@serfab/cadre-core 1.16.0 → 1.17.0

package/dist/control-database.d.ts

@@ -2,8 +2,8 @@ import { Database } from '@quereus/quereus';
 import type { SqlParameters } from '@quereus/quereus';
 import type { Libp2p } from '@libp2p/interface';
 import type { IRepo } from '@optimystic/db-core';
-import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, SeedPeer, MachineRemovalResult } from './types.js';
-import type { ControlTable, RevocableTable, BoundControlDomain, ControlAction, CadreInviteSignedFields } from './control-authorization.js';
+import type { StrandRow, JoinRequestRow, JoinOutcome, PendingJoin, NodeProfile, PeerAddressRecord, CadrePeerRow, OwnerKeyRow, RevocationRow, RevocationLedgerOpenResult, DeviceTokenRecord, DeviceTokenRow, CadreInviteRow, CadreInviteUsageRow, CadreInviteRedemptionResult, CadreInviteStatus, OwnerGrantRow, OwnerGrantUsageRow, OwnerGrantRedemptionResult, OwnerGrantStatus, SeedPeer, MachineRemovalResult } from './types.js';
+import type { ControlTable, RevocableTable, BoundControlDomain, ControlAction, CadreInviteSignedFields, OwnerGrantSignedFields } from './control-authorization.js';
 import type { ControlRetryAbandonment } from './control-retry.js';
 export type { ControlTable, RevocableTable, ControlDomain, ControlAction } from './control-authorization.js';
 /**
@@ -52,13 +52,14 @@ export declare class FormationAbortedError extends Error {
 /**
  * The invitation's seat budget is already spent: the count of recorded usage rows for the
  * invitation has reached its `TotalUses`, so this redemption cannot be given a seat. `token`
- * is the `FormationInvite.Token` or the `CadreInvite.Key`, whichever table the caller
- * redeemed against.
+ * is the `FormationInvite.Token`, the `CadreInvite.Key` or the `OwnerGrant.Key`, whichever
+ * table the caller redeemed against.
  *
  * Raised off the committed-count check ({@link ControlDatabase.assertSeatRemains}) ahead of
  * the write, inside {@link ControlDatabase.redeemInvitation} /
  * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
- * ({@link ControlDatabase.redeemCadreInvite}), and off the unlocked pre-check
+ * ({@link ControlDatabase.redeemCadreInvite}) and an owner grant
+ * ({@link ControlDatabase.redeemOwnerGrant}), and off the unlocked pre-check
  * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
  * pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
@@ -89,6 +90,35 @@ export declare class CadreInviteIssuerUnknownError extends Error {
         cause?: unknown;
     });
 }
+/**
+ * {@link ControlDatabase.seatOwnerGrant} was refused by `OwnerGrant.AuthorizedInsert`: the
+ * grant twin of {@link CadreInviteIssuerUnknownError}, for the same two causes (the issuer's
+ * `OwnerKey` row has not replicated here yet or has since been removed; or a tampered row).
+ * Its own class rather than a shared one so a caller that handles invitation and grant
+ * bundles can tell by `instanceof` which credential was refused.
+ */
+export declare class OwnerGrantIssuerUnknownError extends Error {
+    readonly grantKey: string;
+    readonly issuerKey: string;
+    constructor(grantKey: string, issuerKey: string, options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * An issued row (a `CadreInvite` or an `OwnerGrant`) the cadre holds that this node cannot read
+ * yet: {@link ControlDatabase.seatCadreInvite} / {@link ControlDatabase.seatOwnerGrant} had its
+ * insert refused by a cohort member already holding the row, and a refreshed read here still
+ * finds nothing; or the redemption that follows the seat finds no row. It clears once this
+ * node's store catches up, which is why the redemption paths answer it with the retryable
+ * `conflict` code.
+ */
+export declare class IssuedRowNotHereYetError extends Error {
+    readonly table: IssuedTable;
+    readonly key: string;
+    constructor(table: IssuedTable, key: string, options?: {
+        cause?: unknown;
+    });
+}
 /**
  * What a recorded `FormationUsage` row came out as.
  *
@@ -238,6 +268,73 @@ export declare function cadreInviteRedeemMessage(partyId: string, fields: CadreI
  * distinct action tag, so neither signature can stand in for the other.
  */
 export declare function cadreInviteConsentMessage(partyId: string, fields: CadreInviteRedemptionFields): Uint8Array;
+/**
+ * The exact bytes an owner signs to seat an `OwnerGrant` row — the TS mirror of the `'add'`
+ * digest in `OwnerGrant.AuthorizedInsert`, over the whole row in the schema's order with
+ * nullable columns as `''` (`ownerGrantRowFields`, shared with the base64url verifier
+ * `peer-authorization.ts`'s `ownerGrantAddDigest`). `expiresAt` must already be the stored
+ * canonical `datetime` string, as {@link ControlDatabase.insertOwnerGrant} produces it, for
+ * the reason on {@link cadreInviteAddMessage}.
+ */
+export declare function ownerGrantAddMessage(partyId: string, row: OwnerGrantSignedFields): Uint8Array;
+/** The fields both owner-grant redemption signatures cover; see {@link ownerGrantRedeemMessage}. */
+export interface OwnerGrantRedemptionFields {
+    grantKey: string;
+    /** The single-use nonce the holder minted for this redemption (`generateStampId`). */
+    usageStampId: string;
+    /** The owner key being seated (base64url ed25519). */
+    seatedKey: string;
+}
+/**
+ * The exact bytes the HOLDER of an owner grant signs, with the grant's private key, to redeem
+ * it once — the TS mirror of the `'redeem'` digest `OwnerGrantUsage.GrantPossessed` verifies
+ * against the grant's public key. Binding the seated key and the nonce means a captured
+ * redemption can seat no other key and spend no other use.
+ */
+export declare function ownerGrantRedeemMessage(partyId: string, fields: OwnerGrantRedemptionFields): Uint8Array;
+/**
+ * The exact bytes the SEATED key signs, proving the holder holds it — the TS mirror of the
+ * `'consent'` digest `OwnerGrantUsage.OwnerConsented` verifies against `SeatedKey`. Same
+ * fields as {@link ownerGrantRedeemMessage} under a distinct action tag, so neither
+ * signature can stand in for the other.
+ */
+export declare function ownerGrantConsentMessage(partyId: string, fields: OwnerGrantRedemptionFields): Uint8Array;
+/**
+ * A guarded table of owner-issued credentials: signed rows that travel inside a bundle, are
+ * seated verbatim by any member ({@link ControlDatabase.seatCadreInvite},
+ * {@link ControlDatabase.seatOwnerGrant}), and are never deleted (`NoDelete`) because the
+ * rows they admitted prove themselves through them. Withdrawing one is a tombstone alone
+ * ({@link ControlDatabase.withdrawCadreInvite}, {@link ControlDatabase.withdrawOwnerGrant}).
+ */
+type IssuedTable = Extract<RevocableTable, 'CadreInvite' | 'OwnerGrant'>;
+/**
+ * An owner key's label as its row stores it: trimmed, a blank one left out, and refused past
+ * {@link OWNER_KEY_MAX_LABEL} by name rather than by the schema's `LabelLength` check.
