with its tombstone.
+    const removed = await signer.approve({ partyId: this.partyId, action: `Remove the strand ${trimmed} from the cadre` },
+      (sign) => this.controlDatabase!.deleteStrand(trimmed, signer.publicKey, sign));
     // Gate on `removed`: the absent-row no-op wrote nothing, so warning about an
     // unreplicated deletion there would send an operator chasing a phantom.
     if (removed && this.committedAlone()) {
@@ -6122,12 +6278,12 @@ export class CadreNode implements SAppIdLookup {
     // row is already gone — there is nothing to suppress — and an id re-published before
     // the next poll's suppression cleanup would then never be offered again this session.
     // (Same reasoning as handleStrandRemoved, which also avoids stopStrand's `_running`
-    // guard; here the guard is already satisfied by requireOwnerSigningKey above.)
+    // guard; here the guard is already satisfied by requireOwnerSigner above.)
     await this.strandWatcher?.forcePoll();
     if (this.strandManager.getInstance(trimmed)) {
       await this.detachStrand(trimmed);
     }
-    log('Unpublished strand %s from control DB under owner %s', trimmed, signingKey.publicKeyB64);
+    log('Unpublished strand %s from control DB under owner %s', trimmed, signer.publicKey);
   }
 
   /**
@@ -6154,11 +6310,13 @@ export class CadreNode implements SAppIdLookup {
    *   `generateStrandMemberKey` mints). When a row already holds a DIFFERENT key this
    *   throws — a party has one identity per strand; rotation is a deliberate
    *   remove-then-insert, not a silent swap.
+   * @param sign - The `sign` of an owner approval the caller already holds; omitted, a
+   *   mint asks for its own (a stored key asks for none).
    * @returns The live party key: the one just seated, or the stored one.
    */
-  async ensureStrandPartyKey(strandId: string, partyMemberPrivateKey?: string): Promise<string> {
+  async ensureStrandPartyKey(strandId: string, partyMemberPrivateKey?: string, sign?: OwnerSign): Promise<string> {
     const trimmed = requireNonBlank(strandId, 'strand id');
-    const signingKey = this.requireOwnerSigningKey(`seat a party key for strand ${trimmed}`);
+    const signer = this.requireOwnerSigner(`seat a party key for strand ${trimmed}`);
     const existing = await this.controlDatabase!.queryStrandPartyKey(trimmed);
     if (existing !== null) {
       if (partyMemberPrivateKey !== undefined && partyMemberPrivateKey !== existing) {
@@ -6173,8 +6331,8 @@ export class CadreNode implements SAppIdLookup {
     }
     const key = partyMemberPrivateKey ?? await generateStrandMemberKey();
     try {
-      await this.controlDatabase!.insertStrandPartyKey(
-        trimmed, key, signingKey.publicKeyB64, signMessageWith(signingKey.privateKeyB64));
+      await withinOwnerApproval(signer, { partyId: this.partyId, action: `Seat this cadre's membership key for the strand ${trimmed}` }, sign,
+        (approved) => this.controlDatabase!.insertStrandPartyKey(trimmed, key, signer.publicKey, approved));
     } catch (error) {
       // The read and the insert are not atomic; a concurrent seat of the same strand's
       // key can land in between. Adopt the landed row when it satisfies this request —
@@ -6187,16 +6345,16 @@ export class CadreNode implements SAppIdLookup {
       log('ensureStrandPartyKey(%s): lost a concurrent seat race; adopting the landed key', trimmed);
       return landed;
     }
-    log('Seated strand party key for %s under owner %s', trimmed, signingKey.publicKeyB64);
+    log('Seated strand party key for %s under owner %s', trimmed, signer.publicKey);
     return key;
   }
 
   /**
    * Resolve the party membership key a closed strand's launch threads into the founder
    * bootstrap: the explicit attach-time key when given, else the party's persisted
-   * `StrandPartyKey` row, else — on the one machine whose owner key the row names as
-   * founder — a freshly minted-and-persisted key, which seats the identity for a publish
-   * that was interrupted before its mint. Everyone else resolves undefined: non-founding
+   * `StrandPartyKey` row, else — on the one machine the row names as founder (`FounderPeerId`)
+   * — a freshly minted-and-persisted key, which seats the identity for a publish that was
+   * interrupted before its mint. Everyone else resolves undefined: non-founding
    * machines never mint (no mint race between a party's machines), and only a founder
    * bootstrap needs the key at all.
    *
@@ -6226,6 +6384,9 @@ export class CadreNode implements SAppIdLookup {
     if (!this.isSelfFoundedRow(strand)) {
       return undefined;
     }
+    // NOTE: founder-ness no longer waits for the owner signer, so a founding machine's launch
+    // that runs before the embedder wires it throws here and the watcher retries on its backoff;
+    // if that shows up as restart noise, skip the heal until `getOwnerSigner()` is set.
     return await this.ensureStrandPartyKey(strand.Id);
   }
 
@@ -6241,29 +6402,26 @@ export class CadreNode implements SAppIdLookup {
    * from this row. A host minting a closed-strand invite does both (mint +
    * publish), exactly as the integration harness's `createInvitation` does.
    *
-   * Signs with the same self-owner key as {@link publishStrand} (the ed25519
-   * key behind this node's PeerId, which must be an enrolled `OwnerKey`).
-   * Throws loudly if the node isn't started or exposes no signing key.
+   * Signs through the same owner signer as {@link publishStrand}, whose key must be an
+   * enrolled `OwnerKey`. Throws loudly if the node isn't started or has no owner signer wired.
    *
    * @param token - Invitation token (the `FormationInvite` primary key); use the
    *   `token` of the {@link OpenInvitation} from {@link createOpenInvitation}.
    * @param sAppId - The sApp a redeemed strand will use.
    * @param options - Optional `expiresAtMs` (epoch ms), `totalUses`, `validationUrl`,
    *   `strandId` (bind a closed/pre-existing host strand for provision-then-record).
+   * @param sign - The `sign` of an owner approval the caller already holds; omitted, this
+   *   asks for its own.
    */
   async publishFormationInvite(
     token: string,
     sAppId: string,
-    options: { expiresAtMs?: number; totalUses?: number; validationUrl?: string; strandId?: string } = {}
+    options: { expiresAtMs?: number; totalUses?: number; validationUrl?: string; strandId?: string } = {},
+    sign?: OwnerSign
   ): Promise<void> {
-    const signingKey = this.requireOwnerSigningKey(`publish formation invite ${token}`);
-    await this.controlDatabase!.insertFormationInvite(
-      token,
-      sAppId,
-      signingKey.publicKeyB64,
-      signMessageWith(signingKey.privateKeyB64),
-      options
-    );
+    const signer = this.requireOwnerSigner(`publish formation invite ${token}`);
+    await withinOwnerApproval(signer, { partyId: this.partyId, action: `Publish an invitation to the app ${sAppId}` }, sign,
+      (approved) => this.controlDatabase!.insertFormationInvite(token, sAppId, signer.publicKey, approved, options));
     // A host may publish an invite whose token was minted elsewhere; registering
     // it locally opens the connection gate's formation exemption immediately
     // rather than waiting for the durable row to become readable.
@@ -6271,7 +6429,7 @@ export class CadreNode implements SAppIdLookup {
       token,
       options.expiresAtMs ?? Number.POSITIVE_INFINITY
     );
-    log('Published formation invite %s (sApp %s) under owner %s', token, sAppId, signingKey.publicKeyB64);
+    log('Published formation invite %s (sApp %s) under owner %s', token, sAppId, signer.publicKey);
   }
 
   /**
@@ -6282,10 +6440,10 @@ export class CadreNode implements SAppIdLookup {
    * — this is how a party says which outside approver it trusts. Without an enrollment,
    * every such invitation is unredeemable.
    *
-   * Signs with the same self-owner key as {@link publishStrand} (the ed25519 key behind
-   * this node's PeerId, which must be an enrolled `OwnerKey`). Throws loudly if the node
-   * isn't started, exposes no signing key, or the key is blank — a blank key would reach
-   * the database and fail the signature CHECK as an opaque constraint error.
+   * Signs through the same owner signer as {@link publishStrand}, whose key must be an
+   * enrolled `OwnerKey`. Throws loudly if the node isn't started, has no owner signer wired,
+   * or the key is blank — a blank key would reach the database and fail the signature CHECK
+   * as an opaque constraint error.
    *
    * Enrolling this node's OWN owner key is permitted and harmless: the domain/action tags
    * baked into each authorization digest mean an owner-key signature can never satisfy the
@@ -6300,14 +6458,11 @@ export class CadreNode implements SAppIdLookup {
    * @param key - Approver public key to enroll (base64url ed25519 public key).
    */
   async enrollValidationKey(key: string): Promise<void> {
-    const signingKey = this.requireOwnerSigningKey('enroll a validation key');
+    const signer = this.requireOwnerSigner('enroll a validation key');
     const trimmed = requireEd25519PublicKeyB64(key, 'validation key');
-    await this.controlDatabase!.insertValidationKey(
-      trimmed,
-      signingKey.publicKeyB64,
-      signMessageWith(signingKey.privateKeyB64)
-    );
-    log('Enrolled validation key %s under owner %s', trimmed, signingKey.publicKeyB64);
+    await signer.approve({ partyId: this.partyId, action: `Trust the approver key ${trimmed}` },
+      (sign) => this.controlDatabase!.insertValidationKey(trimmed, signer.publicKey, sign));
+    log('Enrolled validation key %s under owner %s', trimmed, signer.publicKey);
   }
 
   /**
@@ -6327,20 +6482,17 @@ export class CadreNode implements SAppIdLookup {
    * @param key - Approver public key to remove (base64url ed25519 public key).
    */
   async removeValidationKey(key: string): Promise<void> {
-    const signingKey = this.requireOwnerSigningKey('remove a validation key');
+    const signer = this.requireOwnerSigner('remove a validation key');
     const trimmed = requireNonBlank(key, 'validation key');
-    await this.controlDatabase!.deleteValidationKey(
-      trimmed,
-      signingKey.publicKeyB64,
-      signMessageWith(signingKey.privateKeyB64)
-    );
-    log('Removed validation key %s under owner %s', trimmed, signingKey.publicKeyB64);
+    await signer.approve({ partyId: this.partyId, action: `Stop trusting the approver key ${trimmed}` },
+      (sign) => this.controlDatabase!.deleteValidationKey(trimmed, signer.publicKey, sign));
+    log('Removed validation key %s under owner %s', trimmed, signer.publicKey);
   }
 
   /**
    * The approver keys currently enrolled, sorted. Read-only, so unlike
-   * {@link enrollValidationKey} / {@link removeValidationKey} it needs no owner signing
-   * key — only a started node.
+   * {@link enrollValidationKey} / {@link removeValidationKey} it needs no owner signer —
+   * only a started node.
    */
   async listValidationKeys(): Promise<string[]> {
     if (!this._running || !this.controlDatabase) {
@@ -6350,30 +6502,29 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Resolve the owner keypair every owner-signed control write needs — {@link publishStrand},
-   * {@link unpublishStrand}, {@link publishFormationInvite}, {@link enrollValidationKey},
-   * {@link removeValidationKey}
-   * — failing loudly in one two-part shape (not started / no signing key, naming owner
-   * genesis as the fix). Narrows `controlDatabase` for the caller: a non-null return means
+   * The owner signer every owner-signed strand write needs — {@link publishStrand},
+   * {@link unpublishStrand}, {@link ensureStrandPartyKey}, {@link publishFormationInvite},
+   * {@link enrollValidationKey}, {@link removeValidationKey} — failing loudly in one two-part
+   * shape (not started / no signer wired, naming the wiring call as the fix). Enrollment is the
+   * schema's to judge. Narrows `controlDatabase` for the caller: a return means
    * `this.controlDatabase` is non-null too.
    *
    * @param action - Infinitive phrase naming the attempted write, e.g. `'enroll a
    *   validation key'`; interpolated into both messages.
    */
-  private requireOwnerSigningKey(action: string): { privateKeyB64: string; publicKeyB64: string } {
+  private requireOwnerSigner(action: string): OwnerSigner {
     if (!this._running || !this.controlDatabase) {
       throw new Error(`CadreNode must be started before attempting to ${action}`);
     }
-    const signingKey = this.getSelfSigningKey();
-    if (!signingKey) {
+    const signer = this.getOwnerSigner();
+    if (!signer) {
       throw new Error(
-        `Cannot ${action}: no owner signing key available ` +
-        '(node identity is unavailable or does not match the node PeerId). Run owner ' +
-        'genesis (ensureOwnerKey + initializeSeedBootstrap) before writing owner-signed ' +
-        'control state.'
+        `Cannot ${action}: the owner signer is not initialized. Wire this node's owner key ` +
+        '(useOwnerSigner, or initializeSeedBootstrap for a key held in memory) before writing ' +
+        'owner-signed control state.'
       );
     }
-    return signingKey;
+    return signer;
   }
 
