@serfab/cadre-core 1.16.0 → 1.17.0

package/dist/control-database.js

@@ -4,11 +4,13 @@ import { Database, FunctionFlags, TEXT_RETURN, createScalarFunction, registerPlu
 import cryptoPlugin from '@optimystic/quereus-plugin-crypto/plugin';
 import optimysticPlugin from '@optimystic/quereus-plugin-optimystic/plugin';
 import { digest, randomBytes } from '@optimystic/quereus-plugin-crypto';
-import { CONTROL_SCHEMA } from './control-schema.js';
+import { APPLY_CONTROL_SCHEMA, CONTROL_SCHEMA_DECLARATION, controlSchemaFileDeclaration } from './control-schema.js';
+import { refuseIncompatibleControlStore } from './control-schema-version.js';
 import { canonicalDatetime } from './canonical-datetime.js';
-import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, CONTROL_TABLES } from './control-authorization.js';
-import { ed25519PublicKeyB64FromPeerId, requireEd25519PublicKeyB64 } from './ed25519-key.js';
-import { verifyCadreInviteRow } from './peer-authorization.js';
+import { controlAuthorizationFields, unboundAuthorizationFields, cadreInviteRowFields, ownerGrantRowFields, CONTROL_TABLES } from './control-authorization.js';
+import { requireEd25519PublicKeyB64 } from './ed25519-key.js';
+import { verifyCadreInviteRow, verifyOwnerGrantRow } from './peer-authorization.js';
+import { OWNER_KEY_MAX_LABEL } from './owner-key-export.js';
 import { retryControlWrite, SCHEMA_INIT_RETRY_POLICY } from './control-write-retry.js';
 import { isCohortUnreachableRead, retryControlRead } from './control-read-retry.js';
 import { chainMessages } from './control-retry.js';
@@ -78,13 +80,14 @@ export class FormationAbortedError extends Error {
 /**
  * The invitation's seat budget is already spent: the count of recorded usage rows for the
  * invitation has reached its `TotalUses`, so this redemption cannot be given a seat. `token`
- * is the `FormationInvite.Token` or the `CadreInvite.Key`, whichever table the caller
- * redeemed against.
+ * is the `FormationInvite.Token`, the `CadreInvite.Key` or the `OwnerGrant.Key`, whichever
+ * table the caller redeemed against.
  *
  * Raised off the committed-count check ({@link ControlDatabase.assertSeatRemains}) ahead of
  * the write, inside {@link ControlDatabase.redeemInvitation} /
  * {@link ControlDatabase.recordFormationUsage}, off the same check for a cadre invitation
- * ({@link ControlDatabase.redeemCadreInvite}), and off the unlocked pre-check
+ * ({@link ControlDatabase.redeemCadreInvite}) and an owner grant
+ * ({@link ControlDatabase.redeemOwnerGrant}), and off the unlocked pre-check
  * `ControlFormationUsageRecorder.authorizeUsage` runs before the manager issues a membership
  * pass — and off nothing else. It exists because
  * without it the refusal surfaces as a generic `CHECK constraint failed: Authorized` from the
@@ -119,8 +122,42 @@ export class CadreInviteIssuerUnknownError extends Error {
         this.name = 'CadreInviteIssuerUnknownError';
     }
 }
-/** The refusal {@link CadreInviteIssuerUnknownError} wraps — the constraint named, as the engine words it. */
-const CADRE_INVITE_UNAUTHORIZED = /CHECK constraint failed: AuthorizedInsert\b/;
+/**
+ * {@link ControlDatabase.seatOwnerGrant} was refused by `OwnerGrant.AuthorizedInsert`: the
+ * grant twin of {@link CadreInviteIssuerUnknownError}, for the same two causes (the issuer's
+ * `OwnerKey` row has not replicated here yet or has since been removed; or a tampered row).
+ * Its own class rather than a shared one so a caller that handles invitation and grant
+ * bundles can tell by `instanceof` which credential was refused.
+ */
+export class OwnerGrantIssuerUnknownError extends Error {
+    constructor(grantKey, issuerKey, options) {
+        super(`Owner grant ${grantKey} cannot be seated here: its issuer ${issuerKey} is not an owner on this node, or its signature does not verify`, options);
+        this.grantKey = grantKey;
+        this.issuerKey = issuerKey;
+        this.name = 'OwnerGrantIssuerUnknownError';
+    }
+}
+/**
+ * An issued row (a `CadreInvite` or an `OwnerGrant`) the cadre holds that this node cannot read
+ * yet: {@link ControlDatabase.seatCadreInvite} / {@link ControlDatabase.seatOwnerGrant} had its
+ * insert refused by a cohort member already holding the row, and a refreshed read here still
+ * finds nothing; or the redemption that follows the seat finds no row. It clears once this
+ * node's store catches up, which is why the redemption paths answer it with the retryable
+ * `conflict` code.
+ */
+export class IssuedRowNotHereYetError extends Error {
+    constructor(table, key, options) {
+        super(`${table} ${key} is held by the cadre but not readable on this node yet; try again once it has synced`, options);
+        this.table = table;
+        this.key = key;
+        this.name = 'IssuedRowNotHereYetError';
+    }
+}
+/**
+ * The refusal {@link CadreInviteIssuerUnknownError} and {@link OwnerGrantIssuerUnknownError}
+ * wrap — the constraint named, as the engine words it; both tables name theirs `AuthorizedInsert`.
+ */
+const ISSUER_UNAUTHORIZED = /CHECK constraint failed: AuthorizedInsert\b/;
 /**
  * Parse a stored Quereus `datetime` value into epoch milliseconds.
  *
@@ -288,6 +325,39 @@ export function cadreInviteConsentMessage(partyId, fields) {
         fields.inviteKey, fields.usageStampId, fields.peerKey,
     ]);
 }
+/**
+ * The exact bytes an owner signs to seat an `OwnerGrant` row — the TS mirror of the `'add'`
+ * digest in `OwnerGrant.AuthorizedInsert`, over the whole row in the schema's order with
+ * nullable columns as `''` (`ownerGrantRowFields`, shared with the base64url verifier
+ * `peer-authorization.ts`'s `ownerGrantAddDigest`). `expiresAt` must already be the stored
+ * canonical `datetime` string, as {@link ControlDatabase.insertOwnerGrant} produces it, for
+ * the reason on {@link cadreInviteAddMessage}.
+ */
+export function ownerGrantAddMessage(partyId, row) {
+    return buildAuthorizationMessage('CadreControl.OwnerGrant', 'add', partyId, ownerGrantRowFields(row));
+}
+/**
+ * The exact bytes the HOLDER of an owner grant signs, with the grant's private key, to redeem
+ * it once — the TS mirror of the `'redeem'` digest `OwnerGrantUsage.GrantPossessed` verifies
+ * against the grant's public key. Binding the seated key and the nonce means a captured
+ * redemption can seat no other key and spend no other use.
+ */
+export function ownerGrantRedeemMessage(partyId, fields) {
+    return buildAuthorizationMessage('CadreControl.OwnerGrantUsage', 'redeem', partyId, [
+        fields.grantKey, fields.usageStampId, fields.seatedKey,
+    ]);
+}
+/**
+ * The exact bytes the SEATED key signs, proving the holder holds it — the TS mirror of the
+ * `'consent'` digest `OwnerGrantUsage.OwnerConsented` verifies against `SeatedKey`. Same
+ * fields as {@link ownerGrantRedeemMessage} under a distinct action tag, so neither
+ * signature can stand in for the other.
+ */
+export function ownerGrantConsentMessage(partyId, fields) {
+    return buildAuthorizationMessage('CadreControl.OwnerGrantUsage', 'consent', partyId, [
+        fields.grantKey, fields.usageStampId, fields.seatedKey,
+    ]);
+}
 /** Runtime guard for the dynamic-`from` count, over the one table list. */
 const CONTROL_TABLE_SET = new Set(CONTROL_TABLES);
 /**
@@ -306,11 +376,14 @@ const GUARDED_KEY_COLUMN = {
     JoinRequest: 'Id',
     DeviceToken: 'PeerId',
     CadreInvite: 'Key',
+    OwnerGrant: 'Key',
 };
+/** The write-reason prefix each {@link IssuedTable}'s seat and withdrawal log under. */
+const ISSUED_TABLE_REASON = { CadreInvite: 'cadre-invite', OwnerGrant: 'owner-grant' };
 /**
  * The exact bytes an owner signs to append one `Revocation` tombstone — `Revocation.Authorized`
  * binds the whole (TableName, RowKey, StampId) row under its own domain tag. Shared by every
- * tombstone writer (a guarded removal, a `CadreInvite` withdrawal, the ledger marker) so the
+ * tombstone writer (a guarded removal, an issued row's withdrawal, the ledger marker) so the
  * field order lives in one place; the base64url verifier is `peer-authorization.ts`'s
  * `revocationDigest`.