+ * Idempotent, so a caller that checks before opening an owner approval can pass the result on.
+ */
+export declare function ownerKeyLabel(label: string | null | undefined): string | null;
+/**
+ * Signs one owner digest's raw bytes (no pre-hash) and returns a base64url Ed25519 signature:
+ * the callback every owner-signed writer takes. An `OwnerSign` from an open
+ * `OwnerSigner.approve` fits it, and so does a synchronous signer.
+ *
+ * NOTE: writers that read the stamp they sign do so inside the write lock, so the lock is held
+ * across these calls, and a `lockedWithRetry` re-run signs again inside the same approval.
+ * Free for a software signer. If a prompting signer ever holds the lock long enough to stall
+ * other control writes, sign outside the lock and re-check the stamp inside it.
+ */
+export type ControlSign = (message: Uint8Array) => string | Promise<string>;
+/** What an owner asks {@link ControlDatabase.insertCadreInvite} (or {@link ControlDatabase.signCadreInvite}) to sign. */
+export interface CadreInviteFields {
+    /** The invitation public key (base64url ed25519), the row's primary key. */
+    key: string;
+    /** The device the invitation is for, or null for whoever redeems first. */
+    peerId?: string | null;
+    /** Epoch ms after which it cannot be redeemed; omit for never. */
+    expiresAtMs?: number | null;
+    /** How many redemptions it allows; omit for unlimited. */
+    totalUses?: number | null;
+}
 /** The control tables keyed by a strand id whose repeat insert a caller may treat as idempotent. */
 type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
 /**
@@ -256,6 +353,13 @@ type StrandIdTable = Extract<RevocableTable, 'Strand' | 'JoinedStrand'>;
  * reword reddens there.
  */
 export declare function isStrandIdConflict(error: unknown, table: StrandIdTable): boolean;
+/**
+ * Did a seat of an issued row fail because a cohort member already holds a row under its key?
+ * {@link ControlDatabase.seatCadreInvite} / {@link ControlDatabase.seatOwnerGrant} reach this
+ * on a node whose store lags the cohort: its guard read missed the row, and the member that
+ * checked the commit refused the insert. Text-matched, failing closed, like {@link isStrandIdConflict}.
+ */
+export declare function isIssuedRowKeyConflict(error: unknown, table: IssuedTable): boolean;
 /**
  * Did {@link ControlDatabase.insertJoinRequest} fail because the party already holds a
  * `JoinRequest` row for this invitation? The caller adopts the existing request instead.
@@ -299,22 +403,17 @@ export declare const REVOCATION_LEDGER_MARKER: {
 };
 /**
  * Project `CadrePeer` rows into the {@link SeedPeer} list a seed, or a cadre invitation
- * redemption reply, carries.
+ * redemption reply, carries. `minterPeerId` is the machine minting the seed or answering the
+ * redemption; it contributes an entry only through its own `CadrePeer` row.
  *
- * Owner identity is sourced from the `OwnerKey` table, not from the transport peer id. An
- * Ed25519 libp2p peer id embeds its public key (identity multihash), so each peer's ed25519
- * key is derivable from its `PeerId`; a peer is an owner iff that derived key is in
- * `ownerKeys`. This makes any owner node markable — not just the local one. A non-Ed25519
- * or unparsable id yields a non-owner rather than failing the whole projection.
- *
- * NOTE: this is the one owner lookup deliberately left on the REPLICATED table rather than
- * the node-local anchor. `SeedPeer.isOwner` is a dial hint — the receiver dials owner-flagged
- * peers first — not a trust decision, and the receiver re-derives real trust from its own
- * anchor. So a polluted table costs at most a wasted dial, while anchoring here would
- * silently drop legitimate co-owners this node never pinned. If `isOwner` ever gates
- * anything the receiver TRUSTS, move it to the anchor.
+ * A peer is `preferred` when it is the minter, the one machine certain to be reachable by the
+ * receiver at that moment, since it is delivering the seed or the reply, or an always-on
+ * machine (`Profile = 'storage'`), the ones that stay dialable. Preference is a dial hint and
+ * reads no `OwnerKey` row: owner keys are not machines, and a receiver derives trust from its
+ * own anchor, never from this list. A `Profile` is self-declared and not checked here, so a
+ * machine misdeclaring one costs the receiver a wasted dial at most.
  */
-export declare function projectSeedPeers(rows: readonly CadrePeerRow[], ownerKeys: ReadonlySet<string>): SeedPeer[];
+export declare function projectSeedPeers(rows: readonly CadrePeerRow[], minterPeerId: string): SeedPeer[];
 /**
  * Guarded tables a node may reap locally once their tombstone has committed — the
  * tables whose `AuthorizedDelete` carries the REAP branch (see the constraint comment on
@@ -326,8 +425,8 @@ export declare function projectSeedPeers(rows: readonly CadrePeerRow[], ownerKey
  * hold, so a reaped row is recoverable by re-forming. `JoinRequest` is reapable for the same
  * reason: the inviting party and the user also hold its invitation. `OwnerKey` has no
  * production removal path and `MinOneOwner` makes an automated owner-key reap a
- * party-bricking hazard. `CadreInvite` is never deleted at all (its tombstone is a
- * withdrawal over a row that stays), so there is nothing to reap.
+ * party-bricking hazard. `CadreInvite` and `OwnerGrant` are never deleted at all (their
+ * tombstones are withdrawals over rows that stay), so there is nothing to reap.
  */
 export declare const REAPABLE_TABLES: readonly ["CadrePeer", "DeviceToken", "ValidationKey", "JoinedStrand", "JoinRequest"];
 export type ReapableTable = (typeof REAPABLE_TABLES)[number];
@@ -361,8 +460,6 @@ export type MembershipChangeListener = (reason: string) => Promise<void>;
  * the writer that files the row supplies it.
  */
 export type RevokedRowRef = Pick<RevocationRow, 'tableName' | 'rowKey' | 'stampId'>;
-/** What {@link ControlDatabase.removeMachine} wrote: `CadreNode.removeMachine`'s result, less the re-vouches it made first. */
-export type MachineRemovalWrites = Pick<MachineRemovalResult, 'removedPeer' | 'removedOwnerKey' | 'removedDeviceToken' | 'withdrawnInvitations'>;
 /**
  * Notified after a guarded-table delete — and the `CadreControl.Revocation`
  * tombstone it writes in the same transaction — has COMMITTED.
@@ -400,6 +497,8 @@ export interface ControlDatabaseConfig {
      * Optional path to the control schema file.
      * If not provided, uses the embedded schema for cross-platform compatibility.
      * Only use this if you need to override the default schema (e.g., for testing).
+     * The file has the shape of `schemas/control.qsql`: one `declare schema CadreControl`
+     * followed by one plain `apply schema CadreControl` ({@link controlSchemaFileDeclaration}).