   /**
@@ -6383,10 +6534,10 @@ export class CadreNode implements SAppIdLookup {
    * before emitting `strand:started`.
    *
    * Founder-ness: an explicit `founder` argument wins (the formation/responder flows pass
-   * one deliberately — their consent-seated rows carry a null `FounderOwnerKey`); when
+   * one deliberately — their consent-seated rows carry a null `FounderPeerId`); when
    * unset it is DERIVED from the row, so the control-discovered path
    * (`handleStrandAdded`) and a restart's re-attach found this machine's own strands
-   * without the caller having to know. The derivation is pure key comparison — no I/O.
+   * without the caller having to know. The derivation is a pure peer-id comparison — no I/O.
    *
    * Idempotent when the strand manager already tracks `strand.Id` — the watcher
    * rediscovers a row this node already started and calls this again via
@@ -6663,10 +6814,11 @@ export class CadreNode implements SAppIdLookup {
    * receiver records an admission grant BEFORE `libp2p.start()` (re-)dials the
    * relay reservation — the gate denial there is fatal, not degraded. A
    * party-member relay answers the RPC (its control node admits us as a
-   * member); a dedicated ops/ relay does not speak the protocol and the
-   * per-peer failure comes back `unreachable` — harmless, it has no membership gate and
-   * needs no grant. The relay's direct addr rides along as the dial fallback
-   * for a relay we are not yet connected to.
+   * member); a dedicated ops/ relay does not speak the protocol, comes back
+   * `unsupported`, and is left out of later passes
+   * ({@link relaysRefusingStrandAddr}) — it has no membership gate and needs no
+   * grant. The relay's direct addr rides along as the dial fallback for a relay
+   * we are not yet connected to.
    */
   private async resolveCohortSeed(strandId: string, delegatePeerId?: string): Promise<string[]> {
     const siblings = await this.resolveSiblingSeed(strandId, delegatePeerId);
@@ -6694,16 +6846,17 @@ export class CadreNode implements SAppIdLookup {
         targets.push(relayStrandAddrPeer(relay));
       }
     }
-    const bootstrapNodes = targets.length
-      ? (await this.collectSiblingStrandAddrs(this.controlNode, targets, strandId, delegatePeerId)).addrs
-      : [];
+    if (targets.length === 0) {
+      return [];
+    }
+    const { addrs, outcomes } = await this.collectSiblingStrandAddrs(this.controlNode, targets, strandId, delegatePeerId);
     // Throttle state for the RELAY targets only — refreshDelegateGrants never
     // looks up a sibling key, so recording one would only be dead weight. The
     // siblings' refresh due times are deliberately left alone too: stamping here
     // would race the refresh pass's pruning while the strand node is still coming
     // up, and all it would save is one extra RPC per sibling on the first tick.
-    this.recordDelegateAnnounces(relays.map((r) => r.relayPeerId), strandId);
-    return bootstrapNodes;
+    this.recordDelegateAnnounces(relays.map((r) => r.relayPeerId), strandId, outcomes);
+    return addrs;
   }
 
   /**
@@ -6770,35 +6923,47 @@ export class CadreNode implements SAppIdLookup {
    * `libp2p.start()`. Kept because it costs one spread and this is the one place
    * that would silently stop announcing if that rejection is ever relaxed.
    *
+   * Less the relays remembered as refusing the strand-addr protocol
+   * ({@link relaysRefusingStrandAddr}): both callers are announcement passes, and
+   * those relays hold no grant.
+   *
    * NOTE: a relay the STRAND node discovers on its own (autorelay — in neither
    * source) gets no announcement, and a membership-gated one will deny it; fine
    * now, every realistic topology feeds one of the two sources.
    */
   private circuitRelayTargets(): CircuitRelayTarget[] {
-    return extractCircuitRelayTargets([
+    const relays = extractCircuitRelayTargets([
       ...relayCircuitAddrs(this.config.network?.relayAddrs ?? []),
       ...(this.config.network?.listenAddrs ?? []),
       ...(this.controlNode?.getMultiaddrs().map(String) ?? [])
     ]);
+    return relaysNotRefusing(relays, this.relaysRefusingStrandAddr);
   }
 
   /**
-   * Record the announce timestamps {@link refreshDelegateGrants} throttles on,
-   * for every relay a delegate-carrying announce pass dialed.
+   * Record what a delegate-carrying announce pass learned about the relays it
+   * dialed: the announce timestamps {@link refreshDelegateGrants} throttles on,
+   * and from `outcomes` which relays refuse the strand-addr protocol
+   * ({@link relaysRefusingStrandAddr}). Every announce site records through here.
    *
-   * Recorded OPTIMISTICALLY at announce time, whatever `collectStrandAddrs`
-   * reports per peer: a dedicated `ops/` relay never speaks the strand-addr
-   * protocol, so recording only on success would re-announce to it on every
-   * reconcile tick, one wasted protocol negotiation each. A failed INITIAL announce
-   * costs the strand supervisor its first attempt only (the relay denies the
+   * Timestamps are recorded OPTIMISTICALLY, whatever `collectStrandAddrs` reports
+   * per peer: recording only on success would re-announce to an unreachable relay
+   * on every reconcile tick, one dial timeout each. A failed INITIAL announce costs
+   * the strand supervisor its first attempt only (the relay denies the
    * reservation; every re-drive re-announces first through
    * {@link announceDelegateToRelay}); a failed REFRESH retries within
    * `DELEGATE_GRANT_TTL_MS / 2` (15 min), still inside the 30 min TTL.
    */
-  private recordDelegateAnnounces(relayPeerIds: readonly string[], strandId: string, now = Date.now()): void {
+  private recordDelegateAnnounces(
+    relayPeerIds: readonly string[],
+    strandId: string,
+    outcomes: ReadonlyMap<string, StrandAddrOutcome>,
+    now = Date.now()
+  ): void {
     for (const relayPeerId of relayPeerIds) {
       this.delegateAnnounceAt.set(peerStrandKey(relayPeerId, strandId), now);
     }
+    recordRelayRefusals(this.relaysRefusingStrandAddr, relayPeerIds, outcomes);
   }
 
   /**
@@ -6855,11 +7020,12 @@ export class CadreNode implements SAppIdLookup {
    * The throttle map is updated afterwards, so the periodic pass does not announce
    * again right away.
    *
-   * Against a dedicated ops relay (no strand-addr RPC) the request fails per-peer
-   * and `collectStrandAddrs` reports it `unreachable`: one wasted protocol negotiation per
-   * re-drive attempt, bounded by the supervisor's backoff. Never throws on that
-   * path; a relay addr that names no peer id is logged and skipped (the hook's
-   * caller runs the drive regardless).
+   * Unlike the other announce passes, this asks a relay remembered in
+   * {@link relaysRefusingStrandAddr} too, and its reply clears the entry — see
+   * there for why. Against a dedicated ops relay (no strand-addr RPC) that costs
+   * one refused protocol negotiation (`unsupported`) per re-drive attempt, bounded
+   * by the supervisor's backoff. Never throws on that path; a relay addr that names
+   * no peer id is logged and skipped (the hook's caller runs the drive regardless).
    *
    * NOTE: against a relay that is DOWN this hook costs up to two strand-addr
    * timeouts (dial by peer id, then by addr; 28.5 s each at the default declared link round trip)
@@ -6881,13 +7047,13 @@ export class CadreNode implements SAppIdLookup {
       log('announceDelegateToRelay: relay addr %s names no peer id; strand %s not announced', relayAddr, strandId);
       return;
     }
-    await this.collectSiblingStrandAddrs(
+    const { outcomes } = await this.collectSiblingStrandAddrs(
       controlNode,
       [{ peerId: relayPeerId, addrs: [multiaddr(relayAddr)] }],
       strandId,
       delegatePeerId
     );
-    this.recordDelegateAnnounces([relayPeerId], strandId);
+    this.recordDelegateAnnounces([relayPeerId], strandId, outcomes);
   }
 
   /** One strand's share of {@link refreshDelegateGrants}: announce to the relays whose grant is due. */
@@ -6905,8 +7071,8 @@ export class CadreNode implements SAppIdLookup {
     if (due.length === 0) {
       return;
     }
-    await this.collectSiblingStrandAddrs(controlNode, due.map(relayStrandAddrPeer), strandId, delegatePeerId);
-    this.recordDelegateAnnounces(due.map((relay) => relay.relayPeerId), strandId, now);
+    const { outcomes } = await this.collectSiblingStrandAddrs(controlNode, due.map(relayStrandAddrPeer), strandId, delegatePeerId);
+    this.recordDelegateAnnounces(due.map((relay) => relay.relayPeerId), strandId, outcomes, now);
   }
 
   /**
@@ -7824,12 +7990,19 @@ export class CadreNode implements SAppIdLookup {
   // ============================================================================
 
   /**
-   * Initialize the seed bootstrap service with an owner key.
-   * Must be called before using seed-related methods that require signing.
+   * Make `signer` this node's owner signer (`owner-signer.ts`): every owner signature the node
+   * produces from now on goes through it — seeds, vouches, removals, invitations, strand and
+   * join rows, and the background re-issues. Builds the owner-capable seed bootstrap service
+   * around it, so this must come before any of those. One signer per node; a node started
+   * with `claim` is refused (its claimant owns it).
    *
-   * @param ownerPrivateKey - The owner's private key (base64url encoded)
+   * Anchors the signer's key in the node-local trusted-owner store as `genesis`: wiring a key
+   * declares it an authority of this party.
+   *
+   * @throws when the node is not started, was started with `claim`, or already holds the
+   *   seed protocol handler (a second wiring, or {@link enableSeedListener} first).
    */
-  async initializeSeedBootstrap(ownerPrivateKey: string): Promise<void> {
+  async useOwnerSigner(signer: OwnerSigner): Promise<void> {
     if (!this.controlNode || !this.controlDatabase) {
       throw new Error('CadreNode must be started before initializing seed bootstrap');
     }
@@ -7840,9 +8013,9 @@ export class CadreNode implements SAppIdLookup {
       throw new Error('CadreNode: a node started with `claim` is owned by its claimant and cannot initialize seed bootstrap with an owner key');
     }
 
-    // A node wiring seed-bootstrap with an owner PRIVATE key is declaring that
-    // key an authority of its own party (founder genesis / self-signing owner)
-    // — anchor it in the node-local store. The in-memory set updates
+    // A node wiring an owner signer is declaring its key an authority of its own
+    // party (founder genesis / self-signing owner) — anchor it in the node-local
+    // store. The in-memory set updates
     // synchronously (see TrustedOwnerStore.trust); only the file persist is
     // fire-and-forget, logged on failure.
     // NOTE: wiring a key that is not a live owner here self-anchors a key that is
@@ -7850,11 +8023,11 @@ export class CadreNode implements SAppIdLookup {
     // it: a `genesis` entry is base, kept whether or not a live `OwnerKey` row
     // vouches it. A machine that joined by invitation reaches this only through
     // `wireOwnKeyIfOwner`, which checks the row first, so a joined non-owner never
-    // self-anchors. Three callers still wire unconditionally on every start, so a
-    // node of theirs started for a party founded elsewhere does: the phone kit's
-    // `runOwnerGenesis` (cadre-rn; only for a party its saved start does not record
-    // as joined, whose starts call `wireOwnKeyIfOwner` instead), the web reference
-    // app's start (`cadre-web.ts`) and `cadre start --owner`. Contained while the store does
+    // self-anchors. The founded-party starts (cadre-cli `start-owner.ts`, the phone
+    // kit's `runOwnerGenesis`, the web app's `cadre-web.ts`) wire a key only after
+    // inserting it as the founding row or finding it a live owner, but they judge
+    // "founding" on local rows, so one started on a store that has not synced a party
+    // founded elsewhere genesis-inserts and self-anchors its key. Contained while the store does
     // not replicate and such a node cannot mint: `createCadreInvitation` hands out
     // the anchor as the device's pins, but the `CadreInvite` insert needs a live
     // owner as issuer. If anything hands out the anchor without that check, gate
@@ -7864,25 +8037,37 @@ export class CadreNode implements SAppIdLookup {
     // identity key alone.
     if (this.trustedOwnerStore) {
       void this.trustedOwnerStore
-        .trust(ed25519PublicKeyFromPrivate(ownerPrivateKey), 'genesis')
+        .trust(signer.publicKey, 'genesis')
         .catch((error) => log('Trusted-owner genesis anchor persist failed: %o', error));
     }
 
     await this.installSeedBootstrapService(new SeedBootstrapService({
       partyId: this.config.controlNetwork.partyId,
-      ownerPrivateKey,
+      ownerSigner: signer,
       ...this.seedServiceBudgets(),
       trustPolicy: this.inboundSeedTrustPolicy(),
       // Seed trust anchors on the node-local store (seeded just above with this
       // node's own genesis key), never on the replicated OwnerKey table.
       ...(this.trustedOwnerStore ? { trustedOwners: this.trustedOwnerStore } : {}),
     }), this.controlNode, this.controlDatabase);
-    log('Seed bootstrap service initialized');
+    log('Owner signer wired (owner key %s)', signer.publicKey);
     // Embedders wire the owner key after start(), so the runner's first pass usually found
     // this machine not yet an owner; without this it would wait a full poll interval.
     this.pendingJoinRunner?.kick();
   }
 