  */
@@ -321,28 +394,46 @@ function revocationTombstoneMessage(partyId, ref) {
  * The exact bytes an owner signs to seat a further `OwnerKey` row (the signed-add branch of
  * `OwnerKey.Authorized`); the base64url twin is `peer-authorization.ts`'s `ownerKeyAddDigest`.
  */
-function ownerKeyAddMessage(partyId, key, stampId) {
-    return buildAuthorizationMessage('CadreControl.OwnerKey', 'add', partyId, [key, stampId]);
+function ownerKeyAddMessage(partyId, key, label, stampId) {
+    return buildAuthorizationMessage('CadreControl.OwnerKey', 'add', partyId, [key, label ?? '', stampId]);
 }
-function signGuardedRemoval(partyId, tableName, rowKey, stampId, signMessage) {
+/**
+ * An owner key's label as its row stores it: trimmed, a blank one left out, and refused past
+ * {@link OWNER_KEY_MAX_LABEL} by name rather than by the schema's `LabelLength` check.
+ * Idempotent, so a caller that checks before opening an owner approval can pass the result on.
+ */
+export function ownerKeyLabel(label) {
+    const trimmed = label?.trim();
+    if (!trimmed) {
+        return null;
+    }
+    if (trimmed.length > OWNER_KEY_MAX_LABEL) {
+        throw new Error(`An owner key's label must be at most ${OWNER_KEY_MAX_LABEL} characters (this one has ${trimmed.length})`);
+    }
+    return trimmed;
+}
+async function signGuardedRemoval(partyId, tableName, rowKey, stampId, signMessage) {
     const ref = { tableName, rowKey, stampId };
     return {
         ref,
-        signature: signMessage(buildAuthorizationMessage(`CadreControl.${tableName}`, 'remove', partyId, [rowKey, stampId])),
-        revocationSignature: signMessage(revocationTombstoneMessage(partyId, ref)),
+        signature: await signMessage(buildAuthorizationMessage(`CadreControl.${tableName}`, 'remove', partyId, [rowKey, stampId])),
+        revocationSignature: await signMessage(revocationTombstoneMessage(partyId, ref)),
     };
 }
 /**
- * The rejection a second insert of an already-seated id into `table` produces, as the
+ * The rejection a second insert of an already-seated key into `table` produces, as the
  * optimystic vtab words it (`uniqueConstraintMessage`, qualified by table name only — no
- * schema prefix, matching `test/control-constraint-helpers.ts`'s `expectUniqueViolation`).
+ * schema prefix, matching `test/control-constraint-helpers.ts`'s `expectUniqueViolation`),
+ * naming the table's {@link GUARDED_KEY_COLUMN}.
  *
  * Each table's `StampId` is unique too, but a fresh stamp is minted per insert attempt, so
- * only the primary key can collide on a repeat insert. Matching the column explicitly
- * keeps any OTHER uniqueness failure out of the caller's idempotency branch.
+ * only the primary key can collide on a repeat insert. An issued row's bundle copy repeats its
+ * stamp as well, and the engine still names the key (`control-owner-grant.spec.ts` pins it).
+ * Matching the column explicitly keeps any OTHER uniqueness failure out of the caller's
+ * idempotency branch.
  */
-function idConflictPattern(table) {
-    return new RegExp(`UNIQUE constraint failed: ${table}\\.Id\\b`, 'i');
+function keyConflictPattern(table) {
+    return new RegExp(`UNIQUE constraint failed: ${table}\\.${GUARDED_KEY_COLUMN[table]}\\b`, 'i');
 }
 /**
  * Did this write to `table` fail because the strand id is already seated there?
@@ -360,7 +451,16 @@ function idConflictPattern(table) {
  * reword reddens there.
  */
 export function isStrandIdConflict(error, table) {
-    return errorChainMatches(error, idConflictPattern(table));
+    return errorChainMatches(error, keyConflictPattern(table));
+}
+/**
+ * Did a seat of an issued row fail because a cohort member already holds a row under its key?
+ * {@link ControlDatabase.seatCadreInvite} / {@link ControlDatabase.seatOwnerGrant} reach this
+ * on a node whose store lags the cohort: its guard read missed the row, and the member that
+ * checked the commit refused the insert. Text-matched, failing closed, like {@link isStrandIdConflict}.
+ */
+export function isIssuedRowKeyConflict(error, table) {
+    return errorChainMatches(error, keyConflictPattern(table));
 }
 /**
  * Did {@link ControlDatabase.insertJoinRequest} fail because the party already holds a
@@ -372,7 +472,7 @@ export function isStrandIdConflict(error, table) {
  * until the next reap pass.
  */
 export function isPendingJoinConflict(error) {
-    return errorChainMatches(error, idConflictPattern('JoinRequest'));
+    return errorChainMatches(error, keyConflictPattern('JoinRequest'));
 }
 /**
  * The `JoinRequest.Id` of an invitation: the base64url sha256 `digest` of its token. One row
@@ -408,7 +508,7 @@ export const REVOCATION_LEDGER_MARKER = {
 };
 /**
  * The rejection a second insert of the ledger marker produces: the optimystic vtab's
- * primary-key wording (see {@link idConflictPattern}), naming both columns of
+ * primary-key wording (see {@link keyConflictPattern}), naming both columns of
  * `Revocation`'s composite key. Applied only to the marker's own insert, whose key
  * ('Revocation', 'opened') no row but the marker can hold (`RowIsGone`), and `Revocation`
  * has no other unique constraint.
@@ -424,41 +524,32 @@ function errorChainMatches(error, pattern) {
 }
 /**
  * Project `CadrePeer` rows into the {@link SeedPeer} list a seed, or a cadre invitation
- * redemption reply, carries.
+ * redemption reply, carries. `minterPeerId` is the machine minting the seed or answering the
+ * redemption; it contributes an entry only through its own `CadrePeer` row.
  *
- * Owner identity is sourced from the `OwnerKey` table, not from the transport peer id. An
- * Ed25519 libp2p peer id embeds its public key (identity multihash), so each peer's ed25519
- * key is derivable from its `PeerId`; a peer is an owner iff that derived key is in
- * `ownerKeys`. This makes any owner node markable — not just the local one. A non-Ed25519
- * or unparsable id yields a non-owner rather than failing the whole projection.
- *
- * NOTE: this is the one owner lookup deliberately left on the REPLICATED table rather than
- * the node-local anchor. `SeedPeer.isOwner` is a dial hint — the receiver dials owner-flagged
- * peers first — not a trust decision, and the receiver re-derives real trust from its own
- * anchor. So a polluted table costs at most a wasted dial, while anchoring here would
- * silently drop legitimate co-owners this node never pinned. If `isOwner` ever gates
- * anything the receiver TRUSTS, move it to the anchor.
+ * A peer is `preferred` when it is the minter, the one machine certain to be reachable by the
+ * receiver at that moment, since it is delivering the seed or the reply, or an always-on
+ * machine (`Profile = 'storage'`), the ones that stay dialable. Preference is a dial hint and
+ * reads no `OwnerKey` row: owner keys are not machines, and a receiver derives trust from its
+ * own anchor, never from this list. A `Profile` is self-declared and not checked here, so a
+ * machine misdeclaring one costs the receiver a wasted dial at most.
  */
-export function projectSeedPeers(rows, ownerKeys) {
-    return rows.map(({ peerId, multiaddr }) => {
-        const pubKeyB64 = ed25519PublicKeyB64FromPeerId(peerId);
-        const isOwner = pubKeyB64 !== null && ownerKeys.has(pubKeyB64);
-        return {
-            peerId,
-            multiaddrs: multiaddr ? multiaddr.split(',') : [],
-            isOwner,
-            ...(isOwner ? { publicKey: pubKeyB64 } : {}),
-        };
-    });
+export function projectSeedPeers(rows, minterPeerId) {
+    return rows.map(({ peerId, multiaddr, profile }) => ({
+        peerId,
+        multiaddrs: multiaddr ? multiaddr.split(',') : [],
+        preferred: peerId === minterPeerId || profile === 'storage',
+    }));
 }
 /**
- * The conditions a cadre invitation must still meet to be redeemed, short of its use count:
- * not withdrawn, unexpired (`expiresAt <= now` is expired, as the redemption refuses it),
- * and issued by a current owner. Shared by {@link ControlDatabase.hasLiveCadreInvite},
- * {@link ControlDatabase.isCadreInviteLive} and {@link ControlDatabase.listCadreInviteStatuses}
- * so they cannot drift from each other, or from `CadreInviteUsage.Authorized`.