      */
     schemaPath?: string;
     /** Libp2p node for the control network (injected) */
@@ -448,6 +547,8 @@ export declare class ControlDatabase {
      */
     initialize(): Promise<void>;
     private loadSchema;
+    /** Apply the declared control schema, retrying transient cohort failures. */
+    private applyControlSchema;
     /**
      * One UNRETRIED drain of a control read to rows — every read in this class bottoms out
      * here (almost all via {@link readRows}, which adds the transient-failure retry), and
@@ -592,7 +693,7 @@ export declare class ControlDatabase {
     /**
      * Every strand this party joined from another party (`CadreControl.JoinedStrand`), shaped
      * as a {@link StrandRow} so a reader can treat it like one of the party's own. A joiner
-     * never founds, so `FounderOwnerKey` is always null. Read raw, like {@link queryStrands}:
+     * never founds, so `FounderOwnerKey` and `FounderPeerId` are always null. Read raw, like {@link queryStrands}:
      * no retired-stamp filter.
      */
     queryJoinedStrands(): Promise<StrandRow[]>;
@@ -640,8 +741,10 @@ export declare class ControlDatabase {
      * Idempotent genesis: insert `key` as the founding owner key only when
      * the party has none yet. Returns true if it inserted, false if an owner
      * key already existed (so a repeat `--owner` start is a no-op).
+     *
+     * @param label - the user's name for the key ({@link insertOwnerKey}).
      */
-    ensureOwnerKey(key: string): Promise<boolean>;
+    ensureOwnerKey(key: string, label?: string): Promise<boolean>;
     /**
      * Collect every owner key (`CadreControl.OwnerKey.Key`) as a set.
      *
@@ -666,8 +769,9 @@ export declare class ControlDatabase {
      */
     getOwnerKeys(retry?: boolean): Promise<Set<string>>;
     /**
-     * Every live `OwnerKey` row with its persisted proof ({@link OwnerKeyRow}) — what the
-     * trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`). Rows whose
+     * Every live `OwnerKey` row with its label and persisted proof ({@link OwnerKeyRow}) — what
+     * the trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`) and the owner-key
+     * listing shows (`CadreNode.listOwnerKeys`). Rows whose
      * `StampId` is retired in `CadreControl.Revocation` are excluded here, as
      * {@link queryCadrePeers} excludes them and for the reason on {@link getOwnerKeys}, which
      * reads through this. A row with no stamp (the schema permits it; no writer produces one)
@@ -723,15 +827,15 @@ export declare class ControlDatabase {
     queryCadrePeers(retry?: boolean): Promise<CadrePeerRow[]>;
     /**
      * The cadre's peers as a seed or a redemption reply carries them: every live `CadrePeer`
-     * row with its addresses, each flagged `isOwner` when the key behind its peer id is in
-     * the replicated `OwnerKey` table ({@link projectSeedPeers}).
+     * row with its addresses, the minter and every always-on machine marked preferred
+     * ({@link projectSeedPeers}).
      *
      * Read through {@link queryCadrePeers}, never a raw `CadrePeer` select, so a removed
      * member's addresses are never packed into a seed or handed to a redeeming device as a
      * dial hint: a revoked peer is off the addressable surface everywhere, and this is one of
      * its exits.
      */
-    querySeedPeers(): Promise<SeedPeer[]>;
+    querySeedPeers(minterPeerId: string): Promise<SeedPeer[]>;
     /**
      * Every approver public key currently enrolled in `CadreControl.ValidationKey` — the
      * set a `ValidationUrl` redemption's approval signature must be signed by (see
@@ -948,19 +1052,34 @@ export declare class ControlDatabase {
     updateSelfDeviceToken(record: DeviceTokenRecord): Promise<void>;
     /**
      * Insert the initial owner key (bootstrap - no existing owners required)
+     *
+     * @param label - the user's name for the key, at most {@link OWNER_KEY_MAX_LABEL}
+     *   characters once trimmed; blank is stored as none.
      */
-    insertOwnerKey(key: string): Promise<void>;
+    insertOwnerKey(key: string, label?: string): Promise<void>;
     /**
      * Owner-signed INSERT of a further `OwnerKey` row, notifying the membership listener once
      * it has committed. The signed-add branch of `OwnerKey.Authorized`: the signer must be an
      * owner in the pre-transaction snapshot, its signature covers the `'add'` digest over
-     * (Key, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a reader
-     * can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
+     * (Key, Label, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a
+     * reader can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
      *
      * Through {@link mutateCadrePeer}, the membership hub. The liveness read, the stamp and the
      * signature all sit inside the locked body: a {@link lockedWithRetry} re-run starts over a
      * rolled-back attempt with a fresh stamp, as {@link redeemCadreInvite} does.
      *
+     * @param label - the user's name for the key, as {@link insertOwnerKey}'s.
+     * @returns `true` when this call seated the row, `false` when `key` is already a live owner
+     *   here (nothing written, whatever its label).
+     * @throws when this node holds `key`'s row under a retired stamp
+     *   ({@link liveOwnerKeyStamp}), or when the schema refuses the signer.
+     */
+    insertOwnerKeyVouched(key: string, ownerKey: string, signMessage: ControlSign, label?: string | null): Promise<boolean>;
+    /**
+     * The stamp of `key`'s live `OwnerKey` row here, or null when this node holds none: the
+     * insert-if-absent read of {@link insertOwnerKeyVouched} and {@link redeemOwnerGrant}. Inside
+     * the locked body (both reads `retry: false`; see queryStampId's NOTE).
+     *
      * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
      * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
      * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
@@ -968,12 +1087,15 @@ export declare class ControlDatabase {
      * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
      * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
      *
-     * @returns `true` when this call seated the row, `false` when `key` is already a live owner
-     *   here (nothing written).
-     * @throws when this node holds `key`'s row under a retired stamp (above), or when the
-     *   schema refuses the signer.
+     * @throws when this node holds `key`'s row under a retired stamp (above).
      */
-    insertOwnerKeyVouched(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    private liveOwnerKeyStamp;
+    /**
+     * The signed-add statement of {@link insertOwnerKeyVouched} and {@link revouchOwnerKey}, the
+     * stored voucher being the signing pair. Bare `exec`: callers hold the write lock, which is
+     * NOT re-entrant.
+     */
+    private execOwnerKeyVouchedInsert;
     /**
      * Owner-signed removal of one `OwnerKey` row plus the `Revocation` tombstone retiring its
      * stamp, notifying the membership listener once it has committed. The remove branch of
@@ -991,56 +1113,51 @@ export declare class ControlDatabase {
      *   (nothing written, no tombstone).
      * @throws when `key` is `ownerKey`, or is the only live owner.
      */
-    deleteOwnerKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteOwnerKey(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Re-vouch a live `OwnerKey` row under this owner's signature: in ONE transaction, the
      * current row's guarded delete plus tombstone ({@link deleteOwnerKey}'s body) and an insert
-     * of the same key under a fresh stamp, signed by `ownerKey` ({@link insertOwnerKeyVouched}'s
-     * body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
+     * of the same key and label under a fresh stamp, signed by `ownerKey`
+     * ({@link insertOwnerKeyVouched}'s body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
      * this is the only way to rebind a row's voucher; the anchor derivation lets the re-add
      * under a fresh stamp beat the older tombstone (`deriveOwnerAnchor`). For
-     * {@link removeMachine}: the owners a machine being removed had added keep their anchor
-     * place everywhere once their row stands on a remaining owner's signature.