+  /**
+   * {@link useOwnerSigner} with a software signer over `ownerPrivateKey` (`softwareOwnerSigner`):
+   * the owner key held in this process's memory. Kept as a convenience because most tests and
+   * the embedders that hold the key themselves wire it this way; one that keeps the key
+   * elsewhere wires its own signer.
+   *
+   * @param ownerPrivateKey - The owner key's 32-byte Ed25519 seed, base64url.
+   */
+  async initializeSeedBootstrap(ownerPrivateKey: string): Promise<void> {
+    await this.useOwnerSigner(softwareOwnerSigner(ownerPrivateKey));
+  }
+
   /**
    * Push the multiaddrs that future invites should advertise. Pass `null` to
    * revert to the libp2p-reported addresses (the default). The host calls this
@@ -7959,12 +8144,12 @@ export class CadreNode implements SAppIdLookup {
    * never reach here: {@link ControlDatabase.queryCadrePeers} excludes them, so a
    * revoked peer is not addressable either.
    *
-   * NOTE: answers the whole `CadrePeerRow`, past the two fields declared; the integration
+   * NOTE: answers the whole `CadrePeerRow`, past the fields declared; the integration
    * harness (`owner-cli-node.ts`, `OwnerCliMemberRow.sig`) reads `sig` off it through the admin
    * channel to tell a row another member seated from one the subject published itself. Narrow
    * this to the declared fields only together with that reader.
    */
-  async listMembers(): Promise<Array<{ peerId: string; multiaddr: string | null }>> {
+  async listMembers(): Promise<CohortPeerRow[]> {
     if (!this.controlDatabase) {
       throw new Error('CadreNode must be started before listing members');
     }
@@ -8064,7 +8249,7 @@ export class CadreNode implements SAppIdLookup {
 
   /** The invitation chain, loaded only when some row in `rows` is invitation-admitted. */
   private async chainFor(rows: readonly CadrePeerRow[], loadChain: InvitationChainSource): Promise<InvitationChain | null> {
-    return rows.some(isInvitationAdmitted) ? await loadChain() : null;
+    return rows.some(isConsentSeated) ? await loadChain() : null;
   }
 
   /**
@@ -8097,7 +8282,7 @@ export class CadreNode implements SAppIdLookup {
    * one an owner re-vouch leaves behind.
    */
   private hasAnchoredProof(row: CadrePeerVoucherFields, chain: InvitationChain | null): boolean {
-    if (!isInvitationAdmitted(row)) {
+    if (!isConsentSeated(row)) {
       return this.hasAnchoredVoucher(row);
     }
     const usage = chain?.usages.get(row.vouchUsage!);
@@ -8137,17 +8322,15 @@ export class CadreNode implements SAppIdLookup {
    * NOTE: cost per membership refresh is one `OwnerKey` read and one `Revocation` read (the
    * tombstone list, whose `OwnerKey` stamps are handed to `queryOwnerKeyRows` so it does not
    * read the retired set again, and which the hang-up of removed peers shares through
-   * `loadTombstones`), plus the invitation chain when some owner row is
-   * invitation-admitted — shared with the membership read through `loadChain`; the memo
-   * suggestion on {@link loadInvitationChain} covers that part. Before the Revocation ledger
-   * marker is filed that one read is a cohort consult per refresh, which
-   * `control-founding-consult-budget.spec.ts` pins.
+   * `loadTombstones`), plus the owner-grant chain when some owner row is grant-seated (the
+   * NOTE in the body). Before the Revocation ledger marker is filed that one read is a cohort
+   * consult per refresh, which `control-founding-consult-budget.spec.ts` pins.
    *
    * @param retry - forwarded to every read; `false` on the refresh path, for the reason on
    *   {@link refreshAuthorizedControlPeers}.
    * @param loadTombstones - the refresh's shared tombstone read ({@link revocationSource}).
    */
-  private async syncOwnerAnchor(reason: string, retry: boolean, loadChain: InvitationChainSource, loadTombstones: RevocationSource): Promise<void> {
+  private async syncOwnerAnchor(reason: string, retry: boolean, loadTombstones: RevocationSource): Promise<void> {
     const store = this.trustedOwnerStore;
     const controlDatabase = this.controlDatabase;
     if (!store || !controlDatabase) {
@@ -8162,8 +8345,11 @@ export class CadreNode implements SAppIdLookup {
       const tombstones = await loadTombstones();
       const retired = new Set(tombstones.filter(tombstone => tombstone.tableName === 'OwnerKey').map(tombstone => tombstone.stampId));
       const rows = await controlDatabase.queryOwnerKeyRows(retry, retired);
-      const chain = rows.some(isInvitationAdmitted) ? await loadChain() : null;
-      const derivation = deriveOwnerAnchor({ partyId: this.partyId, anchor: before, rows, tombstones, chain });
+      // NOTE: the grant chain is two whole-table reads per membership refresh while any owner
+      // row is grant-seated, over tables that are append-only; the memo suggested on
+      // loadInvitationChain would cover it too.
+      const grantChain = rows.some(isConsentSeated) ? await this.loadOwnerGrantChain(controlDatabase, retry) : null;
+      const derivation = deriveOwnerAnchor({ partyId: this.partyId, anchor: before, rows, tombstones, grantChain });
       if (derivation.refusedRemovals.length > 0) {
         log('syncOwnerAnchor(%s): refused %d owner removal(s) that would empty the anchor: %o', reason, derivation.refusedRemovals.length, derivation.refusedRemovals);
       }
@@ -8225,9 +8411,9 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * The usage and invitation rows {@link hasAnchoredProof} and {@link syncOwnerAnchor}
-   * resolve an invitation-admitted row through, keyed for lookup. Both reads honour `retry`
-   * for {@link listAuthorizedMembers}' reason.
+   * The usage and invitation rows {@link hasAnchoredProof} resolves an invitation-admitted
+   * `CadrePeer` row through, keyed for lookup. Both reads honour `retry` for
+   * {@link listAuthorizedMembers}' reason.
    *
    * NOTE: once invitations are the only admission route (ticket
    * `cadre-invitations-redeemable-by-any-member`), every cadre with a member not yet
@@ -8248,6 +8434,22 @@ export class CadreNode implements SAppIdLookup {
     };
   }
 
+  /**
+   * The usage and grant rows {@link syncOwnerAnchor} resolves a grant-seated `OwnerKey` row
+   * through, keyed for lookup: the owner-grant twin of {@link loadInvitationChain}, read only by
+   * the anchor sync, since a grant admits no machine.
+   */
+  private async loadOwnerGrantChain(controlDatabase: ControlDatabase, retry: boolean): Promise<OwnerGrantChain> {
+    const [usages, grants] = await Promise.all([
+      controlDatabase.queryOwnerGrantUsages(retry),
+      controlDatabase.queryOwnerGrants(retry),
+    ]);
+    return {
+      usages: new Map(usages.map(usage => [usage.usageStampId, usage])),
+      grants: new Map(grants.map(grant => [grant.key, grant])),
+    };
+  }
+
   /**
    * The owner-voucher half of {@link hasAnchoredProof}: complete voucher, `VouchOwner` in
    * the node-local anchor, signature valid over the row's (PeerId, StampId) voucher digest.
@@ -8377,11 +8579,11 @@ export class CadreNode implements SAppIdLookup {
 
   /**
    * The event callbacks every {@link SeedBootstrapService} this node owns is
-   * wired with — shared by the owner-capable service ({@link initializeSeedBootstrap})
+   * wired with — shared by the owner-capable service ({@link useOwnerSigner})
    * and the listener-only one ({@link enableSeedListener}) so the two cannot drift.
    *
    * A seed applied by the INBOUND protocol handler writes no `CadrePeer` row of
-   * its own (it merges the libp2p peer store and dials owners), so the automatic
+   * its own (it merges the libp2p peer store and dials the seed's preferred peers), so the automatic
    * write-driven refresh never fires for it — yet applying it can ANCHOR a new
    * owner key, which flips rows already present from unauthorized to authorized.
    * Hence the explicit refresh here; without it a peer the freshly anchored owner
@@ -8393,7 +8595,7 @@ export class CadreNode implements SAppIdLookup {
       onSeedApplied: (partyId, peersAdded, seed) => {
         this.emit('seed:applied', { partyId, peersAdded });
         // A wire-delivered seed never passes through the `applySeed` wrapper, so
-        // this is where its owner peers become cold-start bootstrap targets.
+        // this is where its preferred peers become cold-start bootstrap targets.
         this.recordSeedBootstrapPeers(seed);
         void this.refreshMembershipGate('seed-applied');
       },
@@ -8532,12 +8734,17 @@ export class CadreNode implements SAppIdLookup {
    * @param multiaddrs - Optional multiaddrs for the peer
    */
   async authorizePeer(peerId: string, multiaddrs?: string[]): Promise<void> {
+    await this.vouchPeer(peerId, multiaddrs);
+  }
+
+  /** {@link authorizePeer}'s body, signing inside the caller's owner approval when it passes `sign` ({@link claimNode}). */
+  private async vouchPeer(peerId: string, multiaddrs: string[] | undefined, sign?: OwnerSign): Promise<void> {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
     // The insert notifies the control DB's membership hub, so the per-stream gate
     // has already admitted the just-vouched peer by the time this resolves.
-    await this.seedBootstrapService.authorizePeer({ peerId, multiaddrs });
+    await this.seedBootstrapService.authorizePeer({ peerId, multiaddrs }, sign);
     // Queue for re-replication if this committed local-only (no connected cohort).
     this.noteControlWrite(peerId, 'authorize');
     // NOTE: unlike addDrone, `multiaddrs` is not retained as a dial target: the
@@ -8550,9 +8757,9 @@ export class CadreNode implements SAppIdLookup {
    * Remove a previously-authorized peer from the cadre.
    * Signs the peer ID with the owner key and deletes the CadrePeer row.
    *
-   * Removes the `CadrePeer` row only. The call that removes a machine completely (its owner
-   * key, its push token and the invitations it could come back through, in one transaction)
-   * is {@link removeMachine}.
+   * Removes the `CadrePeer` row only. The call that removes a machine completely (its push
+   * token and the invitations it could come back through too, in one transaction) is
+   * {@link removeMachine}.
    *
    * @param peerId - The peer ID to remove
    */
@@ -8579,89 +8786,241 @@ export class CadreNode implements SAppIdLookup {
    * `OwnerKey.Authorized`; the row stores the vouching pair). The write notifies the
    * membership hub, so the refresh it triggers has run by the time this resolves.
    *
+   * Refused while alone ({@link ownerKeyWriteAlone}): an `OwnerKey` add has no re-issue path,
+   * so one committed with no control connection would stay on this node.
+   *
    * @param ownerPublicKeyB64 - the new owner's ed25519 public key (base64url).
+   * @param options.label - the user's name for the key ("phone", "paper backup"), bound into
+   *   the signature; trimmed, at most 64 characters, blank meaning none.
    * @returns `true` when the row was seated, `false` when the key is already a live owner.
+   * @throws OwnerKeyAddRefusedError `alone`, before any write.
    */
-  async addOwner(ownerPublicKeyB64: string): Promise<boolean> {
+  async addOwner(ownerPublicKeyB64: string, options: { label?: string } = {}): Promise<boolean> {
     if (!this.seedBootstrapService) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
     const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
-    const added = await this.seedBootstrapService.addOwner(key);
-    // NOTE: an OwnerKey add committed alone is local-only and nothing re-issues it (no
-    // update branch to re-touch, unlike CadrePeer), so it is only logged;
-    // tickets/backlog/debt-owner-key-add-while-alone-has-no-reissue.md owns the fix.
+    if (await this.ownerKeyWriteAlone()) {
+      throw new OwnerKeyAddRefusedError(key, 'alone');
+    }
+    const added = await this.seedBootstrapService.addOwner(key, options.label);
+    // NOTE: the refusal is checked before the approval, and a connection can drop while the
+    // user approves; an add that still commits alone is logged. If that window ever loses an
+    // owner key in practice, re-check inside the write and roll back.
     if (added && this.committedAlone()) {
-      log('addOwner(%s) committed while ALONE (0 control connections): the new owner row is ' +
-        'local-only and is not re-issued on cohort growth, so other machines may never see it.', key);
+      log('addOwner(%s) committed while ALONE (the last control connection dropped during the add): ' +
+        'the new owner row is local-only and is not re-issued on cohort growth.', key);
     }
     return added;
   }
 