+ * The conditions an issued credential (a cadre invitation or an owner grant) must still meet
+ * to be redeemed, short of its use count: not withdrawn, unexpired (`expiresAt <= now` is
+ * expired, as the redemption refuses it), and issued by a current owner. Shared by
+ * {@link ControlDatabase.hasLiveCadreInvite}, {@link ControlDatabase.isCadreInviteLive},
+ * {@link ControlDatabase.listCadreInviteStatuses} and their owner-grant twins so they cannot
+ * drift from each other, or from `CadreInviteUsage.Authorized` / `OwnerGrantUsage.Authorized`.
  */
-function cadreInviteStillOpen(row, withdrawn, owners, nowMs) {
+function issuedRowStillOpen(row, withdrawn, owners, nowMs) {
     if (withdrawn.has(row.stampId) || !owners.has(row.issuerKey)) {
         return false;
     }
@@ -476,31 +567,30 @@ function cadreInviteStillOpen(row, withdrawn, owners, nowMs) {
  * hold, so a reaped row is recoverable by re-forming. `JoinRequest` is reapable for the same
  * reason: the inviting party and the user also hold its invitation. `OwnerKey` has no
  * production removal path and `MinOneOwner` makes an automated owner-key reap a
- * party-bricking hazard. `CadreInvite` is never deleted at all (its tombstone is a
- * withdrawal over a row that stays), so there is nothing to reap.
+ * party-bricking hazard. `CadreInvite` and `OwnerGrant` are never deleted at all (their
+ * tombstones are withdrawals over rows that stay), so there is nothing to reap.
  */
 export const REAPABLE_TABLES = ['CadrePeer', 'DeviceToken', 'ValidationKey', 'JoinedStrand', 'JoinRequest'];
 /**
  * Runtime membership test for {@link REAPABLE_TABLES}, narrowing a tombstone's
  * `TableName` to the subset {@link ControlDatabase.reapRevokedRow} accepts. A tombstone
- * naming an excluded table (`Strand`, `OwnerKey`, `CadreInvite`) is skipped silently —
+ * naming an excluded table (`Strand`, `OwnerKey`, `CadreInvite`, `OwnerGrant`) is skipped silently —
  * `Strand` tombstones are the common case in a party that has unpublished a strand, so a
  * log line per skip would be per-pass noise.
  */
 const REAPABLE_TABLE_SET = new Set(REAPABLE_TABLES);
 const isReapableTable = (table) => REAPABLE_TABLE_SET.has(table);
 /** Every `CadreInvite` column, in the order {@link cadreInviteRowOf} reads them; callers append their `where`. */
-const CADRE_INVITE_SELECT_SQL = 'select Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.CadreInvite';
+const CADRE_INVITE_SELECT_SQL = 'select Key, PeerId, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.CadreInvite';
 /**
  * A stored `CadreInvite` row as a {@link CadreInviteRow}. `ExpiresAt` is kept as the
  * engine-canonical string it reads back as — the form the `'add'` signature covers — never
- * parsed to ms here; `GrantsOwner` is the schema's 0/1 integer.
+ * parsed to ms here.
  */
 function cadreInviteRowOf(row) {
     return {
         key: row.Key,
         peerId: row.PeerId ?? null,
-        grantsOwner: Number(row.GrantsOwner) === 1,
         expiresAt: row.ExpiresAt == null ? null : String(row.ExpiresAt),
         totalUses: row.TotalUses ?? null,
         issuerKey: row.IssuerKey,
@@ -516,11 +606,35 @@ function cadreInviteUsageRowOf(row) {
         peerId: row.PeerId,
         peerKey: row.PeerKey,
         peerStampId: row.PeerStampId,
-        ownerStampId: row.OwnerStampId ?? null,
         inviteSig: row.InviteSig,
         peerSig: row.PeerSig,
     };
 }
+/** Every `OwnerGrant` column, in the order {@link ownerGrantRowOf} reads them; callers append their `where`. */
+const OWNER_GRANT_SELECT_SQL = 'select Key, Label, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId from CadreControl.OwnerGrant';
+/** A stored `OwnerGrant` row as an {@link OwnerGrantRow}; `ExpiresAt` kept canonical, as {@link cadreInviteRowOf} keeps it. */
+function ownerGrantRowOf(row) {
+    return {
+        key: row.Key,
+        label: row.Label ?? null,
+        expiresAt: row.ExpiresAt == null ? null : String(row.ExpiresAt),
+        totalUses: row.TotalUses ?? null,
+        issuerKey: row.IssuerKey,
+        issuerSig: row.IssuerSig,
+        stampId: row.StampId,
+    };
+}
+/** A stored `OwnerGrantUsage` row as an {@link OwnerGrantUsageRow}. */
+function ownerGrantUsageRowOf(row) {
+    return {
+        usageStampId: row.UsageStampId,
+        grantKey: row.GrantKey,
+        seatedKey: row.SeatedKey,
+        seatedStampId: row.SeatedStampId,
+        grantSig: row.GrantSig,
+        ownerSig: row.OwnerSig,
+    };
+}
 /** A `JoinedStrand` row as a {@link StrandRow}; the schema's `KnownType` check backs the `Type` cast. */
 function joinedStrandRow(row) {
     return {
@@ -528,8 +642,20 @@ function joinedStrandRow(row) {
         MemberPrivateKey: row.MemberPrivateKey,
         Type: row.Type,
         FounderOwnerKey: null,
+        FounderPeerId: null,
+    };
+}
+/** A party-own `Strand` row as a {@link StrandRow}; the `Type` cast as {@link joinedStrandRow}'s. */
+function strandRow(row) {
+    return {
+        Id: row.Id,
+        MemberPrivateKey: row.MemberPrivateKey,
+        Type: row.Type,
+        FounderOwnerKey: row.FounderOwnerKey,
+        FounderPeerId: row.FounderPeerId,
     };
 }
+const STRAND_COLUMNS = 'Id, MemberPrivateKey, Type, FounderOwnerKey, FounderPeerId';
 const FORMATION_INVITE_SELECT_SQL = 'select Token, sAppId, ExpiresAt, TotalUses, ValidationUrl, StrandId from CadreControl.FormationInvite';
 function formationInviteRowOf(row) {
     return {
@@ -599,7 +725,7 @@ function joinRequestAddFields(row) {
  * `JoinSuccess` / `JoinFailure` row and the signature its `AuthorizedInsert` verifies, over the
  * row's columns in the schema's order (a null column signs as `''`, an integer as its text).
  */
-function signJoinOutcomeInsert(partyId, requestStampId, outcome, ownerKey, signMessage) {
+async function signJoinOutcomeInsert(partyId, requestStampId, outcome, ownerKey, signMessage) {
     const at = String(outcome.RecordedAt);
     const { table, sql, fields, values } = outcome.kind === 'joined'
         ? {
@@ -612,9 +738,28 @@ function signJoinOutcomeInsert(partyId, requestStampId, outcome, ownerKey, signM
             fields: [requestStampId, at, outcome.Code, outcome.Reason],
             values: [requestStampId, outcome.RecordedAt, outcome.Code, outcome.Reason],
         };
-    const signature = signMessage(buildAuthorizationMessage(`CadreControl.${table}`, 'add', partyId, fields));
+    const signature = await signMessage(buildAuthorizationMessage(`CadreControl.${table}`, 'add', partyId, fields));
     return { sql, params: [ownerKey, signature, ...values] };
 }
+/** The text of a {@link ControlDatabaseConfig.schemaPath} file; Node.js only. */
+async function readSchemaFile(schemaPath) {
+    if (typeof process === 'undefined' || !process.versions?.node) {
+        throw new Error('Loading schema from file is not supported in React Native. ' +
+            'Remove the schemaPath option to use the embedded schema instead.');
+    }
+    try {
+        // Use require to conditionally load fs only in Node.js.
+        // This won't be bundled by React Native's Metro bundler — a dynamic
+        // import() would be statically picked up by Metro, so require is
+        // intentional here (cross-platform constraint, not lazy CommonJS).
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const fs = require('fs/promises');
+        return await fs.readFile(schemaPath, 'utf-8');
+    }
+    catch (error) {
+        throw new Error(`Failed to load schema from ${schemaPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
+    }
+}
 /**
  * ControlDatabase manages the CadreControl schema using Quereus with Optimystic backend.
  * It provides typed query methods for accessing control network data.
@@ -741,44 +886,35 @@ export class ControlDatabase {
         log('ControlDatabase initialized successfully');
     }
     async loadSchema() {
-        let schemaContent;
+        let declaration;
         if (this.config.schemaPath) {
-            // Load from file if explicitly provided (for testing or custom schemas)
-            // This only works in Node.js environments
             log('Loading schema from file: %s', this.config.schemaPath);
-            // Check if we're in a Node.js environment
-            if (typeof process !== 'undefined' && process.versions?.node) {
-                try {
-                    // Use require to conditionally load fs only in Node.js.