+     * `CadreNode.removeOwner`: the owners a key being removed had added keep their anchor place
+     * everywhere once their row stands on a remaining owner's signature.
      *
-     * Through {@link mutateCadrePeer}, the membership hub. The stamp read runs inside the locked
+     * Through {@link mutateCadrePeer}, the membership hub. The row read runs inside the locked
      * body; a row whose stamp is already retired (held without its delete) is reported as absent
      * rather than tombstoned twice.
      *
      * @returns `true` when the row was re-vouched, `false` when `key` is not a live owner here.
      * @throws when `key` is `ownerKey` (an owner cannot sign its own row's removal).
      */
-    revouchOwnerKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    revouchOwnerKey(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
-     * Remove one machine completely, in ONE transaction: its `CadrePeer` row, its `OwnerKey`
-     * row when `target.ownerKey` names one, its `DeviceToken` row when it has one, each with
-     * the `Revocation` tombstone retiring its stamp ({@link deleteGuardedRow}'s statement pair,
-     * composed bare as {@link deleteStrandAndPartyKey} composes it), plus a withdrawal tombstone
-     * for every `CadreInvite` in `target.inviteKeys` that is still live here
-     * ({@link withdrawCadreInvite}'s body). One transaction so no reader sees the machine half
-     * removed: a row gone but its push token resolvable, or its owner key gone but an invitation
-     * it could redeem again still open.
+     * Remove one machine completely, in ONE transaction: its `CadrePeer` row and its
+     * `DeviceToken` row when it has one, each with the `Revocation` tombstone retiring its stamp
+     * ({@link deleteGuardedRow}'s statement pair, composed bare as {@link deleteStrandAndPartyKey}
+     * composes it), plus a withdrawal tombstone for every `CadreInvite` in `target.inviteKeys`
+     * that is still live here ({@link withdrawCadreInvite}'s body). One transaction so no reader
+     * sees the machine half removed: a row gone but its push token resolvable, or an invitation
+     * it could redeem again still open. Owner keys are never touched: they are the person's, and
+     * removing one is {@link deleteOwnerKey}.
      *
      * Through {@link mutateCadrePeer}, the membership hub. Every stamp is read inside the locked
      * body, and a row whose stamp is already retired (held without its delete) is skipped rather
-     * than tombstoned twice. The by-name owner refusals of {@link deleteOwnerKey} apply to the
-     * owner-key arm. Nothing to remove writes nothing and returns all false.
-     *
-     * The caller decides WHAT to remove, which owner key is the machine's and which invitations
-     * it could use, from its plan (`CadreNode.planMachineRemoval`); this method only refuses to
-     * write an inconsistent set.
+     * than tombstoned twice. Nothing to remove writes nothing and returns all false.
      *
-     * @throws when `target.ownerKey` is `ownerKey`, or is the only live owner here.
+     * The caller decides which invitations the machine could use, from its plan
+     * (`CadreNode.planMachineRemoval`).
      */
     removeMachine(target: {
         peerId: string;
-        ownerKey: string | null;
         inviteKeys: readonly string[];
-    }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<MachineRemovalWrites>;
+    }, ownerKey: string, signMessage: ControlSign): Promise<MachineRemovalResult>;
     /**
      * The guarded removals {@link removeMachine} runs, signed over each row's current stamp:
-     * the `CadrePeer` row, the `OwnerKey` row when named, the `DeviceToken` row when present.
-     * Inside the locked body (every read `retry: false`); one `Revocation` scan serves the
-     * retired-stamp check for all three tables and the last-owner refusal.
+     * the `CadrePeer` row and the `DeviceToken` row, each when present. Inside the locked body
+     * (every read `retry: false`); one `Revocation` scan serves the retired-stamp check for both
+     * tables.
      */
     private signMachineRemovals;
     /**
@@ -1062,7 +1179,7 @@ export declare class ControlDatabase {
      *   with the owner's private key, returning a base64url signature
      * @param memberPrivateKey - Optional private key for membership in closed strands
      */
-    insertStrand(strandId: string, type: 'o' | 'c', ownerKey: string, signMessage: (message: Uint8Array) => string, memberPrivateKey?: string): Promise<void>;
+    insertStrand(strandId: string, type: 'o' | 'c', ownerKey: string, signMessage: ControlSign, memberPrivateKey?: string): Promise<void>;
     /**
      * Delete a strand from the control database using an owner signature.
      *
@@ -1090,7 +1207,7 @@ export declare class ControlDatabase {
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
      */
-    deleteStrand(strandId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteStrand(strandId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * The locked body of {@link deleteStrand}: the `Strand` delete + tombstone, plus — when
      * one exists — the strand's `StrandPartyKey` delete + tombstone, all in ONE
@@ -1120,7 +1237,7 @@ export declare class ControlDatabase {
      * @param signMessage - Function that ed25519-signs the raw message bytes (no pre-hash)
      *   with the owner's private key, returning a base64url signature.
      */
-    insertStrandPartyKey(strandId: string, privateKey: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<void>;
+    insertStrandPartyKey(strandId: string, privateKey: string, ownerKey: string, signMessage: ControlSign): Promise<void>;
     /**
      * Owner-signed removal of one `StrandPartyKey` row — the party's own membership
      * identity for that strand, stored nowhere else, so this is as destructive as
@@ -1133,7 +1250,7 @@ export declare class ControlDatabase {
      * `Revocation` tombstone in the same transaction. A no-op (no throw, no tombstone)
      * when the row does not exist — `false` then, `true` when a row was actually removed.
      */
-    deleteStrandPartyKey(strandId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteStrandPartyKey(strandId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Record, party-wide, a strand this party joined from another party (`JoinedStrand` row),
      * using an owner signature.
@@ -1146,14 +1263,14 @@ export declare class ControlDatabase {
      * Fails with a `JoinedStrand.Id` uniqueness violation when the id is already recorded;
      * `isStrandIdConflict(error, 'JoinedStrand')` identifies that case.
      */
-    insertJoinedStrand(row: Pick<StrandRow, 'Id' | 'Type' | 'MemberPrivateKey'>, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<void>;
+    insertJoinedStrand(row: Pick<StrandRow, 'Id' | 'Type' | 'MemberPrivateKey'>, ownerKey: string, signMessage: ControlSign): Promise<void>;
     /**
      * Owner-signed removal of one `JoinedStrand` row. Mirrors {@link deleteStrandPartyKey}:
      * `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same
      * transaction. A no-op (no throw, no tombstone) when the row does not exist — `false`
      * then, `true` when a row was actually removed.
      */
-    deleteJoinedStrand(strandId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteJoinedStrand(strandId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Record, party-wide, a join this party asked for: a `JoinRequest` row under a fresh stamp,
      * owner-signed over every column. Returns the pending join as written.
@@ -1161,7 +1278,7 @@ export declare class ControlDatabase {
      * Fails with a `JoinRequest.Id` uniqueness violation when the party already holds a request
      * for this invitation; {@link isPendingJoinConflict} identifies that case.