   /**
-   * Remove an owner key, signed by this node's owner key (which must be a different owner):
-   * the delete and its `Revocation` tombstone commit together. Refused by name when the key
-   * is this node's own or the only live owner. The write notifies the membership hub; the
-   * tombstone rides the committed-delete seam ({@link noteGuardedDelete}), so one committed
-   * while alone is re-issued on cohort growth like every other removal.
+   * Whether an `OwnerKey` add made now ({@link addOwner}, or the re-add of
+   * {@link removeOwner}'s re-vouch) is refused `alone`: this node holds no control connection
+   * while the party has other members. An `OwnerKey` row has no update to re-touch, so nothing
+   * re-issues it on cohort growth, and a row written now would fork this node's history. A
+   * party with no other members cannot fork, so a solo founder adding an owner key is not
+   * refused.
+   *
+   * Waits out an in-flight membership refresh first: until `start`'s first one lands the
+   * member snapshot is empty, which would read as a party with no other members.
+   */
+  private async ownerKeyWriteAlone(): Promise<boolean> {
+    await this.membershipGateDrain;
+    return this.committedAlone() && this.authorizedControlPeers.size > 0;
+  }
+
+  /**
+   * Every live owner key with its label, who vouched it, whether this node's owner signer
+   * holds it and whether this node's trusted-owner anchor trusts it ({@link CadreOwnerKey}),
+   * for an app's owner-key screen.
+   */
+  async listOwnerKeys(): Promise<CadreOwnerKey[]> {
+    if (!this.controlDatabase) {
+      throw new Error('CadreNode must be started before listing owner keys');
+    }
+    const rows = await this.controlDatabase.queryOwnerKeyRows();
+    return describeOwnerKeys(rows, this.getOwnerSigner()?.publicKey ?? null, this.trustedOwnerStore?.all() ?? new Set());
+  }
+
+  /**
+   * What {@link removeOwner} would do for `ownerPublicKeyB64`, read without writing, for an
+   * app's confirmation step ({@link OwnerKeyRemovalPlan}): whether this node may remove it,
+   * which rows the key vouched (so the app can offer to keep them by re-vouching), and how this
+   * node's own rows depend on it (`planOwnerKeyRemoval` in `owner-keys.ts`).
+   */
+  async planOwnerKeyRemoval(ownerPublicKeyB64: string): Promise<OwnerKeyRemovalPlan> {
+    if (!this.controlDatabase) {
+      throw new Error('CadreNode must be started before planning an owner key removal');
+    }
+    const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
+    return (await this.planOwnerKeyRemovalWith(this.controlDatabase, key)).plan;
+  }
+
+  /**
+   * Remove an owner key, signed by this node's owner key (which must be a different owner): the
+   * `OwnerKey` row and its `Revocation` tombstone commit together, and the tombstone rides the
+   * committed-delete seam ({@link noteGuardedDelete}), so one committed while alone is re-issued
+   * on cohort growth like every other removal. The machines the key was used on stay members;
+   * removing one is {@link removeMachine}. The owner grants the key issued stop being redeemable
+   * (the plan's `grants` names the live ones) and are not withdrawn: a tombstone over a grant
+   * nobody can redeem would add nothing.
    *
-   * Removes the `OwnerKey` row only. The call that removes a machine completely, its owner key
-   * included, is {@link removeMachine}.
+   * Steps: re-plan ({@link planOwnerKeyRemoval}) and throw {@link OwnerKeyRemovalRefusedError}
+   * on a refusal; check `options.revouch` against the plan's dependents and throw before any
+   * write when it names anything else; refuse `alone` ({@link ownerKeyWriteAlone}) when an
+   * `OwnerKey` row is to be re-vouched, since that re-add has no re-issue path; **re-vouch
+   * first**, under this node's key, the dependents the caller chose to keep and this node's own
+   * row when the key vouched it (`ControlDatabase.revouchOwnerKey`, `reauthorizePeer`), so they
+   * are never untrusted in between, and stop before the removal if one fails (re-vouches
+   * already made stay, harmlessly); then the removal. The re-vouches and the removal are one owner approval. The
+   * write notifies the membership hub, so the refresh it triggers has run by the time this
+   * resolves.
    *
    * @param ownerPublicKeyB64 - the owner's ed25519 public key (base64url).
-   * @returns `true` when the row was removed, `false` when the key is not a live owner here.
+   * @returns what was written ({@link OwnerKeyRemovalResult}).
+   * @throws {OwnerKeyRemovalRefusedError} `'not-an-owner'`, `'unknown'`, `'last-owner'`,
+   *   `'self'` or `'alone'`, before any write.
    */
-  async removeOwner(ownerPublicKeyB64: string): Promise<boolean> {
-    if (!this.seedBootstrapService) {
+  async removeOwner(ownerPublicKeyB64: string, options: RemoveOwnerOptions = {}): Promise<OwnerKeyRemovalResult> {
+    const service = this.seedBootstrapService;
+    if (!service || !this.controlDatabase) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
     const key = requireEd25519PublicKeyB64(ownerPublicKeyB64, 'owner key');
-    return await this.seedBootstrapService.removeOwner(key);
+    const { plan, rows } = await this.planOwnerKeyRemovalWith(this.controlDatabase, key);
+    if (plan.refusal !== null) {
+      throw new OwnerKeyRemovalRefusedError(key, plan.refusal);
+    }
+    const revouch = revouchWithinPlan(plan, options.revouch, this.peerId?.toString() ?? null);
+    if (revouch.owners.length > 0 && await this.ownerKeyWriteAlone()) {
+      throw new OwnerKeyRemovalRefusedError(key, 'alone');
+    }
+    // The plan already refused 'not-an-owner' when no enrolled signer is wired.
+    const signer = service.ownerSigner;
+    if (!signer) {
+      throw new OwnerKeyRemovalRefusedError(key, 'not-an-owner');
+    }
+    const action = `Remove the owner key ${namedOwnerKey(key, plan.ownerKey?.label ?? null)} from the cadre`;
+    const removed = await signer.approve({ partyId: this.partyId, action }, async (sign) => {
+      await this.revouchDependents(service, revouch, rows, sign);
+      return await service.removeOwner(key, sign);
+    });
+    log('removeOwner(%s): removed=%s revouched owners=%d peers=%d', key, removed, revouch.owners.length, revouch.peers.length);
+    return { removed, revouched: revouch };
+  }
+
+  /** {@link planOwnerKeyRemoval} with the rows it was judged from, which {@link removeOwner} re-vouches dependents by. */
+  private async planOwnerKeyRemovalWith(controlDatabase: ControlDatabase, key: string): Promise<{ plan: OwnerKeyRemovalPlan; rows: CadrePeerRow[] }> {
+    const [rows, owners, grants] = await Promise.all([
+      controlDatabase.queryCadrePeers(), controlDatabase.queryOwnerKeyRows(), controlDatabase.listOwnerGrantStatuses()
+    ]);
+    const plan = planOwnerKeyRemoval({
+      key,
+      rows,
+      owners,
+      grants,
+      selfPeerId: this.peerId?.toString() ?? null,
+      selfOwnerKey: this.ownerSignerEnrolledIn(new Set(owners.map((owner) => owner.key)))?.publicKey ?? null,
+      anchor: this.trustedOwnerStore?.all() ?? new Set(),
+    });
+    return { plan, rows };
+  }
+
+  /**
+   * The re-vouch step of {@link removeOwner}: every chosen dependent row is rebound to this
+   * node's key BEFORE the removal, so no reader ever judges it against an owner that is gone.
+   * Owners through `ControlDatabase.revouchOwnerKey` (a delete-and-re-add under a fresh stamp,
+   * the only rebinding `OwnerKey.NoUpdate` allows); peers through the owner re-touch
+   * (`reauthorizePeer`), which rewrites `VouchOwner`/`VouchSig` and clears `VouchUsage`.
+   *
+   * The peer re-touch keeps the row's `UpdatedAt` where it is. The owner branch of
+   * `CadrePeer.AuthorizedUpdate` does not require a bump, and bumping a self-published row
+   * would leave its `Sig` unverifiable, so unresolvable and unlisted as self-published, until
+   * the machine's next heartbeat (the NOTE on that constraint); the write-while-alone drain
+   * bumps because it re-issues an otherwise unchanged row, whereas here the voucher itself
+   * changes. A row never self-published carries no stamp to keep and gets the clock.
+   *
+   * A failure rethrows and stops the call before the removal; re-vouches already made stay
+   * (the row is only re-signed by a current owner) and the caller retries. An owner re-vouch
+   * is refused alone before this runs; one whose last connection drops while it runs is logged,
+   * as {@link addOwner}'s add is.
+   *
+   * NOTE: a peer re-touch committed alone is not queued, and the drain skips self-published
+   * rows anyway, so the other machines may get the removal's tombstone without the new voucher
+   * (`tickets/backlog/bug-owner-key-removal-revouch-made-alone-is-not-reissued`).
+   */
+  private async revouchDependents(
+    service: SeedBootstrapService,
+    revouch: OwnerKeyDependents,
+    rows: readonly CadrePeerRow[],
+    sign: OwnerSign,
+  ): Promise<void> {
+    for (const key of revouch.owners) {
+      await service.revouchOwner(key, sign);
+      if (this.committedAlone()) {
+        log('removeOwner: re-vouch of owner %s committed while ALONE (the last control connection dropped during the call): ' +
+          'the re-added owner row is local-only and is not re-issued on cohort growth.', key);
+      }
+    }
+    for (const dependent of revouch.peers) {
+      const row = rows.find((candidate) => candidate.peerId === dependent);
+      const updatedAt = row !== undefined && row.updatedAt > 0 ? row.updatedAt : Date.now();
+      await service.reauthorizePeer(dependent, updatedAt, sign);
+    }
   }
 
   /**
    * The cadre's machines as an app lists them ({@link CadreMachine}): one entry per live
-   * `CadrePeer` row, judged by this node's membership predicate, plus one per live `OwnerKey`
-   * whose key names a machine with no row (`describeMachines` in `machine-removal.ts`).
+   * `CadrePeer` row, judged by this node's membership predicate (`describeMachines` in
+   * `machine-removal.ts`). Owner keys are not machines; {@link listOwnerKeys} lists them.
    * Unlocked reads with the default retry.
    */
   async listMachines(): Promise<CadreMachine[]> {
     if (!this.controlDatabase) {
       throw new Error('CadreNode must be started before listing machines');
     }
-    return (await this.readMachines(this.controlDatabase)).machines;
+    return await this.readMachines(this.controlDatabase);
   }
 
   /**
    * What {@link removeMachine} would do for `peerId`, read without writing, for an app's
-   * confirmation step ({@link MachineRemovalPlan}): whether this node may remove it, whether its
-   * owner key goes with it, which rows that key vouched (so the app can offer to keep them by
-   * re-vouching), which invitations it could come back through, and whether this node's own
-   * rows depend on it (`planMachineRemoval` in `machine-removal.ts`).
+   * confirmation step ({@link MachineRemovalPlan}): whether this node may remove it and which
+   * invitations it could come back through (`planMachineRemoval` in `machine-removal.ts`).
    */
   async planMachineRemoval(peerId: string): Promise<MachineRemovalPlan> {
     if (!this.controlDatabase) {
       throw new Error('CadreNode must be started before planning a machine removal');
     }
-    return (await this.planMachineRemovalWith(this.controlDatabase, peerId)).plan;
+    const machines = await this.readMachines(this.controlDatabase);
+    const [invites, usages, owners] = await Promise.all([
+      this.controlDatabase.listCadreInviteStatuses(),
+      this.controlDatabase.queryCadreInviteUsages(),
+      this.controlDatabase.getOwnerKeys(),
+    ]);
+    return planMachineRemoval({
+      peerId,
+      machines,
+      selfPeerId: this.peerId?.toString() ?? null,
+      canSign: this.ownerSignerEnrolledIn(owners) !== null,
+      invites,
+      usages,
+    });
   }
 