-                    // This won't be bundled by React Native's Metro bundler — a dynamic
-                    // import() would be statically picked up by Metro, so require is
-                    // intentional here (cross-platform constraint, not lazy CommonJS).
-                    // eslint-disable-next-line @typescript-eslint/no-require-imports
-                    const fs = require('fs/promises');
-                    schemaContent = await fs.readFile(this.config.schemaPath, 'utf-8');
-                }
-                catch (error) {
-                    throw new Error(`Failed to load schema from ${this.config.schemaPath}: ${error instanceof Error ? error.message : String(error)}`, { cause: error });
-                }
-            }
-            else {
-                throw new Error('Loading schema from file is not supported in React Native. ' +
-                    'Remove the schemaPath option to use the embedded schema instead.');
-            }
+            declaration = controlSchemaFileDeclaration(await readSchemaFile(this.config.schemaPath));
         }
         else {
-            // Use embedded schema for cross-platform compatibility
             log('Using embedded control schema');
-            schemaContent = CONTROL_SCHEMA;
+            declaration = CONTROL_SCHEMA_DECLARATION;
         }
+        // Declaring runs no DDL; it only records the declaration the check and the apply both read.
+        await this.db.exec(declaration);
+        // A warm store this build cannot apply to without losing data is refused HERE, before the
+        // apply runs anything: the optimystic module refuses most changes to an existing table
+        // part-way through an apply, and a dropped table takes its rows. Migrating a store in place
+        // (control-store-migrates-on-start) widens this check to let catalog-only changes through.
+        await refuseIncompatibleControlStore(this.db, this.config.partyId);
+        await this.applyControlSchema();
+        log('Schema loaded and executed');
+    }
+    /** Apply the declared control schema, retrying transient cohort failures. */
+    async applyControlSchema() {
         // Schema init is a DISTRIBUTED write, so it gets the same bounded transient-failure
         // retry every other control write does ({@link lockedWithRetry}). Every CadreControl
-        // table is optimystic-backed (the default vtab was routed to optimystic just above),
+        // table is optimystic-backed (`initialize` routes the default vtab to optimystic),
         // so each `create table` needs a super-majority of the party's peers to answer. On a
         // node joining a party that already has two live members a single unanswered peer
         // during any one create otherwise kills startup outright.
         //
-        // Re-running the WHOLE `exec` after a partial failure is safe, and this is the
+        // Re-running the apply after a partial failure is safe, and this is the
         // non-obvious part:
         //
         //  - `apply schema` is a DIFF, not a replay. Quereus collects the live catalog, diffs
@@ -786,11 +922,6 @@ export class ControlDatabase {
         //    exactly why `initialize` hydrates persisted optimystic schemas BEFORE getting here.
         //    A table the live catalog already lists generates no statements at all, which is what
         //    makes an apply over an already-complete schema (a warm start) a no-op.
-        //    NOTE: a table the catalog lists with DIFFERENT constraint text diffs to
-        //    `alter table ... drop constraint`, which the optimystic module refuses, so a store
-        //    written by a build with older constraint text fails here on every start (policy:
-        //    recreate, docs/architecture.md after the Control Network table). If backwards
-        //    compatibility becomes a requirement, this apply is the migration site.
         //  - a failed apply is taken back WHOLE (Quereus 4.20.0). The migration loop keeps an
         //    undo journal; when a step fails it runs that journal in reverse, re-renders the
         //    catalog, compares it against a fingerprint taken BEFORE the apply, and only then
@@ -823,8 +954,7 @@ export class ControlDatabase {
         // also what lets schema init absorb optimystic's self-coordination grace refusal, which
         // is unsafe for control writes in general. Why, on
         // `RETRIABLE_SCHEMA_INIT_MATCHERS` in `control-write-retry.ts`.
-        await this.lockedWithRetry(() => this.db.exec(schemaContent), SCHEMA_INIT_RETRY_POLICY, 'schema-init');
-        log('Schema loaded and executed');
+        await this.lockedWithRetry(() => this.db.exec(APPLY_CONTROL_SCHEMA), SCHEMA_INIT_RETRY_POLICY, 'schema-init');
     }
     /**
      * One UNRETRIED drain of a control read to rows — every read in this class bottoms out
@@ -994,16 +1124,8 @@ export class ControlDatabase {
      */
     async queryStrands() {
         this.ensureInitialized();
-        const results = [];
-        for (const row of await this.readRows('select Id, MemberPrivateKey, Type, FounderOwnerKey from CadreControl.Strand', undefined, 'strands')) {
-            results.push({
-                Id: row.Id,
-                MemberPrivateKey: row.MemberPrivateKey,
-                Type: row.Type,
-                FounderOwnerKey: row.FounderOwnerKey,
-            });
-        }
-        return results;
+        const rows = await this.readRows(`select ${STRAND_COLUMNS} from CadreControl.Strand`, undefined, 'strands');
+        return rows.map(strandRow);
     }
     /**
      * Read a single strand row by id, or null when absent. Single-row sibling of
@@ -1013,20 +1135,13 @@ export class ControlDatabase {
      */
     async queryStrand(strandId) {
         this.ensureInitialized();
-        for (const row of await this.readRows('select Id, MemberPrivateKey, Type, FounderOwnerKey from CadreControl.Strand where Id = ?', [strandId], 'strand')) {
-            return {
-                Id: row.Id,
-                MemberPrivateKey: row.MemberPrivateKey,
-                Type: row.Type,
-                FounderOwnerKey: row.FounderOwnerKey,
-            };
-        }
-        return null;
+        const rows = await this.readRows(`select ${STRAND_COLUMNS} from CadreControl.Strand where Id = ?`, [strandId], 'strand');
+        return rows.length === 0 ? null : strandRow(rows[0]);
     }
     /**
      * Every strand this party joined from another party (`CadreControl.JoinedStrand`), shaped
      * as a {@link StrandRow} so a reader can treat it like one of the party's own. A joiner
-     * never founds, so `FounderOwnerKey` is always null. Read raw, like {@link queryStrands}:
+     * never founds, so `FounderOwnerKey` and `FounderPeerId` are always null. Read raw, like {@link queryStrands}:
      * no retired-stamp filter.
      */
     async queryJoinedStrands() {
@@ -1113,15 +1228,17 @@ export class ControlDatabase {
      * Idempotent genesis: insert `key` as the founding owner key only when
      * the party has none yet. Returns true if it inserted, false if an owner
      * key already existed (so a repeat `--owner` start is a no-op).
+     *
+     * @param label - the user's name for the key ({@link insertOwnerKey}).
      */
-    async ensureOwnerKey(key) {
+    async ensureOwnerKey(key, label) {
         this.ensureInitialized();
         const trimmed = requireEd25519PublicKeyB64(key, 'owner key');
         if (await this.hasOwnerKey()) {
             log('Owner key already present; skipping genesis insert');
             return false;
         }
-        await this.insertOwnerKey(trimmed);
+        await this.insertOwnerKey(trimmed, label);
         return true;
     }
     /**
@@ -1150,8 +1267,9 @@ export class ControlDatabase {
         return new Set((await this.queryOwnerKeyRows(retry)).map(row => row.key));
     }
     /**
-     * Every live `OwnerKey` row with its persisted proof ({@link OwnerKeyRow}) — what the
-     * trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`). Rows whose
+     * Every live `OwnerKey` row with its label and persisted proof ({@link OwnerKeyRow}) — what
+     * the trusted-owner anchor sync derives from (`CadreNode.syncOwnerAnchor`) and the owner-key
+     * listing shows (`CadreNode.listOwnerKeys`). Rows whose
      * `StampId` is retired in `CadreControl.Revocation` are excluded here, as
      * {@link queryCadrePeers} excludes them and for the reason on {@link getOwnerKeys}, which
      * reads through this. A row with no stamp (the schema permits it; no writer produces one)
@@ -1171,7 +1289,7 @@ export class ControlDatabase {
         this.ensureInitialized();
         const revoked = retired ?? await this.queryRevokedStamps('OwnerKey', retry);
         const rows = [];
-        const sql = 'select Key, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.OwnerKey';
+        const sql = 'select Key, Label, StampId, VouchOwner, VouchSig, VouchUsage from CadreControl.OwnerKey';
         for (const row of await this.readRows(sql, undefined, 'owner-keys', retry)) {
             const stampId = row.StampId ?? null;
             if (stampId === null) {
@@ -1183,6 +1301,7 @@ export class ControlDatabase {
             }
             rows.push({
                 key: row.Key,
+                label: row.Label ?? null,
                 stampId,
                 vouchOwner: row.VouchOwner ?? null,
                 vouchSig: row.VouchSig ?? null,
@@ -1257,16 +1376,16 @@ export class ControlDatabase {
     }
     /**
      * The cadre's peers as a seed or a redemption reply carries them: every live `CadrePeer`
-     * row with its addresses, each flagged `isOwner` when the key behind its peer id is in
-     * the replicated `OwnerKey` table ({@link projectSeedPeers}).