      */
-    insertJoinRequest(request: JoinRequestFields, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
+    insertJoinRequest(request: JoinRequestFields, ownerKey: string, signMessage: ControlSign): Promise<PendingJoin>;
     /**
      * Record the outcome of the pending join `expected`: its owner-signed `JoinSuccess` /
      * `JoinFailure` row, keyed by the request's stamp. A join recorded over a failure deletes the
@@ -1175,7 +1292,7 @@ export declare class ControlDatabase {
      * transaction instead (its outcome row collides on the primary key, or its tombstone retires
      * the stamp), and the caller re-reads either way.
      */
-    recordJoinOutcome(expected: PendingJoin, outcome: JoinOutcome, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
+    recordJoinOutcome(expected: PendingJoin, outcome: JoinOutcome, ownerKey: string, signMessage: ControlSign): Promise<PendingJoin>;
     /**
      * Re-write the pending join `next` (request and outcome) under a fresh stamp, retiring the
      * live request incarnation `expectedStampId`: how a finished request is asked for again, and
@@ -1190,14 +1307,14 @@ export declare class ControlDatabase {
      * that committed but reported failure throws {@link PendingJoinChangedError} whose live join
      * carries the returned stamp, so a caller that re-reads finds its write.
      */
-    rewritePendingJoin(expectedStampId: string, next: PendingJoinFields, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<PendingJoin>;
+    rewritePendingJoin(expectedStampId: string, next: PendingJoinFields, ownerKey: string, signMessage: ControlSign): Promise<PendingJoin>;
     /**
      * Owner-signed removal of one pending join, as {@link deleteJoinedStrand} removes its row:
      * `'remove'`-tagged digest over (Id, StampId), `Revocation` tombstone in the same transaction,
      * and the request's outcome row with it. A no-op (no throw, no tombstone) when there is no
      * request — `false` then, `true` when one was actually removed.
      */
-    deletePendingJoin(id: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deletePendingJoin(id: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Mint a fresh stamp for `request` and the owner signature `JoinRequest.AuthorizedInsert`
      * verifies, returning the row as it will be written and its insert.
@@ -1224,7 +1341,7 @@ export declare class ControlDatabase {
      * @param signMessage - Function that ed25519-signs the raw message bytes (no pre-hash)
      *   with the owner's private key, returning a base64url signature
      */
-    insertValidationKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<void>;
+    insertValidationKey(key: string, ownerKey: string, signMessage: ControlSign): Promise<void>;
     /**
      * Delete a validation key from the control database using an owner signature.
      *
@@ -1241,7 +1358,7 @@ export declare class ControlDatabase {
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
      */
-    deleteValidationKey(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteValidationKey(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Owner-vouched INSERT of one `CadrePeer` membership row, notifying the membership
      * listener once it has committed.
@@ -1286,7 +1403,7 @@ export declare class ControlDatabase {
         updatedAt: number;
         sig: string | null;
         profile: NodeProfile | null;
-    }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    }, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Owner "re-touch" of an existing `CadrePeer` membership row: bump `UpdatedAt` and
      * rewrite `VouchOwner`/`VouchSig` under the owner branch of `CadrePeer.AuthorizedUpdate`
@@ -1327,13 +1444,13 @@ export declare class ControlDatabase {
      *
      * NOTE: this rebinds VouchOwner to the CALLING owner's key, and the authorized-membership
      * predicate (`CadreNode.listAuthorizedMembers`) now judges rows by that column against each
-     * reader's node-local anchor. Benign today because the only caller — the write-while-alone
-     * drain — re-touches solely rows this node itself authored (`pendingPeerWrites`), so the
-     * voucher is rewritten to the key that already signed it. If a future path ever lets one
-     * owner re-touch a row a DIFFERENT owner vouched, the voucher silently flips: readers that
-     * anchor the original owner but not this one would drop a legitimate member. Such a path
-     * must re-vouch deliberately (or preserve the existing VouchOwner/VouchSig) rather than
-     * inherit this rebinding.
+     * reader's node-local anchor. The two callers rebind on purpose: the write-while-alone drain
+     * re-touches solely rows this node itself authored (`pendingPeerWrites`), so the voucher is
+     * rewritten to the key that already signed it, and `CadreNode.removeOwner` moves rows off a
+     * key it is about to remove. A new caller that re-touches a row a DIFFERENT owner vouched
+     * flips the voucher silently: readers that anchor the original owner but not this one would
+     * drop a legitimate member. It must re-vouch deliberately (or preserve the existing
+     * VouchOwner/VouchSig) rather than inherit this rebinding.
      *
      * @param peerId - the membership row to re-touch.
      * @param updatedAt - the strictly-increasing freshness stamp to write.
@@ -1341,7 +1458,7 @@ export declare class ControlDatabase {
      * @param signMessage - ed25519-signs the raw message bytes with that owner's private key.
      * @returns `true` when the row was re-touched, `false` when no row exists (no notify).
      */
-    reauthorizeCadrePeer(peerId: string, updatedAt: number, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    reauthorizeCadrePeer(peerId: string, updatedAt: number, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Owner-signed removal of one `CadrePeer` membership row, notifying the membership
      * listener once it has committed.
@@ -1362,7 +1479,7 @@ export declare class ControlDatabase {
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
      */
-    deleteCadrePeer(peerId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteCadrePeer(peerId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Owner-signed removal of one peer's `DeviceToken` row (logout / token invalidation).
      *
@@ -1376,7 +1493,7 @@ export declare class ControlDatabase {
      * A no-op (no throw, no tombstone) when the row does not exist — `false` then, `true`
      * when a row was actually removed.
      */
-    deleteDeviceToken(peerId: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    deleteDeviceToken(peerId: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
      * Owner-signed delete of one guarded row plus the `Revocation` tombstone retiring its
      * stamp, in ONE transaction. The single body behind EVERY guarded delete —
@@ -1421,8 +1538,8 @@ export declare class ControlDatabase {
     private execGuardedRemoval;
     /**
      * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
-     * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of a
-     * `CadreInvite` withdrawal ({@link withdrawCadreInvite}), whose row stays — or the ledger
+     * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of an
+     * issued row's withdrawal ({@link withdrawIssuedRow}), whose row stays — or the ledger
      * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
      * lock and, where one is needed, the transaction.
      *
@@ -1575,7 +1692,7 @@ export declare class ControlDatabase {
      *
      * Returns how many UPDATE statements ran (`rows.length` on success).
      */
-    reissueRevocations(rows: readonly RevocationRow[], reissuedAt: number, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<number>;
+    reissueRevocations(rows: readonly RevocationRow[], reissuedAt: number, ownerKey: string, signMessage: ControlSign): Promise<number>;
     /**
      * Owner-signed filing of the singleton `Revocation` ledger marker
      * ({@link REVOCATION_LEDGER_MARKER}), the one row in that table that retires nothing.
@@ -1607,7 +1724,7 @@ export declare class ControlDatabase {
      * @returns `'opened'` when this call filed the marker, `'already-open'` when it was
      *   already there.
      */
-    openRevocationLedger(ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<RevocationLedgerOpenResult>;
+    openRevocationLedger(ownerKey: string, signMessage: ControlSign): Promise<RevocationLedgerOpenResult>;
     /**
      * Whether the ledger marker is present locally: a scan of the `'Revocation'` rows with the
      * stamp compared in TypeScript (see {@link openRevocationLedger} for why not a seek).