   /**
    * Remove a machine from the cadre completely, signed by this node's owner key: its
-   * `CadrePeer` row, its `OwnerKey` row when its key is an owner, its `DeviceToken` row (a
-   * removed phone must not be push-woken) and a withdrawal of every live invitation it could
-   * redeem to come back, in ONE transaction ({@link ControlDatabase.removeMachine}), with a
-   * `Revocation` tombstone per row so the removal holds on every machine
-   * ("Deletes made while alone" in docs/architecture.md).
-   *
-   * Steps: re-plan ({@link planMachineRemoval}) and throw {@link MachineRemovalRefusedError} on a
-   * refusal; check `options.revouch` against the plan's dependents and throw before any write
-   * when it names anything else; **re-vouch first**, under this node's key, the dependents the
-   * caller chose to keep (`ControlDatabase.revouchOwnerKey`, `reauthorizePeer`), so they are
-   * never untrusted in between, and stop before the removal if one fails (re-vouches already
-   * made stay, harmlessly); then the removal transaction. Afterwards this node forgets the
-   * machine as a dial target, and the refresh the write notifies hangs up its control
-   * connection ({@link hangUpRevokedControlPeers}) before this resolves.
+   * `CadrePeer` row, its `DeviceToken` row (a removed phone must not be push-woken) and a
+   * withdrawal of every live invitation it could redeem to come back, in ONE transaction
+   * ({@link ControlDatabase.removeMachine}), with a `Revocation` tombstone per row so the
+   * removal holds on every machine ("Deletes made while alone" in docs/architecture.md), under
+   * one owner approval. Afterwards this node forgets the machine as a dial target, and the
+   * refresh the write notifies hangs up its control connection ({@link hangUpRevokedControlPeers})
+   * before this resolves.
+   *
+   * Owner keys stay: they are the person's, not the machine's. A lost phone that held one can
+   * still sign, a fresh machine invitation it could redeem included, so removing that key
+   * ({@link removeOwner}) is the step that locks it out.
    *
    * Not undone by this call: the machine keeps every row and strand block it already synced
    * and the party's strand member keys (`tickets/blocked/decide-removed-machine-strand-access`).
@@ -8669,28 +9028,22 @@ export class CadreNode implements SAppIdLookup {
    *
    * @returns what was written ({@link MachineRemovalResult}); all false when no live row names
    *   the machine here (already removed elsewhere).
-   * @throws {MachineRemovalRefusedError} `'not-an-owner'`, `'self'` or `'last-owner'`.
+   * @throws {MachineRemovalRefusedError} `'not-an-owner'` or `'self'`, before any write.
    */
-  async removeMachine(peerId: string, options: RemoveMachineOptions = {}): Promise<MachineRemovalResult> {
+  async removeMachine(peerId: string): Promise<MachineRemovalResult> {
     const service = this.seedBootstrapService;
     if (!service || !this.controlDatabase) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
-    const { plan, rows } = await this.planMachineRemovalWith(this.controlDatabase, peerId);
+    const plan = await this.planMachineRemoval(peerId);
     if (plan.refusal !== null) {
       throw new MachineRemovalRefusedError(peerId, plan.refusal);
     }
-    const revouch = revouchWithinPlan(plan, options.revouch);
     if (plan.machine === null) {
       log('removeMachine(%s): no live row names it here; nothing to remove', peerId);
-      return { removedPeer: false, removedOwnerKey: false, removedDeviceToken: false, withdrawnInvitations: [], revouched: { owners: [], peers: [] } };
+      return { removedPeer: false, removedDeviceToken: false, withdrawnInvitations: [] };
     }
-    await this.revouchDependents(service, revouch, rows);
-    const writes = await service.removeMachine({
-      peerId,
-      ownerKey: plan.removesOwnerKey ? plan.machine.publicKey : null,
-      inviteKeys: plan.invitations,
-    });
+    const writes = await service.removeMachine({ peerId, inviteKeys: plan.invitations });
     if (writes.removedPeer) {
       // Track + loudly flag a delete that committed local-only (security-relevant).
       this.noteControlWrite(peerId, 'remove');
@@ -8700,84 +9053,25 @@ export class CadreNode implements SAppIdLookup {
     void this.bootstrapPeerStore?.forget(peerId).catch((error: unknown) => {
       log('removeMachine: persisting the removal of dial target %s failed (forgotten in memory): %o', peerId, error);
     });
-    log('removeMachine(%s): peer=%s ownerKey=%s deviceToken=%s invitations=%d revouched owners=%d peers=%d', peerId,
-      writes.removedPeer, writes.removedOwnerKey, writes.removedDeviceToken, writes.withdrawnInvitations.length,
-      revouch.owners.length, revouch.peers.length);
-    return { ...writes, revouched: revouch };
+    log('removeMachine(%s): peer=%s deviceToken=%s invitations=%d', peerId,
+      writes.removedPeer, writes.removedDeviceToken, writes.withdrawnInvitations.length);
+    return writes;
   }
 
   /**
-   * The reads behind {@link listMachines}: the live `CadrePeer` and `OwnerKey` rows and the
-   * machines projected from them, with this node's membership predicate as the `trusted` test.
+   * The read behind {@link listMachines}: the live `CadrePeer` rows projected as machines, with
+   * this node's membership predicate as the `trusted` test.
    */
-  private async readMachines(controlDatabase: ControlDatabase): Promise<{ machines: CadreMachine[]; rows: CadrePeerRow[]; owners: OwnerKeyRow[] }> {
-    const [rows, owners] = await Promise.all([controlDatabase.queryCadrePeers(), controlDatabase.queryOwnerKeyRows()]);
+  private async readMachines(controlDatabase: ControlDatabase): Promise<CadreMachine[]> {
+    const rows = await controlDatabase.queryCadrePeers();
     const chain = await this.chainFor(rows, this.invitationChainSource(controlDatabase, true));
     const selfPeerId = this.peerId?.toString() ?? null;
-    const machines = describeMachines({
+    return describeMachines({
       partyId: this.partyId,
       selfPeerId,
       rows,
-      owners,
       trusted: (row) => row.peerId !== selfPeerId && this.hasAnchoredProof(row, chain),
     });
-    return { machines, rows, owners };
-  }
-
-  /** {@link planMachineRemoval} with the rows it was judged from, which {@link removeMachine} re-vouches dependents by. */
-  private async planMachineRemovalWith(controlDatabase: ControlDatabase, peerId: string): Promise<{ plan: MachineRemovalPlan; rows: CadrePeerRow[] }> {
-    const { machines, rows, owners } = await this.readMachines(controlDatabase);
-    const [invites, usages] = await Promise.all([controlDatabase.listCadreInviteStatuses(), controlDatabase.queryCadreInviteUsages()]);
-    const plan = planMachineRemoval({
-      peerId,
-      machines,
-      rows,
-      owners,
-      selfPeerId: this.peerId?.toString() ?? null,
-      selfOwnerKey: this.ownerSigningKeyEnrolledIn(new Set(owners.map((owner) => owner.key)))?.publicKeyB64 ?? null,
-      invites,
-      usages,
-    });
-    return { plan, rows };
-  }
-
-  /**
-   * The re-vouch step of {@link removeMachine}: every chosen dependent row is rebound to this
-   * node's key BEFORE the removal, so no reader ever judges it against an owner that is gone.
-   * Owners through `ControlDatabase.revouchOwnerKey` (a delete-and-re-add under a fresh stamp,
-   * the only rebinding `OwnerKey.NoUpdate` allows); peers through the owner re-touch
-   * (`reauthorizePeer`), which rewrites `VouchOwner`/`VouchSig` and clears `VouchUsage`.
-   *
-   * The peer re-touch keeps the row's `UpdatedAt` where it is. The owner branch of
-   * `CadrePeer.AuthorizedUpdate` does not require a bump, and bumping a self-published row
-   * would leave its `Sig` unverifiable, so unresolvable and unlisted as self-published, until
-   * the machine's next heartbeat (the NOTE on that constraint); the write-while-alone drain
-   * bumps because it re-issues an otherwise unchanged row, whereas here the voucher itself
-   * changes. A row never self-published carries no stamp to keep and gets the clock.
-   *
-   * A failure rethrows and stops the call before the removal; re-vouches already made stay
-   * (the row is only re-signed by a current owner) and the caller retries. An owner re-vouch
-   * committed alone is not re-issued on growth (the add half has no re-issue path,
-   * `tickets/backlog/debt-owner-key-add-while-alone-has-no-reissue`), so it is logged as
-   * {@link addOwner} logs it; the peer re-touches are re-issued by the existing drain.
-   */
-  private async revouchDependents(
-    service: SeedBootstrapService,
-    revouch: MachineRemovalPlan['dependents'],
-    rows: readonly CadrePeerRow[],
-  ): Promise<void> {
-    for (const key of revouch.owners) {
-      await service.revouchOwner(key);
-      if (this.committedAlone()) {
-        log('removeMachine: re-vouch of owner %s committed while ALONE (0 control connections): the re-added ' +
-          'owner row is local-only and is not re-issued on cohort growth, so other machines may never see it.', key);
-      }
-    }
-    for (const dependent of revouch.peers) {
-      const row = rows.find((candidate) => candidate.peerId === dependent);
-      const updatedAt = row !== undefined && row.updatedAt > 0 ? row.updatedAt : Date.now();
-      await service.reauthorizePeer(dependent, updatedAt);
-    }
   }
 
   /**
@@ -8845,9 +9139,9 @@ export class CadreNode implements SAppIdLookup {
   }
 
   /**
-   * Post-process an {@link applySeed} outcome: retain the seed's owner peers as
+   * Post-process an {@link applySeed} outcome: retain the seed's preferred peers as
    * cold-start bootstrap targets, and surface a seed that was accepted but whose
-   * every owner dial failed — the node is now seeded yet unconnected, and the
+   * every dial failed — the node is now seeded yet unconnected, and the
    * cold-start reconcile branch is what gets it out of that state.
    */
   private noteAppliedSeed(result: ApplySeedResult, seed: ControlNetworkSeed): void {
@@ -8855,9 +9149,9 @@ export class CadreNode implements SAppIdLookup {
       return;
     }
     this.recordSeedBootstrapPeers(seed);
-    if (result.ownerDialsAttempted > 0 && result.ownerDialsFailed === result.ownerDialsAttempted) {
-      log('applySeed: seeded but no owner reachable (%d/%d dial(s) failed) — cold-start reconcile will retry',
-        result.ownerDialsFailed, result.ownerDialsAttempted);
+    if (result.preferredDialsAttempted > 0 && result.preferredDialsFailed === result.preferredDialsAttempted) {
+      log('applySeed: seeded but no preferred peer reachable (%d/%d dial(s) failed) — cold-start reconcile will retry',
+        result.preferredDialsFailed, result.preferredDialsAttempted);
     }
   }
 