+     * row with its addresses, the minter and every always-on machine marked preferred
+     * ({@link projectSeedPeers}).
      *
      * Read through {@link queryCadrePeers}, never a raw `CadrePeer` select, so a removed
      * member's addresses are never packed into a seed or handed to a redeeming device as a
      * dial hint: a revoked peer is off the addressable surface everywhere, and this is one of
      * its exits.
      */
-    async querySeedPeers() {
-        return projectSeedPeers(await this.queryCadrePeers(), await this.getOwnerKeys());
+    async querySeedPeers(minterPeerId) {
+        return projectSeedPeers(await this.queryCadrePeers(), minterPeerId);
     }
     /**
      * Every approver public key currently enrolled in `CadreControl.ValidationKey` — the
@@ -1603,9 +1722,13 @@ export class ControlDatabase {
     }
     /**
      * Insert the initial owner key (bootstrap - no existing owners required)
+     *
+     * @param label - the user's name for the key, at most {@link OWNER_KEY_MAX_LABEL}
+     *   characters once trimmed; blank is stored as none.
      */
-    async insertOwnerKey(key) {
+    async insertOwnerKey(key, label) {
         this.ensureInitialized();
+        const storedLabel = ownerKeyLabel(label);
         log('Inserting owner key: %s', key);
         // Bootstrap is authorized by the schema's genesis branch — `(select count(1) from
         // committed.OwnerKey) = 0`, i.e. the party had no owner before this transaction — so no
@@ -1617,60 +1740,81 @@ export class ControlDatabase {
         // optimystic `StampId()` SQL function.
         const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
         await this.execWrite(`
-      insert into CadreControl.OwnerKey (Key, StampId)
+      insert into CadreControl.OwnerKey (Key, Label, StampId)
         with context OwnerKey = null, Signature = null
-        values (?, ?)
-    `, [key, stampId], 'owner-key-insert');
+        values (?, ?, ?)
+    `, [key, storedLabel, stampId], 'owner-key-insert');
         log('Owner key inserted');
     }
     /**
      * Owner-signed INSERT of a further `OwnerKey` row, notifying the membership listener once
      * it has committed. The signed-add branch of `OwnerKey.Authorized`: the signer must be an
      * owner in the pre-transaction snapshot, its signature covers the `'add'` digest over
-     * (Key, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a reader
-     * can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
+     * (Key, Label, StampId), and the stored `VouchOwner`/`VouchSig` are that same pair, so a
+     * reader can later judge the add against its own anchor (`verifyOwnerKeyVoucher`).
      *
      * Through {@link mutateCadrePeer}, the membership hub. The liveness read, the stamp and the
      * signature all sit inside the locked body: a {@link lockedWithRetry} re-run starts over a
      * rolled-back attempt with a fresh stamp, as {@link redeemCadreInvite} does.
      *
-     * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
-     * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
-     * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
-     * would collide on the primary key. Re-add from the machine that removed the key, or any
-     * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
-     * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
-     *
+     * @param label - the user's name for the key, as {@link insertOwnerKey}'s.
      * @returns `true` when this call seated the row, `false` when `key` is already a live owner
-     *   here (nothing written).
-     * @throws when this node holds `key`'s row under a retired stamp (above), or when the
-     *   schema refuses the signer.
+     *   here (nothing written, whatever its label).
+     * @throws when this node holds `key`'s row under a retired stamp
+     *   ({@link liveOwnerKeyStamp}), or when the schema refuses the signer.
      */
-    async insertOwnerKeyVouched(key, ownerKey, signMessage) {
+    async insertOwnerKeyVouched(key, ownerKey, signMessage, label) {
         this.ensureInitialized();
+        const storedLabel = ownerKeyLabel(label);
         return await this.mutateCadrePeer('owner-key-add', async () => {
-            // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
-            const heldStamp = await this.queryStampId('OwnerKey', key, false);
-            if (heldStamp !== null) {
-                if (!(await this.queryRevokedStamps('OwnerKey', false)).has(heldStamp)) {
-                    log('insertOwnerKeyVouched: %s is already an owner; nothing written', key);
-                    return false;
-                }
-                throw new Error(`Cannot re-add owner key ${key} here: this node still holds the row it was removed under ` +
-                    '(OwnerKey rows are not reaped); re-add it from the machine that removed it');
+            if (await this.liveOwnerKeyStamp(key) !== null) {
+                log('insertOwnerKeyVouched: %s is already an owner; nothing written', key);
+                return false;
             }
             const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
-            const signature = signMessage(ownerKeyAddMessage(this.config.partyId, key, stampId));
-            // Bare `exec`: already inside the write lock, which is NOT re-entrant.
-            await this.db.exec(`
-        insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
-          with context OwnerKey = ?, Signature = ?
-          values (?, ?, ?, ?)
-      `, [ownerKey, signature, key, stampId, ownerKey, signature]);
+            const signature = await signMessage(ownerKeyAddMessage(this.config.partyId, key, storedLabel, stampId));
+            await this.execOwnerKeyVouchedInsert({ key, label: storedLabel, stampId }, ownerKey, signature);
             log('Owner key %s added (vouched by %s)', key, ownerKey);
             return true;
         });
     }
+    /**
+     * The stamp of `key`'s live `OwnerKey` row here, or null when this node holds none: the
+     * insert-if-absent read of {@link insertOwnerKeyVouched} and {@link redeemOwnerGrant}. Inside
+     * the locked body (both reads `retry: false`; see queryStampId's NOTE).
+     *
+     * NOTE: re-adding a removed owner from a machine that still holds its retired physical row
+     * is refused here by name: `OwnerKey` is not reaped, so a machine that received the
+     * tombstone without the delete (see {@link getOwnerKeys}) keeps the row, and an insert there
+     * would collide on the primary key. Re-add from the machine that removed the key, or any
+     * machine the delete reached; if re-adding removed owners becomes routine, the fix is an
+     * `OwnerKey` reap branch, gated so it can never take the table below `MinOneOwner`.
+     *
+     * @throws when this node holds `key`'s row under a retired stamp (above).
+     */
+    async liveOwnerKeyStamp(key) {
+        const heldStamp = await this.queryStampId('OwnerKey', key, false);
+        if (heldStamp === null) {
+            return null;
+        }
+        if ((await this.queryRevokedStamps('OwnerKey', false)).has(heldStamp)) {
+            throw new Error(`Cannot re-add owner key ${key} here: this node still holds the row it was removed under ` +
+                '(OwnerKey rows are not reaped); re-add it from the machine that removed it');
+        }
+        return heldStamp;
+    }
+    /**
+     * The signed-add statement of {@link insertOwnerKeyVouched} and {@link revouchOwnerKey}, the
+     * stored voucher being the signing pair. Bare `exec`: callers hold the write lock, which is
+     * NOT re-entrant.
+     */
+    async execOwnerKeyVouchedInsert(row, ownerKey, signature) {
+        await this.db.exec(`
+      insert into CadreControl.OwnerKey (Key, Label, StampId, VouchOwner, VouchSig)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?)
+    `, [ownerKey, signature, row.key, row.label, row.stampId, ownerKey, signature]);
+    }
     /**
      * Owner-signed removal of one `OwnerKey` row plus the `Revocation` tombstone retiring its
      * stamp, notifying the membership listener once it has committed. The remove branch of
@@ -1708,14 +1852,14 @@ export class ControlDatabase {
     /**
      * Re-vouch a live `OwnerKey` row under this owner's signature: in ONE transaction, the
      * current row's guarded delete plus tombstone ({@link deleteOwnerKey}'s body) and an insert
-     * of the same key under a fresh stamp, signed by `ownerKey` ({@link insertOwnerKeyVouched}'s
-     * body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
+     * of the same key and label under a fresh stamp, signed by `ownerKey`
+     * ({@link insertOwnerKeyVouched}'s body), as {@link rewritePendingJoin} re-seats a request. `OwnerKey` has `NoUpdate`, so
      * this is the only way to rebind a row's voucher; the anchor derivation lets the re-add
      * under a fresh stamp beat the older tombstone (`deriveOwnerAnchor`). For
-     * {@link removeMachine}: the owners a machine being removed had added keep their anchor
-     * place everywhere once their row stands on a remaining owner's signature.