@@ -1672,8 +1789,9 @@ export declare class ControlDatabase {
      * Covers every write that can change who is a member or an owner: EVERY `CadrePeer`
      * writer, with one documented exception ({@link updateSelfPeerRecord}, which cannot
      * change the snapshot), the `OwnerKey` writers ({@link insertOwnerKeyVouched},
-     * {@link deleteOwnerKey}) and the invitation redemption ({@link redeemCadreInvite}),
-     * which seats both. That is what makes the party-membership snapshot refresh automatic
+     * {@link deleteOwnerKey}), the invitation redemption ({@link redeemCadreInvite}), which
+     * seats both, and the owner-grant redemption ({@link redeemOwnerGrant}). That is what
+     * makes the party-membership snapshot refresh automatic
      * rather than a caller obligation. The name predates the `OwnerKey` writers. A
      * writer necessarily holds the target node's ControlDatabase (the `SeedBootstrapService`'s
      * event callbacks are NOT a viable seam: the temp service `CadreNode.applySeed`
@@ -1760,7 +1878,7 @@ export declare class ControlDatabase {
      * backoff never stalls the other local writers queued behind it. Safe because every
      * locked body is atomic and re-runnable (the contract on {@link withWriteLock}).
      *
-     * Also carries {@link loadSchema}'s distributed DDL, the one caller that runs BEFORE
+     * Also carries {@link applyControlSchema}'s distributed DDL, the one caller that runs BEFORE
      * `initialized` is set — so it reaches this method directly rather than through
      * {@link execWrite}, whose {@link ensureInitialized} would reject it. The write queue is
      * necessarily empty at that point, so the lock is uncontended there; it is taken anyway
@@ -1863,7 +1981,7 @@ export declare class ControlDatabase {
      * @param options - Optional `expiresAtMs` (epoch ms), `totalUses`, `validationUrl`,
      *   `strandId` (bind to a pre-existing host strand for provision-then-record)
      */
-    insertFormationInvite(token: string, sAppId: string, ownerKey: string, signMessage: (message: Uint8Array) => string, options?: {
+    insertFormationInvite(token: string, sAppId: string, ownerKey: string, signMessage: ControlSign, options?: {
         expiresAtMs?: number;
         totalUses?: number;
         validationUrl?: string;
@@ -2091,31 +2209,53 @@ export declare class ControlDatabase {
      * private half to the invitee out of band. It is never stored here (`Strand.Invite` has the
      * same shape).
      *
-     * @param invite.key - the invitation public key (base64url ed25519), the row's primary key
-     * @param invite.peerId - the device the invitation is for, or null for whoever redeems first
-     * @param invite.grantsOwner - whether redemption also seats an `OwnerKey` row for the device
-     * @param invite.expiresAtMs - epoch ms after which it cannot be redeemed; omit for never
-     * @param invite.totalUses - how many redemptions it allows; omit for unlimited
      * @returns the row as stored, `expiresAt` in its canonical form
      */
-    insertCadreInvite(invite: {
-        key: string;
-        peerId?: string | null;
-        grantsOwner: boolean;
-        expiresAtMs?: number | null;
-        totalUses?: number | null;
-    }, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<CadreInviteRow>;
+    insertCadreInvite(invite: CadreInviteFields, ownerKey: string, signMessage: ControlSign): Promise<CadreInviteRow>;
+    /**
+     * Build and owner-sign a `CadreInvite` row WITHOUT inserting it: the signing half of
+     * {@link insertCadreInvite}, which `CadreNode.joinWithOwnerGrant` uses alone for the
+     * invitation a node issues to itself, since a store that holds no `OwnerKey` row for the
+     * issuer would refuse the local insert and the row is seated at a member from the bundle
+     * instead. `ExpiresAt` is canonicalized by this database's engine, which is a format, not a
+     * store, so the row reads the same wherever it is seated.
+     */
+    signCadreInvite(invite: CadreInviteFields, ownerKey: string, signMessage: ControlSign): Promise<CadreInviteRow>;
     /**
      * Seat an owner-signed `CadreInvite` row received inside an invitation bundle, under its own
      * stored `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, so a member that
-     * already holds the row (by replication, or from an earlier redemption attempt) is a no-op.
+     * already holds the row (by replication, or from an earlier redemption attempt) is a no-op,
+     * and so is one whose insert the cohort refuses because a member there holds it.
      *
      * @returns `true` when this call inserted the row, `false` when it was already present.
      * @throws {CadreInviteIssuerUnknownError} when `CadreInvite.AuthorizedInsert` refuses it: the
      *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
-     *   not verify. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     *   not verify. {@link IssuedRowNotHereYetError} when the cohort holds the row and this node
+     *   cannot read it yet. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
      */
     seatCadreInvite(row: CadreInviteRow): Promise<boolean>;
+    /**
+     * Insert-if-absent of an issued row from a bundle's copy, under the write lock: the body of
+     * {@link seatCadreInvite} and {@link seatOwnerGrant}. `exec` runs the bare insert under the
+     * row's own stored issuer pair.
+     *
+     * @returns `true` when this call inserted the row, `false` when it was already present —
+     *   here, or at the cohort member that refused the insert for holding it
+     *   ({@link adoptCohortHeldRow}).
+     * @throws `refuse(cause)` when the table's `AuthorizedInsert` refuses the row;
+     *   {@link IssuedRowNotHereYetError} when the cohort holds the row and this node still cannot
+     *   read it; every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     */
+    private seatIssuedRow;
+    /**
+     * The seat's insert was refused because a cohort member already holds a row under `key`, which
+     * this node's guard read missed because its store lags the cohort. A bundle's copy is verbatim
+     * and every column is under the issuer's signature, so the held row is this one: it counts as
+     * seated once a refreshing read (unlocked, so retried as any read) finds it here.
+     *
+     * @throws {IssuedRowNotHereYetError} when the read still does not find it.
+     */
+    private adoptCohortHeldRow;
     /** Bare `CadreInvite` insert shared by {@link insertCadreInvite} and {@link seatCadreInvite}; the caller holds the lock. */
     private execCadreInviteInsert;
     /**
@@ -2149,6 +2289,8 @@ export declare class ControlDatabase {
      * `retry: false` is passed by {@link assertCadreInviteSeatRemains}, inside the locked body.
      */
     countCadreInviteUsage(key: string, retry?: boolean): Promise<number>;
+    /** The one-row count read behind {@link countCadreInviteUsage} and {@link countOwnerGrantUsage}. */
+    private countUsageRows;
     /**
      * Is any cadre invitation still redeemable — not withdrawn, unexpired, with uses below its
      * `TotalUses`, and issued by a current owner? The conditions `CadreInviteUsage.Authorized`
@@ -2172,6 +2314,11 @@ export declare class ControlDatabase {
      * what enforce every condition.
      */
     isCadreInviteLive(invite: CadreInviteRow, nowMs?: number): Promise<boolean>;
+    /**
+     * The body of {@link isCadreInviteLive} and {@link isOwnerGrantLive}: is `row` (the one held,
+     * or a verified bundle copy; null for neither) still open and under its use cap?