@@ -8958,9 +9252,10 @@ export class CadreNode implements SAppIdLookup {
    * vouch the node into this cadre and keep its addresses as a dial target. The owner
    * side of the claim-secret entry in the Seed Delivery Protocol (`docs/architecture.md`).
    *
-   * Requires the seed service with an owner key ({@link initializeSeedBootstrap}), as
-   * {@link addDrone} does. The order is the REVERSE of `addDrone`'s: seed first, row
-   * second. A refused claim or a failed delivery therefore leaves no `CadrePeer` row and
+   * Requires the seed service with an owner key ({@link useOwnerSigner}), as
+   * {@link addDrone} does, and like it is one owner approval (the seed and the vouch). The
+   * order is the REVERSE of `addDrone`'s: seed first, row second. A refused claim or a
+   * failed delivery therefore leaves no `CadrePeer` row and
    * no retained dial target behind on this node — a phone that typed the wrong secret,
    * or scanned a node someone else already owns, has nothing to clean up.
    *
@@ -8984,28 +9279,35 @@ export class CadreNode implements SAppIdLookup {
    * timed reconcile pass; a caller that wants to wait for the connection awaits
    * {@link reconcileControlCohort} itself, with `addDrone`'s caveat that a pass already
    * in flight is joined rather than restarted. The claimed node dials this one back too,
-   * from the seed's owner list, when this node has a listen or relay address; a phone
+   * as the seed's minter, when this node has a listen or relay address; a phone
    * with neither is reached by its own reconcile pass alone.
    *
    * @throws {ClaimRefusedError} when the node was reached and refused the claim.
    * @throws {PeerUnreachableError} when the node was never reached.
    */
   async claimNode(target: { peerId: string; multiaddrs: string[]; secret: string }): Promise<void> {
-    if (!this.seedBootstrapService) {
+    const service = this.seedBootstrapService;
+    if (!service) {
       throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
     }
     const secret = parseClaimSecret(target.secret);
-    const seed = await this.seedBootstrapService.createSeed();
-    const proof = claimProof(secret, target.peerId, seed.signerKey, seedDigest(seed));
-    const ack = await this.seedBootstrapService.deliverSeed(
-      { peerId: target.peerId, multiaddrs: target.multiaddrs }, seed, { claimProof: proof });
-    if (!ack.accepted) {
-      throw new ClaimRefusedError(target.peerId, ack.reason ?? 'no reason given', ack.code);
-    }
-    log('claimNode: %s accepted the claim; vouching it into the cadre', target.peerId);
-    // The wrapper queues the write for re-replication: a phone claiming its first
-    // always-on node has no control connection yet, so the insert commits local-only.
-    await this.authorizePeer(target.peerId, target.multiaddrs);
+    const signer = service.ownerSigner;
+    if (!signer) {
+      throw new Error('Owner key required to create seeds');
+    }
+    await signer.approve({ partyId: this.partyId, action: `Claim the node ${target.peerId} for the cadre` }, async (sign) => {
+      const seed = await service.createSeed(sign);
+      const proof = claimProof(secret, target.peerId, seed.signerKey, seedDigest(seed));
+      const ack = await service.deliverSeed(
+        { peerId: target.peerId, multiaddrs: target.multiaddrs }, seed, { claimProof: proof });
+      if (!ack.accepted) {
+        throw new ClaimRefusedError(target.peerId, ack.reason ?? 'no reason given', ack.code);
+      }
+      log('claimNode: %s accepted the claim; vouching it into the cadre', target.peerId);
+      // The wrapper queues the write for re-replication: a phone claiming its first
+      // always-on node has no control connection yet, so the insert commits local-only.
+      await this.vouchPeer(target.peerId, target.multiaddrs, sign);
+    });
     this.retainDialTarget(target.peerId, target.multiaddrs, 'claimNode');
     void this.reconcileControlCohort().catch((error) =>
       log('claimNode: reconcile kick after claiming %s failed: %o', target.peerId, error));
@@ -9058,13 +9360,13 @@ export class CadreNode implements SAppIdLookup {
   /**
    * Mint an owner-signed cadre invitation that a device can redeem at ANY member machine of
    * this party, the owner offline included ({@link redeemCadreInvitation}). Requires the
-   * owner key ({@link initializeSeedBootstrap}).
+   * owner key ({@link useOwnerSigner}).
    *
    * The invitation is an ed25519 keypair: the public half is the `CadreInvite` row's key,
-   * the private half rides in the returned bundle as the proof of possession. Whoever holds
-   * the bundle can redeem it, so an UNTARGETED, OWNER-GRANTING invitation — a bearer
-   * credential for admin rights — defaults to a 15-minute lifetime; every other kind to 24
-   * hours. One use unless `uses` says otherwise. The bundle carries the signed row (so a
+   * the private half rides in the returned bundle as the proof of possession. It admits a
+   * machine and grants nothing else (ownership is {@link createOwnerGrant}'s), so it defaults
+   * to a 24-hour lifetime ({@link CADRE_INVITATION_DEFAULT_TTL_MS}) and one use unless `uses`
+   * says otherwise. The bundle carries the signed row (so a
    * member that has not received it by replication seats it from the bundle), this node's
    * anchored owner keys — every current owner this node has verified, the out-of-band ones
    * and those derived along verifiable chains ({@link syncOwnerAnchor}) — (the device pins
@@ -9089,30 +9391,13 @@ export class CadreNode implements SAppIdLookup {
    * @throws when no owner key is wired, the anchor is empty, `uses` is not a positive
    *   integer, or neither this machine nor any other member has an address.
    */
-  async createCadreInvitation(options: CreateCadreInvitationOptions): Promise<CreateCadreInvitationResult> {
-    const service = this.seedBootstrapService;
-    if (!service?.canAuthorize()) {
-      throw new Error('Seed bootstrap service not initialized with an owner key. Call initializeSeedBootstrap() first.');
-    }
-    const ownerKeys = Array.from(this.trustedOwnerStore?.all() ?? []);
-    if (ownerKeys.length === 0) {
-      throw new Error('createCadreInvitation: this node anchors no owner key, and an invitation without owner keys cannot be verified by the device that redeems it');
-    }
-    const uses = options.uses ?? 1;
-    if (!Number.isInteger(uses) || uses < 1) {
-      throw new Error(`createCadreInvitation: uses must be a positive integer (received ${String(options.uses)})`);
-    }
-    const { members, reach } = await this.selectInvitationMembers();
-    if (members.length === 0) {
-      throw new Error('createCadreInvitation: neither this machine nor any other machine of the party has an address a device could dial');
-    }
-    const expiresInMs = options.expiresInMs
-      ?? (options.grantsOwner && !options.peerId ? OWNER_INVITATION_DEFAULT_TTL_MS : CADRE_INVITATION_DEFAULT_TTL_MS);
+  async createCadreInvitation(options: CreateCadreInvitationOptions = {}): Promise<CreateCadreInvitationResult> {
+    const { service, ownerKeys, uses, members, reach } = await this.issuedBundleParts('createCadreInvitation', options.uses);
+    const expiresInMs = options.expiresInMs ?? CADRE_INVITATION_DEFAULT_TTL_MS;
     const invitePrivateKey = generatePrivateKey('ed25519', 'base64url') as string;
     const row = await service.insertCadreInvite({
       key: ed25519PublicKeyFromPrivate(invitePrivateKey),
       peerId: options.peerId ?? null,
-      grantsOwner: options.grantsOwner,
       expiresAtMs: Date.now() + expiresInMs,
       totalUses: uses,
     });
@@ -9124,11 +9409,41 @@ export class CadreNode implements SAppIdLookup {
       ownerKeys,
       members,
     };
-    log('Cadre invitation minted: %s (peer=%s owner=%s uses=%d, %d member address(es), reach=%s)',
-      row.key, row.peerId ?? 'any', row.grantsOwner, uses, members.length, reach);
+    log('Cadre invitation minted: %s (peer=%s uses=%d, %d member address(es), reach=%s)',
+      row.key, row.peerId ?? 'any', uses, members.length, reach);
     return { invitation, encoded: encodeCadreInvitation(invitation), reach };
   }
 
+  /**
+   * What the two credentials an owner mints share ({@link createCadreInvitation},
+   * {@link createOwnerGrant}), checked in this order: the owner-capable service; the anchor's
+   * keys the holder pins (an empty anchor is refused rather than falling back to the table, since
+   * a reply could not be checked against it); the use count; and the member addresses with their
+   * reach, refused when neither this machine nor any other member has one.
+   */
+  private async issuedBundleParts(
+    caller: string,
+    uses: number | undefined
+  ): Promise<{ service: SeedBootstrapService; ownerKeys: string[]; uses: number; members: string[]; reach: CadreInvitationReach }> {
+    const service = this.seedBootstrapService;
+    if (!service?.canAuthorize()) {
+      throw new Error('Seed bootstrap service not initialized with an owner key. Call initializeSeedBootstrap() first.');
+    }
+    const ownerKeys = Array.from(this.trustedOwnerStore?.all() ?? []);
+    if (ownerKeys.length === 0) {
+      throw new Error(`${caller}: this node anchors no owner key, and a bundle without owner keys cannot be verified by the device that redeems it`);
+    }
+    const checkedUses = uses ?? 1;
+    if (!Number.isInteger(checkedUses) || checkedUses < 1) {
+      throw new Error(`${caller}: uses must be a positive integer (received ${String(uses)})`);
+    }
+    const { members, reach } = await this.selectInvitationMembers();
+    if (members.length === 0) {
+      throw new Error(`${caller}: neither this machine nor any other machine of the party has an address a device could dial`);
+    }
+    return { service, ownerKeys, uses: checkedUses, members, reach };
+  }
+
   /**
    * Every cadre invitation this node holds — minted here or replicated in — with its
    * standing ({@link CadreInviteStatus}: live, withdrawn, redemptions recorded).
@@ -9184,11 +9499,9 @@ export class CadreNode implements SAppIdLookup {
    * pass whose reply was lost answers the next as already a member. `options.onProgress`
    * reports each pass and pause.
    *
-   * When the invitation grants ownership, the member seats this node's key as an `OwnerKey`
-   * row by consent. The caller still has to wire that key for signing afterwards, with
-   * {@link wireOwnKeyIfOwner}; never `ensureOwnerKey`, the row is already there. Other
-   * machines derive this node's key into their anchors from the row's stored proof on their
-   * next membership refresh ({@link syncOwnerAnchor}).
+   * The invitation admits this node as a machine and nothing else: ownership is an owner
+   * grant ({@link redeemOwnerGrant}, {@link joinWithOwnerGrant}). A key of this node's that is
+   * already an owner here is wired afterwards with {@link wireOwnKeyIfOwner}(signer).
    *
    * Limit: the reply check ({@link verifyRedeemReply}) does not authenticate the member. A
    * forged bundle, or a legitimate one whose addresses were swapped, dials a machine that
@@ -9231,7 +9544,7 @@ export class CadreNode implements SAppIdLookup {
       ...(options.signal ? { signal: options.signal } : {}),
       ...(options.onProgress ? { onProgress: options.onProgress } : {}),
     });
-    log('Cadre invitation %s redeemed at %s (owner=%s)', invitation.invite.key, memberAddr, reply.invite.grantsOwner);
+    log('Cadre invitation %s redeemed at %s', invitation.invite.key, memberAddr);
 
     const selfPeerId = controlNode.peerId.toString();
     await mergeSeedPeers(controlNode, reply.peers.filter((peer) => peer.peerId !== selfPeerId));
@@ -9247,42 +9560,351 @@ export class CadreNode implements SAppIdLookup {
     await this.refreshMembershipGate('invitation-redeemed');
     void this.reconcileControlCohort().catch((error) =>
       log('redeemCadreInvitation: the post-redemption reconcile pass failed: %o', error));
-    return { peerId: memberPeerId, grantsOwner: reply.invite.grantsOwner, redeemedAt: new Date().toISOString() };
+    return { peerId: memberPeerId, redeemedAt: new Date().toISOString() };
   }
 