+     * `CadreNode.removeOwner`: the owners a key being removed had added keep their anchor place
+     * everywhere once their row stands on a remaining owner's signature.
      *
-     * Through {@link mutateCadrePeer}, the membership hub. The stamp read runs inside the locked
+     * Through {@link mutateCadrePeer}, the membership hub. The row read runs inside the locked
      * body; a row whose stamp is already retired (held without its delete) is reported as absent
      * rather than tombstoned twice.
      *
@@ -1727,59 +1871,48 @@ export class ControlDatabase {
             throw new Error(`Cannot re-vouch owner key ${key}: an owner cannot re-vouch itself`);
         }
         return await this.mutateCadrePeer('owner-key-revouch', async () => {
-            // retry: false on both reads — inside the locked write body (see queryStampId's NOTE).
-            const stampId = await this.queryStampId('OwnerKey', key, false);
-            if (stampId === null || (await this.queryRevokedStamps('OwnerKey', false)).has(stampId)) {
+            // retry: false — inside the locked write body (see queryStampId's NOTE).
+            const live = (await this.queryOwnerKeyRows(false)).find((row) => row.key === key);
+            if (live === undefined) {
                 log('revouchOwnerKey: %s is not a live owner here (nothing to re-vouch)', key);
                 return false;
             }
-            const removal = signGuardedRemoval(this.config.partyId, 'OwnerKey', key, stampId, signMessage);
-            const freshStampId = generateStampId(this.config.libp2pNode.peerId.toString());
-            const signature = signMessage(ownerKeyAddMessage(this.config.partyId, key, freshStampId));
+            const removal = await signGuardedRemoval(this.config.partyId, 'OwnerKey', key, live.stampId, signMessage);
+            const stampId = generateStampId(this.config.libp2pNode.peerId.toString());
+            const signature = await signMessage(ownerKeyAddMessage(this.config.partyId, key, live.label, stampId));
             await this.inTransaction('revouch OwnerKey', async () => {
                 await this.execGuardedRemoval(removal, ownerKey);
-                await this.db.exec(`
-          insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig)
-            with context OwnerKey = ?, Signature = ?
-            values (?, ?, ?, ?)
-        `, [ownerKey, signature, key, freshStampId, ownerKey, signature]);
+                await this.execOwnerKeyVouchedInsert({ key, label: live.label, stampId }, ownerKey, signature);
             });
-            log('Owner key %s re-vouched by %s (stamp %s retired)', key, ownerKey, stampId);
+            log('Owner key %s re-vouched by %s (stamp %s retired)', key, ownerKey, live.stampId);
             this.notifyGuardedDelete(removal.ref);
             return true;
         });
     }
     /**
-     * Remove one machine completely, in ONE transaction: its `CadrePeer` row, its `OwnerKey`
-     * row when `target.ownerKey` names one, its `DeviceToken` row when it has one, each with
-     * the `Revocation` tombstone retiring its stamp ({@link deleteGuardedRow}'s statement pair,
-     * composed bare as {@link deleteStrandAndPartyKey} composes it), plus a withdrawal tombstone
-     * for every `CadreInvite` in `target.inviteKeys` that is still live here
-     * ({@link withdrawCadreInvite}'s body). One transaction so no reader sees the machine half
-     * removed: a row gone but its push token resolvable, or its owner key gone but an invitation
-     * it could redeem again still open.
+     * Remove one machine completely, in ONE transaction: its `CadrePeer` row and its
+     * `DeviceToken` row when it has one, each with the `Revocation` tombstone retiring its stamp
+     * ({@link deleteGuardedRow}'s statement pair, composed bare as {@link deleteStrandAndPartyKey}
+     * composes it), plus a withdrawal tombstone for every `CadreInvite` in `target.inviteKeys`
+     * that is still live here ({@link withdrawCadreInvite}'s body). One transaction so no reader
+     * sees the machine half removed: a row gone but its push token resolvable, or an invitation
+     * it could redeem again still open. Owner keys are never touched: they are the person's, and
+     * removing one is {@link deleteOwnerKey}.
      *
      * Through {@link mutateCadrePeer}, the membership hub. Every stamp is read inside the locked
      * body, and a row whose stamp is already retired (held without its delete) is skipped rather
-     * than tombstoned twice. The by-name owner refusals of {@link deleteOwnerKey} apply to the
-     * owner-key arm. Nothing to remove writes nothing and returns all false.
-     *
-     * The caller decides WHAT to remove, which owner key is the machine's and which invitations
-     * it could use, from its plan (`CadreNode.planMachineRemoval`); this method only refuses to
-     * write an inconsistent set.
+     * than tombstoned twice. Nothing to remove writes nothing and returns all false.
      *
-     * @throws when `target.ownerKey` is `ownerKey`, or is the only live owner here.
+     * The caller decides which invitations the machine could use, from its plan
+     * (`CadreNode.planMachineRemoval`).
      */
     async removeMachine(target, ownerKey, signMessage) {
-        if (target.ownerKey === ownerKey) {
-            throw new Error(`Cannot remove owner key ${ownerKey}: an owner cannot remove itself`);
-        }
         return await this.mutateCadrePeer('machine-remove', async () => {
-            const removals = await this.signMachineRemovals(target, signMessage);
-            const withdrawals = await this.signCadreInviteWithdrawals(target.inviteKeys, signMessage);
+            const removals = await this.signMachineRemovals(target.peerId, signMessage);
+            const withdrawals = await this.signWithdrawals('CadreInvite', target.inviteKeys, signMessage);
             if (removals.length === 0 && withdrawals.length === 0) {
                 log('removeMachine: nothing live names %s here (already removed)', target.peerId);
-                return { removedPeer: false, removedOwnerKey: false, removedDeviceToken: false, withdrawnInvitations: [] };
+                return { removedPeer: false, removedDeviceToken: false, withdrawnInvitations: [] };
             }
             await this.inTransaction('remove machine', async () => {
                 for (const removal of removals) {
@@ -1799,7 +1932,6 @@ export class ControlDatabase {
             }
             return {
                 removedPeer: removed.has('CadrePeer'),
-                removedOwnerKey: removed.has('OwnerKey'),
                 removedDeviceToken: removed.has('DeviceToken'),
                 withdrawnInvitations: withdrawals.map((withdrawal) => withdrawal.ref.rowKey),
             };
@@ -1807,11 +1939,11 @@ export class ControlDatabase {
     }
     /**
      * The guarded removals {@link removeMachine} runs, signed over each row's current stamp:
-     * the `CadrePeer` row, the `OwnerKey` row when named, the `DeviceToken` row when present.
-     * Inside the locked body (every read `retry: false`); one `Revocation` scan serves the
-     * retired-stamp check for all three tables and the last-owner refusal.
+     * the `CadrePeer` row and the `DeviceToken` row, each when present. Inside the locked body
+     * (every read `retry: false`); one `Revocation` scan serves the retired-stamp check for both
+     * tables.
      */
-    async signMachineRemovals(target, signMessage) {
+    async signMachineRemovals(peerId, signMessage) {
         const retiredByTable = new Map();
         for (const tombstone of await this.queryRevocations(false)) {
             const stamps = retiredByTable.get(tombstone.tableName) ?? new Set();
@@ -1824,24 +1956,12 @@ export class ControlDatabase {
             return stampId !== null && !retired(table).has(stampId) ? stampId : null;
         };
         const removals = [];
-        const peerStamp = await liveStamp('CadrePeer', target.peerId);
-        if (peerStamp !== null) {
-            removals.push(signGuardedRemoval(this.config.partyId, 'CadrePeer', target.peerId, peerStamp, signMessage));
-        }
-        if (target.ownerKey !== null) {
-            const ownerStamp = await liveStamp('OwnerKey', target.ownerKey);
-            if (ownerStamp !== null) {
-                const owners = await this.queryOwnerKeyRows(false, retired('OwnerKey'));
-                if (owners.length <= 1) {
-                    throw new Error(`Cannot remove owner key ${target.ownerKey}: cannot remove the last owner`);
-                }
-                removals.push(signGuardedRemoval(this.config.partyId, 'OwnerKey', target.ownerKey, ownerStamp, signMessage));
+        for (const table of ['CadrePeer', 'DeviceToken']) {
+            const stampId = await liveStamp(table, peerId);
+            if (stampId !== null) {
+                removals.push(await signGuardedRemoval(this.config.partyId, table, peerId, stampId, signMessage));
             }
         }
-        const tokenStamp = await liveStamp('DeviceToken', target.peerId);
-        if (tokenStamp !== null) {
-            removals.push(signGuardedRemoval(this.config.partyId, 'DeviceToken', target.peerId, tokenStamp, signMessage));
-        }
         return removals;
     }
     /**
@@ -1870,18 +1990,18 @@ export class ControlDatabase {
         const peerId = this.config.libp2pNode.peerId.toString();
         const stampId = generateStampId(peerId);
         // Field order MUST match the schema's Strand `AuthorizedInsert` verify:
-        // Id, Type, MemberPrivateKey ('' when null), StampId. FounderOwnerKey is
+        // Id, Type, MemberPrivateKey ('' when null), FounderPeerId, StampId. FounderOwnerKey is
         // deliberately NOT in the digest — the schema binds it by equality to the
         // verified context.OwnerKey instead (see the constraint's comment).