+     */
+    private issuedRowLive;
     /**
      * Every `CadreInvite` row this node holds with its standing: how many redemptions are
      * recorded, whether it is withdrawn, and whether it is still redeemable — the same
@@ -2180,6 +2327,11 @@ export declare class ControlDatabase {
      * occasional read, not a gate's.
      */
     listCadreInviteStatuses(nowMs?: number): Promise<CadreInviteStatus[]>;
+    /**
+     * The body of {@link listCadreInviteStatuses} and {@link listOwnerGrantStatuses}: each of
+     * `rows` with its withdrawal, its recorded uses and whether it is still redeemable.
+     */
+    private issuedRowStandings;
     /**
      * Owner-signed WITHDRAWAL of a cadre invitation: file the `Revocation` tombstone retiring its
      * stamp, with the row kept. The row stays because every device the invitation admitted
@@ -2197,24 +2349,29 @@ export declare class ControlDatabase {
      * Fires the guarded-delete listener like a removal does, so a withdrawal committed while the
      * node was alone is queued for re-issue on cohort growth ({@link CadreNode.noteGuardedDelete}).
      */
-    withdrawCadreInvite(key: string, ownerKey: string, signMessage: (message: Uint8Array) => string): Promise<boolean>;
+    withdrawCadreInvite(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
     /**
-     * The withdrawal tombstones for the `CadreInvite` rows among `keys` that are held here and
-     * not yet withdrawn, signed and ready for {@link execTombstone}: the body
-     * {@link withdrawCadreInvite} files one of and {@link removeMachine} files several of in one
+     * The body of {@link withdrawCadreInvite} and {@link withdrawOwnerGrant}: under the write
+     * lock, file the owner-signed tombstone retiring the row's stamp with the row kept, and fire
+     * the guarded-delete listener for it (so a withdrawal made while alone is re-issued).
+     */
+    private withdrawIssuedRow;
+    /**
+     * The withdrawal tombstones for the `table` rows among `keys` that are held here and not
+     * yet withdrawn, signed and ready for {@link execTombstone}: the body
+     * {@link withdrawIssuedRow} files one of and {@link removeMachine} files several of in one
      * transaction. Inside the locked body (every read `retry: false`); an absent or already
      * withdrawn key is logged and left out.
      */
-    private signCadreInviteWithdrawals;
+    private signWithdrawals;
     /**
-     * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member and,
-     * when the invitation grants ownership, as an owner — with NO owner signature. One
-     * transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`), the
-     * `OwnerKey` row when granted (consent branch of `Authorized`), and last the
-     * `CadreInviteUsage` row that authorizes both; the usage row's own checks (`PeerExists`,
-     * `OwnerExists`) read the rows back, so the three are mutually bound to this exact
-     * redemption and none can be held in reserve. The invitation must already be committed
-     * ({@link seatCadreInvite}): every consent branch reads `committed.CadreInvite`.
+     * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member —
+     * with NO owner signature, and as a machine only (ownership is {@link redeemOwnerGrant}'s).
+     * One transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`) and then
+     * the `CadreInviteUsage` row that authorizes it; the usage row's own check (`PeerExists`)
+     * reads the peer row back, so the two are mutually bound to this exact redemption and
+     * neither can be held in reserve. The invitation must already be committed
+     * ({@link seatCadreInvite}): the consent branch reads `committed.CadreInvite`.
      *
      * The two signatures are the holder's and the device's, minted on the device over
      * {@link cadreInviteRedeemMessage} / {@link cadreInviteConsentMessage}; this machine only
@@ -2223,18 +2380,17 @@ export declare class ControlDatabase {
      * (`verifyInvitationAdmission`) — a mismatched pair is written and then never trusted.
      *
      * Idempotent for a retry after a dropped reply: when the device's row is already present
-     * (and its `OwnerKey` row too, when granted) nothing is written and no seat is spent —
-     * `alreadyMember: true`. A present row whose `OwnerKey` row is missing under an
-     * owner-granting invitation is completed: the usage row then names the existing peer stamp.
-     * The seat check ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a
-     * single-use redemption is answered `alreadyMember` rather than refused as exhausted.
+     * nothing is written and no seat is spent — `alreadyMember: true`. The seat check
+     * ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a single-use
+     * redemption is answered `alreadyMember` rather than refused as exhausted.
      *
      * Through {@link mutateCadrePeer}, so the membership hub is notified; inside the locked body
      * every read passes `retry: false` and every stamp is minted per attempt, so a
      * {@link lockedWithRetry} re-run starts clean.
      *
      * @throws {InvitationExhaustedError} when the invitation's seats are all spent (by name,
-     *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains}).
+     *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains});
+     *   {@link IssuedRowNotHereYetError} when no `CadreInvite` row is readable here.
      */
     redeemCadreInvite(params: {
         inviteKey: string;
@@ -2251,13 +2407,6 @@ export declare class ControlDatabase {
         peerSig: string;
         nowMs?: number;
     }): Promise<CadreInviteRedemptionResult>;
-    /**
-     * The rows a redemption would seat that are already present: the device's `CadrePeer`
-     * stamp, and — only when the invitation grants ownership — its `OwnerKey` stamp. Raw stamp
-     * reads ({@link queryStampId}), so a physically present row counts; inside the locked
-     * body, so never retried.
-     */
-    private readSeatedAdmission;
     /**
      * Refuse a redemption that would consume a seat the cadre invitation does not have, by
      * name ({@link InvitationExhaustedError}) — the cadre-invitation twin of
@@ -2266,6 +2415,137 @@ export declare class ControlDatabase {
      * committed count inside the locked body, so on a same-node race the loser is refused here.
      */
     private assertCadreInviteSeatRemains;
+    /** The body of {@link assertCadreInviteSeatRemains} and {@link assertOwnerGrantSeatRemains}; `countUsage` reads inside the locked body. */
+    private assertIssuedSeatRemains;
+    /**
+     * Mint and insert an owner-signed `OwnerGrant`: a grant of ownership to whoever holds the
+     * grant's private half, redeemable through any member machine ({@link redeemOwnerGrant})
+     * to seat an owner key the holder generates or already holds. No machine is admitted and no
+     * peer id is named. The grant twin of {@link insertCadreInvite}: the owner signs the whole
+     * row ({@link ownerGrantAddMessage}), `ExpiresAt` through {@link canonicalDatetime}, and
+     * the returned row is what the grant bundle carries, re-inserted verbatim by
+     * {@link seatOwnerGrant} on a member that has not received it by replication.
+     *
+     * @param grant.key - the grant's ed25519 PUBLIC key (base64url), the row's primary key; the
+     *   caller minted the pair and hands the private half to the holder out of band
+     * @param grant.label - the label every key this grant seats will carry
+     *   ({@link ownerKeyLabel}'s rule: trimmed, at most 64 characters, blank meaning none); the
+     *   issuer's choice, which the holder cannot change
+     * @param grant.expiresAtMs - epoch ms after which it cannot be redeemed; omit or null for
+     *   never. The short default lifetime is the node API's to apply, not this writer's.