   /**
-   * If this node's identity key is a live `OwnerKey` here, wire it for signing
-   * ({@link initializeSeedBootstrap}) and return true; otherwise change nothing and return
-   * false. For a machine that joined someone else's cadre by invitation: after an
-   * owner-granting redemption, and on every later start. A redemption seats the request's
-   * `peerKey`, the key behind this node's peer id, so the identity key is the one to look for.
+   * If `signer`'s key is a live `OwnerKey` here, wire it ({@link useOwnerSigner}) and return
+   * true; otherwise change nothing and return false. For a machine that joined someone else's
+   * cadre: after an owner grant seated its key, and on every later start.
+   *
+   * Without `signer` the candidate is the signer already wired, so the call answers whether
+   * that key is still a live owner; with nothing wired it is false. The node's identity key is
+   * never a candidate: a machine's network identity is never an owner key.
    *
    * Unlike `ensureOwnerKey` it never inserts an `OwnerKey` row, so a machine that joined a
    * cadre can never genesis-insert itself into it, and a non-owner never anchors its own key.
    * An owner whose key is already wired (an earlier call) is answered true with nothing redone.
    *
    * NOTE: a node running the listener-only seed service ({@link enableSeedListener}) cannot be
-   * wired this way: libp2p takes one seed handler, and {@link initializeSeedBootstrap} would
-   * register a second. Nothing that joins by invitation enables the listener today; if one
-   * does, replace the listener here rather than beside it.
+   * wired this way: libp2p takes one seed handler, and {@link useOwnerSigner} would register a
+   * second. Nothing that joins by invitation enables the listener today; if one does, replace
+   * the listener here rather than beside it.
    *
-   * @throws when the node is not started.
+   * @throws when the node is not started, or when `signer` names a different key from the
+   *   signer already wired (one signer per node).
    */
-  async wireOwnKeyIfOwner(): Promise<boolean> {
+  async wireOwnKeyIfOwner(signer?: OwnerSigner): Promise<boolean> {
     if (!this.controlDatabase || !this._running) {
       throw new Error('CadreNode must be started before wiring its owner key');
     }
-    const signingKey = this.getSelfSigningKey();
-    if (!signingKey || !(await this.controlDatabase.getOwnerKeys()).has(signingKey.publicKeyB64)) {
-      log('wireOwnKeyIfOwner: this node\'s key is not an owner here; not wiring it');
+    const wired = this.getOwnerSigner();
+    const candidate = signer ?? wired;
+    if (!candidate || !(await this.controlDatabase.getOwnerKeys()).has(candidate.publicKey)) {
+      log('wireOwnKeyIfOwner: the candidate owner key is not an owner here; not wiring it');
       return false;
     }
-    if (!this.seedBootstrapService?.canAuthorize()) {
-      await this.initializeSeedBootstrap(signingKey.privateKeyB64);
+    if (wired === null) {
+      await this.useOwnerSigner(candidate);
+    } else if (wired.publicKey !== candidate.publicKey) {
+      throw new Error(`wireOwnKeyIfOwner: this node already has the owner key ${wired.publicKey} wired; one owner signer per node`);
+    }
+    return true;
+  }
+
+  // ============================================================================
+  // Owner Grant API (redeemable through any member, `/sereus/owner-grant/1.0.0`)
+  // ============================================================================
+
+  /**
+   * Mint an owner-signed owner grant: whoever holds the returned bundle can seat an owner key of
+   * their own through ANY member machine of this party ({@link redeemOwnerGrant}), or join the
+   * party as a machine and an owner at once ({@link joinWithOwnerGrant}), the owner that minted
+   * it offline or not. Requires the owner key ({@link useOwnerSigner}); one owner approval.
+   *
+   * The grant is an ed25519 keypair: the public half is the `OwnerGrant` row's key, the private
+   * half rides in the bundle as the proof of possession. It admits no machine and names no peer
+   * id. Whoever holds the bundle can become an owner, so it defaults to a 15-minute lifetime
+   * ({@link OWNER_GRANT_DEFAULT_TTL_MS}) and one use; `expiresInMs: null` mints a BACKUP grant
+   * with no expiry, which must be asked for explicitly and kept as carefully as an owner key.
+   * The label is the issuer's choice and goes on every key the grant seats ({@link addOwner}'s
+   * rule: trimmed, at most 64 characters, blank meaning none). The bundle carries the signed
+   * row, this node's anchored owner keys and at most six member addresses, chosen as
+   * {@link createCadreInvitation} chooses them and for the same reasons; `reach` says where a
+   * holder could redeem it once this machine is gone. A backup's addresses are those at mint
+   * time, so it can go stale if every member's address changes.
+   *
+   * @throws when no owner key is wired, the anchor is empty, `uses` is not a positive integer,
+   *   the label is over 64 characters, or neither this machine nor any other member has an address.
+   */
+  async createOwnerGrant(options: CreateOwnerGrantOptions = {}): Promise<CreateOwnerGrantResult> {
+    const { service, ownerKeys, uses, members, reach } = await this.issuedBundleParts('createOwnerGrant', options.uses);
+    const expiresInMs = options.expiresInMs === undefined ? OWNER_GRANT_DEFAULT_TTL_MS : options.expiresInMs;
+    const grantPrivateKey = generatePrivateKey('ed25519', 'base64url') as string;
+    const row = await service.insertOwnerGrant({
+      key: ed25519PublicKeyFromPrivate(grantPrivateKey),
+      label: options.label,
+      expiresAtMs: expiresInMs === null ? null : Date.now() + expiresInMs,
+      totalUses: uses,
+    });
+    const grant: OwnerGrantBundle = {
+      v: 1,
+      partyId: this.config.controlNetwork.partyId,
+      grantPrivateKey,
+      grant: row,
+      ownerKeys,
+      members,
+    };
+    log('Owner grant minted: %s (label=%s expires=%s uses=%d, %d member address(es), reach=%s)',
+      row.key, row.label ?? 'none', row.expiresAt ?? 'never', uses, members.length, reach);
+    return { grant, encoded: encodeOwnerGrant(grant), reach };
+  }
+
+  /**
+   * Every owner grant this node holds — minted here or replicated in — with its standing
+   * ({@link OwnerGrantStatus}: live, withdrawn, redemptions recorded).
+   */
+  async listOwnerGrants(): Promise<OwnerGrantStatus[]> {
+    if (!this.controlDatabase) {
+      throw new Error('CadreNode must be started before listing owner grants');
+    }
+    return await this.controlDatabase.listOwnerGrantStatuses();
+  }
+
+  /**
+   * Withdraw an owner grant: an owner-signed `Revocation` tombstone over its row, which stays as
+   * the proof behind every key it seated; those keys stay owners (removing one is
+   * {@link removeOwner}). No further redemption succeeds anywhere the tombstone reaches, and a
+   * member holding it refuses the bundle's copy of the row. A withdrawal committed while alone is
+   * re-issued on cohort growth like any other tombstone.
+   *
+   * @returns `true` when this call filed the tombstone, `false` when the row is not held here or
+   *   was already withdrawn.
+   */
+  async withdrawOwnerGrant(key: string): Promise<boolean> {
+    if (!this.seedBootstrapService) {
+      throw new Error('Seed bootstrap service not initialized. Call initializeSeedBootstrap() first.');
+    }
+    return await this.seedBootstrapService.withdrawOwnerGrant(key);
+  }
+
+  /**
+   * Become an owner of this node's party with an owner grant: seat `signer`'s key as an
+   * `OwnerKey` row by consent, with no owner online. `signer` holds the key to seat; its one
+   * `approve` names the party and says the key becomes an owner of it, and signs the `'consent'`
+   * digest. The grant's `'redeem'` signature is made with the bundle's private key in memory.
+   * A bundle for another party is refused before anything is pinned, dialed or written.
+   *
+   * Two paths, chosen by whether this node is a live member of the party ({@link isLiveMemberSelf})
+   * or an enrolled owner of it ({@link isOwner}):
+   *
+   * - **Local**, on a member machine: the grant row is seated from the bundle when absent (its
+   *   own transaction) and the redemption written in this node's own control database
+   *   (`ControlDatabase.redeemOwnerGrant`), replicating like any other write. Refused `alone`
+   *   under {@link addOwner}'s rule, before the approval: an `OwnerKey` row has no re-issue
+   *   path, so one committed with no control connection while the party has other members would
+   *   stay here; connect, then try again. A grant that is not live here (withdrawn, expired,
+   *   spent, its issuer no longer an owner) is refused before the approval too, unless the key
+   *   is already an owner. The bundle's `ownerKeys` are NOT pinned: this node judges the issuer
+   *   by its own `OwnerKey` table, and its anchor must not be widened by pasted text.
+   * - **Protocol**, otherwise (a device with no machine in the cadre; a node started in the
+   *   party on an empty store): the bundle's `ownerKeys` are pinned into the node-local anchor
+   *   (`'invite'` provenance, the pin a credential the owner handed out carries, as
+   *   {@link redeemCadreInvitation} pins), then the members the bundle names are dialed over
+   *   `/sereus/owner-grant/1.0.0` (`redeemOwnerGrantInPasses`), one signed request for every
+   *   address and every pass as {@link redeemCadreInvitation} dials, so a retry after a lost
+   *   reply is answered `alreadyOwner`. The member that accepts pushes its control store here
+   *   and writes the row with this node counted in its write cohort, so a member alone with
+   *   this node still commits. `options` are the invitation's (`waitForMember`, `signal`,
+   *   `onProgress`).
+   *
+   * Neither path wires the signer: call {@link wireOwnKeyIfOwner}(signer) afterwards — at once
+   * on the local path, and on the protocol path once the row has synced here. A key that is
+   * already a live owner is answered `alreadyOwner` with no use spent, on both paths. To join
+   * the party as a machine too, use {@link joinWithOwnerGrant}.
+   *
+   * @throws a plain `Error` for a node not started or a bundle naming another party;
+   *   {@link OwnerKeyAddRefusedError} `alone` on the local path, `OwnerGrantIssuerUnknownError`
+   *   when the issuer is not an owner here, `OwnerGrantRejectedError` `grant-spent` for a
+   *   grant no longer live here, and `OwnerGrantRejectedError` `conflict` (retryable) when the
+   *   cadre holds the grant row and this node has not synced it yet; on the protocol path
+   *   `OwnerGrantRejectedError` on a final refusal, `OwnerGrantReplyInvalidError` on an
+   *   acceptance that fails the reply check,
+   *   `OwnerGrantUnreachableError` when every address was tried (one pass only), and the
+   *   signal's reason on an abort.
+   */
+  async redeemOwnerGrant(bundle: OwnerGrantBundle, signer: OwnerSigner, options: RedeemOwnerGrantOptions = {}): Promise<RedeemOwnerGrantResult> {
+    const { controlDatabase } = this.requireStartedForGrant(bundle, 'redeeming an owner grant');
+    // An enrolled owner machine is a party machine whether or not its own row is published yet
+    // (the first self-record lands a second after start), so it writes locally too.
+    if (await this.isLiveMemberSelf() || await this.isOwner()) {
+      return await this.redeemOwnerGrantLocally(controlDatabase, bundle, signer);
+    }
+    await this.trustOwnerKeys(bundle.ownerKeys, 'invite');
+    const request = await signer.approve(ownerGrantApproval(bundle), (sign) => this.signOwnerGrantRequest(bundle, signer, sign));
+    const { reply, memberPeerId } = await this.redeemOwnerGrantAtMembers(bundle, request, options);
+    return { ownerKey: signer.publicKey, alreadyOwner: reply.alreadyOwner, memberPeerId };
+  }
+
+  /**
+   * {@link redeemOwnerGrant}'s local path: the alone refusal, the seat, the liveness refusal,
+   * then one approval around the consent signature and the write. Every refusal comes before
+   * the approval, so a prompting signer never asks for a redemption this node would refuse.
+   */
+  private async redeemOwnerGrantLocally(controlDatabase: ControlDatabase, bundle: OwnerGrantBundle, signer: OwnerSigner): Promise<RedeemOwnerGrantResult> {
+    if (await this.ownerKeyWriteAlone()) {
+      throw new OwnerKeyAddRefusedError(signer.publicKey, 'alone');
+    }
+    await refusingUnsyncedGrant(() => controlDatabase.seatOwnerGrant(bundle.grant));
+    // The write answers a key that is already an owner without reading the grant, so only a
+    // key that is not one needs the grant live (the same permissive pre-check the handler's
+    // admission uses; the write enforces every condition).
+    if (!(await controlDatabase.getOwnerKeys()).has(signer.publicKey) && !await controlDatabase.isOwnerGrantLive(bundle.grant)) {
+      throw new OwnerGrantRejectedError('grant-spent', 'The grant is expired, withdrawn, exhausted, or its issuer is no longer an owner');
+    }
+    const { alreadyOwner } = await signer.approve(ownerGrantApproval(bundle), async (sign) => {
+      const request = await this.signOwnerGrantRequest(bundle, signer, sign);
+      return await refusingUnsyncedGrant(() => controlDatabase.redeemOwnerGrant({
+        grantKey: bundle.grant.key,
+        seatedKey: signer.publicKey,
+        usageStampId: request.usageStampId,
+        grantSig: request.grantSig,
+        ownerSig: request.ownerSig,
+      }));
+    });
+    // NOTE: the refusal is checked before the approval, and a connection can drop while the user
+    // approves; a redemption that still commits alone is logged, as an add's is.
+    if (!alreadyOwner && this.committedAlone()) {
+      log('redeemOwnerGrant(%s) committed while ALONE (the last control connection dropped during the approval): ' +
+        'the new owner row is local-only and is not re-issued on cohort growth.', signer.publicKey);
+    }
+    log('Owner grant %s redeemed locally for %s (alreadyOwner=%s)', bundle.grant.key, signer.publicKey, alreadyOwner);
+    return { ownerKey: signer.publicKey, alreadyOwner, memberPeerId: null };
+  }
+
+  /**
+   * {@link redeemOwnerGrant}'s protocol path, given the signed request: dial the bundle's members
+   * in passes, then refresh the membership gate, since the rows the member pushed and wrote are
+   * judged against the pins and the anchor derives this node's key from them once its row is here.
+   */
+  private async redeemOwnerGrantAtMembers(bundle: OwnerGrantBundle, request: OwnerGrantRedeemRequest, options: RedeemOwnerGrantOptions): Promise<OwnerGrantRedemption> {
+    const pinned = new Set(bundle.ownerKeys);
+    const redemption = await redeemOwnerGrantInPasses(this.controlNode!, {
+      bundle,
+      request,
+      isTrustedIssuer: (ownerKey) => pinned.has(ownerKey),
+      linkRoundTripMs: this.config.network?.linkRoundTripMs,
+      waitForMember: options.waitForMember ?? false,
+      ...(options.signal ? { signal: options.signal } : {}),
+      ...(options.onProgress ? { onProgress: options.onProgress } : {}),
+    });
+    log('Owner grant %s redeemed at %s for %s (alreadyOwner=%s)', bundle.grant.key, redemption.memberAddr, request.ownerKey, redemption.reply.alreadyOwner);
+    await this.refreshMembershipGate('owner-grant-redeemed');
+    return redemption;
+  }
+
+  /** The signed request for `bundle` seating `signer`'s key, under an open approval's `sign`; the nonce is minted here, by the holder. */
+  private signOwnerGrantRequest(bundle: OwnerGrantBundle, signer: OwnerSigner, sign: OwnerSign): Promise<OwnerGrantRedeemRequest> {
+    return signOwnerGrantRequest(bundle, signer.publicKey, sign, generateStampId(this.controlNode!.peerId.toString()));
+  }
+
+  /**
+   * Join this node's party as a machine AND an owner with one owner grant, for a node started in
+   * the grant's party that is not a member: a fresh install recovering with a backup grant, an
+   * app joining as an owner. Needs a started node with a stable identity, as
+   * {@link redeemCadreInvitation} does, and a bundle for this party.
+   *
+   * Steps, the two signatures made under ONE approval of `signer` before any dial, so a
+   * prompting signer asks once and its prompt does not span the network:
+   *
+   * 1. {@link redeemOwnerGrant}'s protocol path: the member that accepts seats `signer`'s key.
+   * 2. A **self-invitation**: a `CadreInvite` row targeted at this node's peer id, one use, a
+   *    short expiry ({@link SELF_INVITATION_TTL_MS}), signed by `signer`
+   *    (`ControlDatabase.signCadreInvite`; never inserted here, since this store holds no
+   *    `OwnerKey` row for the issuer yet). Its bundle carries the grant's owner keys plus the
+   *    new key (the device's reply check wants the row's issuer among the pins) and the grant's
+   *    members with the member that accepted the grant first, since that member holds the new
+   *    key as a live owner and seats the row from the bundle; one the row has not reached yet
+   *    answers `issuer-unknown`, which is retryable.
+   * 3. {@link redeemCadreInvitation} with it: the member admits this node.
+   * 4. {@link wireOwnKeyIfOwner}(signer) once the `OwnerKey` row has synced here, asked every
+   *    {@link OWNER_ROW_SYNC_RECHECK_MS} up to {@link OWNER_ROW_SYNC_TIMEOUT_MS}; the result's
+   *    `ownerWired` says whether it did in time, and a later call wires it otherwise.
+   *
+   * @throws as {@link redeemOwnerGrant} (protocol path) and {@link redeemCadreInvitation} throw,
+   *   and a plain `Error` for an ephemeral identity.
+   */
+  async joinWithOwnerGrant(bundle: OwnerGrantBundle, signer: OwnerSigner, options: RedeemOwnerGrantOptions = {}): Promise<JoinWithOwnerGrantResult> {
+    const { controlNode, controlDatabase } = this.requireStartedForGrant(bundle, 'joining with an owner grant');
+    if (!this.getSelfSigningKey()) {
+      throw new Error('joinWithOwnerGrant: this node runs on an ephemeral identity; configure `keyStore` or `privateKey` so its key can sign the admission');
+    }
+    await this.trustOwnerKeys(bundle.ownerKeys, 'invite');
+    const invitePrivateKey = generatePrivateKey('ed25519', 'base64url') as string;
+    const { request, selfInvite } = await signer.approve(ownerGrantApproval(bundle, 'join'), async (sign) => ({
+      request: await this.signOwnerGrantRequest(bundle, signer, sign),
+      selfInvite: await controlDatabase.signCadreInvite({
+        key: ed25519PublicKeyFromPrivate(invitePrivateKey),
+        peerId: controlNode.peerId.toString(),
+        expiresAtMs: Date.now() + SELF_INVITATION_TTL_MS,
+        totalUses: 1,
+      }, signer.publicKey, sign),
+    }));
+    const granted = await this.redeemOwnerGrantAtMembers(bundle, request, options);
+    const selfInvitation: CadreInvitation = {
+      v: 1,
+      partyId: bundle.partyId,
+      invitePrivateKey,
+      invite: selfInvite,
+      ownerKeys: [...bundle.ownerKeys, signer.publicKey],
+      members: addressesOfFirst(bundle.members, granted.memberPeerId),
+    };
+    const joined = await this.redeemCadreInvitation(selfInvitation, options);
+    const ownerWired = await this.wireOwnKeyOnceSynced(signer);
+    log('Joined with owner grant %s: member via %s, owner key %s (wired=%s)', bundle.grant.key, joined.peerId ?? 'unnamed member', signer.publicKey, ownerWired);
+    return { peerId: joined.peerId, redeemedAt: joined.redeemedAt, ownerKey: signer.publicKey, alreadyOwner: granted.reply.alreadyOwner, ownerWired };
+  }
+
+  /**
+   * {@link wireOwnKeyIfOwner}(signer) once `signer`'s `OwnerKey` row has reached this node, asked
+   * again every {@link OWNER_ROW_SYNC_RECHECK_MS} until it has, the node stops, or
+   * {@link OWNER_ROW_SYNC_TIMEOUT_MS} passes: false then, and a later call wires it. Usually
+   * immediate: the member pushed its whole store, the row included, before the admission write.
+   */
+  private async wireOwnKeyOnceSynced(signer: OwnerSigner): Promise<boolean> {
+    const deadline = Date.now() + OWNER_ROW_SYNC_TIMEOUT_MS;
+    while (!(await this.wireOwnKeyIfOwner(signer))) {
+      if (!this._running || Date.now() >= deadline) {
+        log('wireOwnKeyOnceSynced: the OwnerKey row for %s has not reached this node yet; not wired', signer.publicKey);
+        return false;
+      }
+      await new Promise<void>((resolve) => setTimeout(resolve, OWNER_ROW_SYNC_RECHECK_MS));
     }
     return true;
   }
 