-        const message = buildAuthorizationMessage('CadreControl.Strand', 'add', this.config.partyId, [strandId, type, memberPrivateKey ?? '', stampId]);
-        const signature = signMessage(message);
+        const message = buildAuthorizationMessage('CadreControl.Strand', 'add', this.config.partyId, [strandId, type, memberPrivateKey ?? '', peerId, stampId]);
+        const signature = await signMessage(message);
         // StampId is a real, unique column (single-use anti-replay), no longer a context value.
         // FounderOwnerKey must equal the signing owner or the constraint rejects the row.
         await this.execWrite(`
-      insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey)
+      insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey, FounderPeerId)
         with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?)
-    `, [ownerKey, signature, strandId, type, memberPrivateKey ?? null, stampId, ownerKey], 'strand-insert');
+        values (?, ?, ?, ?, ?, ?)
+    `, [ownerKey, signature, strandId, type, memberPrivateKey ?? null, stampId, ownerKey, peerId], 'strand-insert');
         log('Strand inserted: %s', strandId);
     }
     /**
@@ -1935,10 +2055,10 @@ export class ControlDatabase {
             return false;
         }
         const partyKeyStamp = await this.queryStampId('StrandPartyKey', strandId, false);
-        const strandRemoval = signGuardedRemoval(this.config.partyId, 'Strand', strandId, strandStamp, signMessage);
+        const strandRemoval = await signGuardedRemoval(this.config.partyId, 'Strand', strandId, strandStamp, signMessage);
         const partyKeyRemoval = partyKeyStamp === null
             ? null
-            : signGuardedRemoval(this.config.partyId, 'StrandPartyKey', strandId, partyKeyStamp, signMessage);
+            : await signGuardedRemoval(this.config.partyId, 'StrandPartyKey', strandId, partyKeyStamp, signMessage);
         await this.inTransaction('delete Strand', async () => {
             await this.execGuardedRemoval(strandRemoval, ownerKey);
             if (partyKeyRemoval !== null) {
@@ -1976,7 +2096,7 @@ export class ControlDatabase {
         // Field order MUST match the schema's StrandPartyKey `AuthorizedInsert` verify:
         // Id, PrivateKey, StampId.
         const message = buildAuthorizationMessage('CadreControl.StrandPartyKey', 'add', this.config.partyId, [strandId, privateKey, stampId]);
-        const signature = signMessage(message);
+        const signature = await signMessage(message);
         await this.execWrite(`
       insert into CadreControl.StrandPartyKey (Id, PrivateKey, StampId)
         with context OwnerKey = ?, Signature = ?
@@ -2018,7 +2138,7 @@ export class ControlDatabase {
         // Field order MUST match the schema's JoinedStrand `AuthorizedInsert` verify:
         // Id, Type, MemberPrivateKey ('' when null), StampId.
         const message = buildAuthorizationMessage('CadreControl.JoinedStrand', 'add', this.config.partyId, [row.Id, row.Type, row.MemberPrivateKey ?? '', stampId]);
-        const signature = signMessage(message);
+        const signature = await signMessage(message);
         await this.execWrite(`
       insert into CadreControl.JoinedStrand (Id, Type, MemberPrivateKey, StampId)
         with context OwnerKey = ?, Signature = ?
@@ -2044,7 +2164,7 @@ export class ControlDatabase {
      */
     async insertJoinRequest(request, ownerKey, signMessage) {
         this.ensureInitialized();
-        const { written, insert } = this.signJoinRequestInsert(request, ownerKey, signMessage);
+        const { written, insert } = await this.signJoinRequestInsert(request, ownerKey, signMessage);
         await this.execWrite(insert.sql, insert.params, 'join-request-insert');
         log('Join request inserted: %s', request.Id);
         return { ...written, outcome: null };
@@ -2064,7 +2184,7 @@ export class ControlDatabase {
      */
     async recordJoinOutcome(expected, outcome, ownerKey, signMessage) {
         this.ensureInitialized();
-        const insert = signJoinOutcomeInsert(this.config.partyId, expected.StampId, outcome, ownerKey, signMessage);
+        const insert = await signJoinOutcomeInsert(this.config.partyId, expected.StampId, outcome, ownerKey, signMessage);
         return this.lockedWithRetry(async () => {
             const live = await this.readPendingJoin(expected.Id, false);
             if (live === null || live.StampId !== expected.StampId || live.outcome?.kind !== expected.outcome?.kind) {
@@ -2097,9 +2217,9 @@ export class ControlDatabase {
     async rewritePendingJoin(expectedStampId, next, ownerKey, signMessage) {
         this.ensureInitialized();
         const { outcome, ...request } = next;
-        const removal = signGuardedRemoval(this.config.partyId, 'JoinRequest', next.Id, expectedStampId, signMessage);
-        const { written, insert } = this.signJoinRequestInsert(request, ownerKey, signMessage);
-        const outcomeInsert = outcome === null ? null : signJoinOutcomeInsert(this.config.partyId, written.StampId, outcome, ownerKey, signMessage);
+        const removal = await signGuardedRemoval(this.config.partyId, 'JoinRequest', next.Id, expectedStampId, signMessage);
+        const { written, insert } = await this.signJoinRequestInsert(request, ownerKey, signMessage);
+        const outcomeInsert = outcome === null ? null : await signJoinOutcomeInsert(this.config.partyId, written.StampId, outcome, ownerKey, signMessage);
         return this.lockedWithRetry(async () => {
             // retry: false — this runs inside the locked write body (see queryStampId's NOTE).
             const liveStampId = await this.queryStampId('JoinRequest', next.Id, false);
@@ -2132,9 +2252,9 @@ export class ControlDatabase {
      * Mint a fresh stamp for `request` and the owner signature `JoinRequest.AuthorizedInsert`
      * verifies, returning the row as it will be written and its insert.
      */
-    signJoinRequestInsert(request, ownerKey, signMessage) {
+    async signJoinRequestInsert(request, ownerKey, signMessage) {
         const written = { ...request, StampId: generateStampId(this.config.libp2pNode.peerId.toString()) };
-        const signature = signMessage(buildAuthorizationMessage('CadreControl.JoinRequest', 'add', this.config.partyId, joinRequestAddFields(written)));
+        const signature = await signMessage(buildAuthorizationMessage('CadreControl.JoinRequest', 'add', this.config.partyId, joinRequestAddFields(written)));
         const params = [ownerKey, signature, written.Id, written.Invitation, written.Disclosure, written.RequestedAt, written.ExpiresAt, written.StampId];
         return { written, insert: { sql: JOIN_REQUEST_INSERT_SQL, params } };
     }
@@ -2175,7 +2295,7 @@ export class ControlDatabase {
         const stampId = generateStampId(peerId);
         // Field order MUST match the schema's ValidationKey `AuthorizedInsert` verify: Key, StampId.
         const message = buildAuthorizationMessage('CadreControl.ValidationKey', 'add', this.config.partyId, [key, stampId]);
-        const signature = signMessage(message);
+        const signature = await signMessage(message);
         await this.execWrite(`
       insert into CadreControl.ValidationKey (Key, StampId)
         with context OwnerKey = ?, Signature = ?
@@ -2244,7 +2364,7 @@ export class ControlDatabase {
         // Stamp is minted from the ADMITTED peer's id, not this node's — the nonce names the
         // row it vouches.
         const stampId = generateStampId(row.peerId);
-        const signature = signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [row.peerId, stampId]));
+        const signature = await signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [row.peerId, stampId]));
         return await this.mutateCadrePeer('peer-insert', async () => {
             // retry: false — this guard runs inside the locked write body (see queryStampId's NOTE).
             if (await this.queryStampId('CadrePeer', row.peerId, false) !== null) {
@@ -2305,13 +2425,13 @@ export class ControlDatabase {
      *
      * NOTE: this rebinds VouchOwner to the CALLING owner's key, and the authorized-membership
      * predicate (`CadreNode.listAuthorizedMembers`) now judges rows by that column against each
-     * reader's node-local anchor. Benign today because the only caller — the write-while-alone
-     * drain — re-touches solely rows this node itself authored (`pendingPeerWrites`), so the
-     * voucher is rewritten to the key that already signed it. If a future path ever lets one
-     * owner re-touch a row a DIFFERENT owner vouched, the voucher silently flips: readers that
-     * anchor the original owner but not this one would drop a legitimate member. Such a path
-     * must re-vouch deliberately (or preserve the existing VouchOwner/VouchSig) rather than
-     * inherit this rebinding.