+     * @param grant.totalUses - how many redemptions it allows; omit for unlimited
+     * @returns the row as stored, `expiresAt` in its canonical form
+     */
+    insertOwnerGrant(grant: {
+        key: string;
+        label?: string | null;
+        expiresAtMs?: number | null;
+        totalUses?: number | null;
+    }, ownerKey: string, signMessage: ControlSign): Promise<OwnerGrantRow>;
+    /**
+     * Seat an owner-signed `OwnerGrant` row received inside a grant bundle, under its own stored
+     * `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, as {@link seatCadreInvite}.
+     *
+     * @returns `true` when this call inserted the row, `false` when it was already present.
+     * @throws {OwnerGrantIssuerUnknownError} when `OwnerGrant.AuthorizedInsert` refuses it: the
+     *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
+     *   not verify. {@link IssuedRowNotHereYetError} when the cohort holds the row and this node
+     *   cannot read it yet. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     */
+    seatOwnerGrant(row: OwnerGrantRow): Promise<boolean>;
+    /** Bare `OwnerGrant` insert shared by {@link insertOwnerGrant} and {@link seatOwnerGrant}; the caller holds the lock. */
+    private execOwnerGrantInsert;
+    /**
+     * Read one `OwnerGrant` row by key, or null when absent. Withdrawn rows are returned too,
+     * as {@link queryCadreInvite} returns them: the row is the holder's proof and never goes
+     * away. `retry: false` is passed by {@link redeemOwnerGrant}, inside its locked body.
+     */
+    queryOwnerGrant(key: string, retry?: boolean): Promise<OwnerGrantRow | null>;
+    /**
+     * Every `OwnerGrant` row this node holds, withdrawn and expired ones included. Read by the
+     * anchor sync when at least one `OwnerKey` row is consent-seated (`CadreNode.loadOwnerGrantChain`);
+     * `retry: false` is forwarded from the membership-gate refresh for {@link queryCadrePeers}' reason.
+     */
+    queryOwnerGrants(retry?: boolean): Promise<OwnerGrantRow[]>;
+    /** Every `OwnerGrantUsage` row this node holds — the redemption records a grant-seated `OwnerKey` row is verified against. Same `retry` contract as {@link queryOwnerGrants}. */
+    queryOwnerGrantUsages(retry?: boolean): Promise<OwnerGrantUsageRow[]>;
+    /**
+     * How many times an owner grant has been redeemed (its `OwnerGrantUsage` rows), served
+     * through the `OwnerGrantUsageByGrant` index. A permissive PRE-check like
+     * {@link countCadreInviteUsage}: the cap is `OwnerGrantUsage.Authorized`'s own committed count.
+     */
+    countOwnerGrantUsage(key: string, retry?: boolean): Promise<number>;
+    /**
+     * Is this one owner grant still redeemable here — not withdrawn, unexpired, uses left, issuer
+     * still an owner — judged as {@link isCadreInviteLive} judges an invitation: by the row this
+     * node holds under `grant.key`, else by `grant` itself (a bundle's copy, not seated yet)
+     * when its issuer signature verifies. A permissive pre-check; {@link seatOwnerGrant} and the
+     * redemption's own write enforce every condition.
+     */
+    isOwnerGrantLive(grant: OwnerGrantRow, nowMs?: number): Promise<boolean>;
+    /**
+     * Every `OwnerGrant` row this node holds with its standing — recorded redemptions, withdrawal,
+     * and whether it is still redeemable — for an owner's listing, as {@link listCadreInviteStatuses}.
+     */
+    listOwnerGrantStatuses(nowMs?: number): Promise<OwnerGrantStatus[]>;
+    /**
+     * Owner-signed WITHDRAWAL of an owner grant: file the `Revocation` tombstone retiring its
+     * stamp, with the row kept, exactly as {@link withdrawCadreInvite} withdraws an invitation
+     * and for the same reason (every key the grant seated proves itself through the row;
+     * `OwnerGrant.NoDelete`, `Revocation.RowIsGone`). Afterwards `OwnerGrantUsage.Authorized`
+     * refuses every further redemption and `OwnerGrant.NotRevoked` refuses re-seating the
+     * holder's copy on any node holding the tombstone. Keys already seated stay owners;
+     * removing one is {@link deleteOwnerKey}.
+     *
+     * Idempotent: `false` (nothing written) when the row is absent here or already withdrawn,
+     * `true` when this call filed the tombstone. Fires the guarded-delete listener, so a
+     * withdrawal committed while alone is re-issued on cohort growth.
+     */
+    withdrawOwnerGrant(key: string, ownerKey: string, signMessage: ControlSign): Promise<boolean>;
+    /**
+     * Redeem a seated `OwnerGrant` on the issuer's behalf: seat `seatedKey` as an owner with NO
+     * owner signature. One transaction writes the `OwnerKey` row (the grant branch of
+     * `Authorized`: `VouchOwner` the issuer, `VouchSig` null, `VouchUsage` the usage stamp,
+     * `Label` the grant's) and then the `OwnerGrantUsage` row that authorizes it; the usage
+     * row's `SeatedExists` reads the owner row back, so the two are bound to this exact
+     * redemption and neither can be held in reserve. The grant must already be committed
+     * ({@link seatOwnerGrant}): both consent reads are of `committed.OwnerGrant`. No machine is
+     * admitted and no peer id is named.
+     *
+     * The two signatures are minted where the private keys are (the grant's and the seated
+     * key's), over {@link ownerGrantRedeemMessage} / {@link ownerGrantConsentMessage}; this
+     * machine only verifies them, by writing the row.
+     *
+     * Idempotent, and a no-op for a key that is already an owner: when `seatedKey` has a live
+     * `OwnerKey` row here nothing is written and no use is spent — `alreadyOwner: true` with
+     * that row's stamp. The seat check ({@link assertOwnerGrantSeatRemains}) runs after that, so
+     * the retry of a single-use redemption is answered `alreadyOwner` rather than refused as
+     * exhausted. A key removed earlier is seated afresh under a new stamp (`NotRevoked` passes),
+     * except on a machine that still holds its retired row, which refuses by name
+     * ({@link liveOwnerKeyStamp}).
+     *
+     * Through {@link mutateCadrePeer}, so the membership hub is notified and the anchors follow;
+     * inside the locked body every read passes `retry: false` and the stamp is minted per
+     * attempt, so a {@link lockedWithRetry} re-run starts clean.
+     *
+     * @throws {InvitationExhaustedError} when the grant's uses are all spent (by name, ahead of
+     *   the schema's generic `Authorized` refusal); its `token` is the grant key.
+     *   {@link IssuedRowNotHereYetError} when no `OwnerGrant` row is readable here.
+     */
+    redeemOwnerGrant(params: {
+        grantKey: string;
+        /** The owner key to seat (base64url ed25519): the holder generated it, or already holds it. */
+        seatedKey: string;
+        /** Single-use nonce minted by the holder; both signatures cover it. */
+        usageStampId: string;
+        /** The holder's signature with the grant private key over the `'redeem'` digest. */
+        grantSig: string;
+        /** The seated key's signature over the `'consent'` digest. */
+        ownerSig: string;
+        nowMs?: number;
+    }): Promise<OwnerGrantRedemptionResult>;
+    /** {@link assertCadreInviteSeatRemains} for an owner grant: refuse an exhausted grant by name, ahead of the write. */
+    private assertOwnerGrantSeatRemains;
     /**
      * Close the database and cleanup resources.
      *