+  /**
+   * The started node's handles for a grant call, the bundle's party checked first: a grant for
+   * another party is refused before any pin, dial or write.
+   */
+  private requireStartedForGrant(bundle: OwnerGrantBundle, action: string): { controlNode: Libp2p; controlDatabase: ControlDatabase } {
+    if (!this.controlNode || !this.controlDatabase || !this._running) {
+      throw new Error(`CadreNode must be started before ${action}`);
+    }
+    if (bundle.partyId !== this.config.controlNetwork.partyId) {
+      throw new Error(`Owner grant is for party ${bundle.partyId}; this node serves ${this.config.controlNetwork.partyId}`);
+    }
+    return { controlNode: this.controlNode, controlDatabase: this.controlDatabase };
+  }
+
+  /**
+   * Is this node a live member of its party: its own `CadrePeer` row is held here and passes the
+   * membership predicate ({@link hasAnchoredProof}, judged as {@link listAuthorizedMembers}
+   * judges every other row; that listing leaves this node out)? What decides
+   * {@link redeemOwnerGrant}'s path. A machine's own row is written by its enrollment (or its
+   * first self-record, for an owner's machine), so a node on an empty store, or one holding only
+   * a store a member pushed it, is not one.
+   */
+  private async isLiveMemberSelf(): Promise<boolean> {
+    const controlDatabase = this.controlDatabase;
+    const self = this.controlNode?.peerId.toString();
+    if (!controlDatabase || self === undefined) {
+      return false;
+    }
+    const own = (await controlDatabase.queryCadrePeers()).find((row) => row.peerId === self);
+    return own !== undefined && this.hasAnchoredProof(own, await this.chainFor([own], this.invitationChainSource(controlDatabase, true)));
+  }
+
   // ============================================================================
   // Strand Solicitation API (native cadre-core formation transport)
   // ============================================================================
@@ -9522,7 +10144,7 @@ export class CadreNode implements SAppIdLookup {
    */
   async requestJoin(invitation: OpenInvitation, disclosure: StrandFormationDisclosure = {}): Promise<PendingJoinStatus> {
     const { database, runner } = this.requirePendingJoins();
-    const signer = await this.requireOwnerSigner(
+    const signer = await this.requireEnrolledOwnerSigner(
       'requestJoin needs an enrolled owner machine of this party, because the party-wide join request is ' +
       'owner-signed. formStrand(invitation, disclosure) joins once from this machine, with no retries.'
     );
@@ -9536,7 +10158,10 @@ export class CadreNode implements SAppIdLookup {
     }
     const requested = requestedPendingJoin(
       pendingJoinId(invitation.token), this.encodeInvitation(invitation), disclosure, expiresAt, now);
-    const row = await this.recordJoinRequest(database, requested, signer);
+    // The attempt below runs outside the approval: a formation can take a network timeout, and
+    // the outcome it records is the retry loop's own write.
+    const row = await signer.approve({ partyId: this.partyId, action: `Ask to join a strand of the app ${invitation.sAppId}` },
+      (sign) => this.recordJoinRequest(database, requested, signer.publicKey, sign));
     log('requestJoin: pending join %s recorded; attempting now', row.Id);
     return runner.attemptNow(row);
   }
@@ -9558,9 +10183,10 @@ export class CadreNode implements SAppIdLookup {
    */
   async dismissPendingJoin(id: string): Promise<boolean> {
     const { database, runner } = this.requirePendingJoins();
-    const { ownerKey, signMessage } = await this.requireOwnerSigner(
+    const signer = await this.requireEnrolledOwnerSigner(
       'dismissPendingJoin needs an enrolled owner machine of this party: the removal is owner-signed');
-    const removed = await database.deletePendingJoin(id, ownerKey, signMessage);
+    const removed = await signer.approve({ partyId: this.partyId, action: `Dismiss the pending join ${id}` },
+      (sign) => database.deletePendingJoin(id, signer.publicKey, sign));
     runner.forgetRow(id);
     return removed;
   }
@@ -9572,13 +10198,13 @@ export class CadreNode implements SAppIdLookup {
     return { database: this.controlDatabase, runner: this.pendingJoinRunner };
   }
 
-  /** This machine's owner key and signer for an owner-signed control write, or a throw carrying `refusal`. */
-  private async requireOwnerSigner(refusal: string): Promise<{ ownerKey: string; signMessage: (message: Uint8Array) => string }> {
-    const signingKey = await this.enrolledOwnerSigningKey();
-    if (!signingKey) {
+  /** This machine's enrolled owner signer ({@link enrolledOwnerSigner}), or a throw carrying `refusal`. */
+  private async requireEnrolledOwnerSigner(refusal: string): Promise<OwnerSigner> {
+    const signer = await this.enrolledOwnerSigner();
+    if (!signer) {
       throw new Error(refusal);
     }
-    return { ownerKey: signingKey.publicKeyB64, signMessage: signMessageWith(signingKey.privateKeyB64) };
+    return signer;
   }
 
   /**
@@ -9588,7 +10214,8 @@ export class CadreNode implements SAppIdLookup {
   private async recordJoinRequest(
     database: ControlDatabase,
     requested: JoinRequestFields,
-    { ownerKey, signMessage }: { ownerKey: string; signMessage: (message: Uint8Array) => string }
+    ownerKey: string,
+    signMessage: OwnerSign
   ): Promise<PendingJoin> {
     let written: PendingJoin;
     try {
@@ -9622,30 +10249,28 @@ export class CadreNode implements SAppIdLookup {
       }
       return this.controlDatabase;
     };
-    const outcomeSigner = (): Promise<{ ownerKey: string; signMessage: (message: Uint8Array) => string }> =>
-      this.requireOwnerSigner('Cannot record a pending join outcome: this machine is not an enrolled owner of the party');
+    // Each write is its own approval: the retry loop runs unattended.
+    const ownerWrite = async <T>(action: string, write: (ownerKey: string, sign: OwnerSign) => Promise<T>): Promise<T> => {
+      const signer = await this.requireEnrolledOwnerSigner(
+        'Cannot record a pending join outcome: this machine is not an enrolled owner of the party');
+      return await signer.approve({ partyId: this.partyId, action }, (sign) => write(signer.publicKey, sign));
+    };
     this.pendingJoinRunner = new PendingJoinRunner({
       selfId: this.controlNode!.peerId.toString(),
       linkRoundTripMs: this.config.network?.linkRoundTripMs,
-      isOwner: async () => (await this.enrolledOwnerSigningKey()) !== null,
+      isOwner: () => this.isOwner(),
       // NOTE: one owner-key read and one pending-join read (three tables) per pass (30 s); for a
       // party that never asked for a join the second reads never-written blocks, which consults
       // the cohort. If it shows up in a device profile, poll more slowly while the tables read empty.
       readRows: () => database().queryPendingJoins(),
       readRow: (id) => database().queryPendingJoin(id),
       attempt: (join) => this.formStrand(this.pendingJoinInvitation(join), parseStoredDisclosure(join)),
-      record: async (expected, outcome) => {
-        const { ownerKey, signMessage } = await outcomeSigner();
-        return database().recordJoinOutcome(expected, outcome, ownerKey, signMessage);
-      },
-      rewrite: async (expectedStampId, next) => {
-        const { ownerKey, signMessage } = await outcomeSigner();
-        return database().rewritePendingJoin(expectedStampId, next, ownerKey, signMessage);
-      },
-      remove: async (id) => {
-        const { ownerKey, signMessage } = await outcomeSigner();
-        return database().deletePendingJoin(id, ownerKey, signMessage);
-      },
+      record: (expected, outcome) => ownerWrite(`Record the outcome of the pending join ${expected.Id}`,
+        (ownerKey, sign) => database().recordJoinOutcome(expected, outcome, ownerKey, sign)),
+      rewrite: (expectedStampId, next) => ownerWrite(`Re-send the pending join ${next.Id} to the cadre`,
+        (ownerKey, sign) => database().rewritePendingJoin(expectedStampId, next, ownerKey, sign)),
+      remove: (id) => ownerWrite(`Clean up the finished pending join ${id}`,
+        (ownerKey, sign) => database().deletePendingJoin(id, ownerKey, sign)),
       isAlone: () => this.committedAlone(),
       sAppIdOf: (row) => this.pendingJoinSAppId(row),
       observeRows: (rows) => this.stageMembershipInvitesFromPendingJoins(rows),