+     * reader's node-local anchor. The two callers rebind on purpose: the write-while-alone drain
+     * re-touches solely rows this node itself authored (`pendingPeerWrites`), so the voucher is
+     * rewritten to the key that already signed it, and `CadreNode.removeOwner` moves rows off a
+     * key it is about to remove. A new caller that re-touches a row a DIFFERENT owner vouched
+     * flips the voucher silently: readers that anchor the original owner but not this one would
+     * drop a legitimate member. It must re-vouch deliberately (or preserve the existing
+     * VouchOwner/VouchSig) rather than inherit this rebinding.
      *
      * @param peerId - the membership row to re-touch.
      * @param updatedAt - the strictly-increasing freshness stamp to write.
@@ -2326,7 +2446,7 @@ export class ControlDatabase {
             log('reauthorizeCadrePeer: no CadrePeer row for %s (nothing to re-touch)', peerId);
             return false;
         }
-        const signature = signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, stampId]));
+        const signature = await signMessage(buildAuthorizationMessage('CadreControl.CadrePeer', 'vouch', this.config.partyId, [peerId, stampId]));
         await this.mutateCadrePeer('peer-reauthorize', async () => {
             // Bare `exec` — inside the non-re-entrant write lock (see insertCadrePeer).
             await this.db.exec(`
@@ -2412,7 +2532,7 @@ export class ControlDatabase {
             log('delete %s: no row for %s (already absent)', table, keyValue);
             return false;
         }
-        const removal = signGuardedRemoval(this.config.partyId, table, keyValue, stampId, signMessage);
+        const removal = await signGuardedRemoval(this.config.partyId, table, keyValue, stampId, signMessage);
         await this.inTransaction(`delete ${table}`, async () => {
             await alongside?.(stampId);
             await this.execGuardedRemoval(removal, ownerKey);
@@ -2445,8 +2565,8 @@ export class ControlDatabase {
     }
     /**
      * File the owner-signed `Revocation` tombstone retiring one row incarnation — the second
-     * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of a
-     * `CadreInvite` withdrawal ({@link withdrawCadreInvite}), whose row stays — or the ledger
+     * statement of every guarded removal ({@link execGuardedRemoval}) and the whole of an
+     * issued row's withdrawal ({@link withdrawIssuedRow}), whose row stays — or the ledger
      * marker ({@link openRevocationLedger}), which retires nothing. The caller supplies the
      * lock and, where one is needed, the transaction.
      *
@@ -2692,17 +2812,20 @@ export class ControlDatabase {
      *
      * Returns how many UPDATE statements ran (`rows.length` on success).
      */
-    reissueRevocations(rows, reissuedAt, ownerKey, signMessage) {
+    async reissueRevocations(rows, reissuedAt, ownerKey, signMessage) {
         this.ensureInitialized();
         // Signatures minted OUTSIDE the locked body: a retried attempt must re-present the
         // exact signed message, never re-mint (the contract on withWriteLock). ReissuedAt
         // rides in the digest as a string — SQL-side it is cast(new.ReissuedAt as text),
         // and every digest field is TEXT on both sides (see buildAuthorizationMessage).
-        const signed = rows.map((row) => ({
-            row,
-            signature: signMessage(buildAuthorizationMessage('CadreControl.Revocation', 'reissue', this.config.partyId, [row.tableName, row.rowKey, row.stampId, String(reissuedAt)])),
-        }));
-        return this.lockedWithRetry(async () => {
+        const signed = [];
+        for (const row of rows) {
+            signed.push({
+                row,
+                signature: await signMessage(buildAuthorizationMessage('CadreControl.Revocation', 'reissue', this.config.partyId, [row.tableName, row.rowKey, row.stampId, String(reissuedAt)])),
+            });
+        }
+        return await this.lockedWithRetry(async () => {
             // Counter lives INSIDE the locked body so a lockedWithRetry re-run (which
             // re-executes the whole body) starts from zero instead of double-counting.
             let executed = 0;
@@ -2766,7 +2889,7 @@ export class ControlDatabase {
      */
     async openRevocationLedger(ownerKey, signMessage) {
         this.ensureInitialized();
-        const signature = signMessage(revocationTombstoneMessage(this.config.partyId, REVOCATION_LEDGER_MARKER));
+        const signature = await signMessage(revocationTombstoneMessage(this.config.partyId, REVOCATION_LEDGER_MARKER));
         try {
             return await this.lockedWithRetry(async () => {
                 if (await this.revocationLedgerFiled()) {
@@ -2876,8 +2999,9 @@ export class ControlDatabase {
      * Covers every write that can change who is a member or an owner: EVERY `CadrePeer`
      * writer, with one documented exception ({@link updateSelfPeerRecord}, which cannot
      * change the snapshot), the `OwnerKey` writers ({@link insertOwnerKeyVouched},
-     * {@link deleteOwnerKey}) and the invitation redemption ({@link redeemCadreInvite}),
-     * which seats both. That is what makes the party-membership snapshot refresh automatic
+     * {@link deleteOwnerKey}), the invitation redemption ({@link redeemCadreInvite}), which
+     * seats both, and the owner-grant redemption ({@link redeemOwnerGrant}). That is what
+     * makes the party-membership snapshot refresh automatic
      * rather than a caller obligation. The name predates the `OwnerKey` writers. A
      * writer necessarily holds the target node's ControlDatabase (the `SeedBootstrapService`'s
      * event callbacks are NOT a viable seam: the temp service `CadreNode.applySeed`
@@ -2988,7 +3112,7 @@ export class ControlDatabase {
      * backoff never stalls the other local writers queued behind it. Safe because every
      * locked body is atomic and re-runnable (the contract on {@link withWriteLock}).
      *
-     * Also carries {@link loadSchema}'s distributed DDL, the one caller that runs BEFORE
+     * Also carries {@link applyControlSchema}'s distributed DDL, the one caller that runs BEFORE
      * `initialized` is set — so it reaches this method directly rather than through
      * {@link execWrite}, whose {@link ensureInitialized} would reject it. The write queue is
      * necessarily empty at that point, so the lock is uncontended there; it is taken anyway
@@ -3144,7 +3268,7 @@ export class ControlDatabase {
         const message = buildAuthorizationMessage('CadreControl.FormationInvite', 'add', this.config.partyId, [
             token, sAppId, expiresAtField, totalUsesField, validationUrlField, strandIdField, stampId,
         ]);
-        const signature = signMessage(message);
+        const signature = await signMessage(message);
         // Persist the canonical ExpiresAt string (datetime parse is idempotent on it) so the
         // signed source-of-truth and the stored value are produced once. StampId is a real,
         // unique column (single-use anti-replay), no longer a context value.
@@ -3217,13 +3341,13 @@ export class ControlDatabase {
             await this.inTransaction('redemption', async () => {
                 // 1. Strand row — authorised by the FormationUsage branch (no owner sig),
                 //    still carrying a fresh unique StampId for the anti-replay column.
-                //    Hard-coded open + keyless + explicit null FounderOwnerKey: the
+                //    Hard-coded open + keyless + explicit null founder columns: the
                 //    consent branch admits no other shape (no signature means no
-                //    trustworthy founder machine to record — see the schema's NOTE).
+                //    trustworthy founder machine to record — see the schema's comment).
                 await this.db.exec(`
-          insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey)
+          insert into CadreControl.Strand (Id, Type, MemberPrivateKey, StampId, FounderOwnerKey, FounderPeerId)
             with context OwnerKey = null, Signature = null
-            values (?, 'o', null, ?, null)
+            values (?, 'o', null, ?, null, null)
         `, [strandId, strandStampId]);
                 // 2. FormationUsage row — authorised by the matching FormationInvite, and
                 //    carrying the strand's stamp so it authorizes THIS row and no other.
@@ -3492,73 +3616,116 @@ export class ControlDatabase {
      * private half to the invitee out of band. It is never stored here (`Strand.Invite` has the
      * same shape).
      *
-     * @param invite.key - the invitation public key (base64url ed25519), the row's primary key
-     * @param invite.peerId - the device the invitation is for, or null for whoever redeems first
-     * @param invite.grantsOwner - whether redemption also seats an `OwnerKey` row for the device
-     * @param invite.expiresAtMs - epoch ms after which it cannot be redeemed; omit for never
-     * @param invite.totalUses - how many redemptions it allows; omit for unlimited
      * @returns the row as stored, `expiresAt` in its canonical form
      */
     async insertCadreInvite(invite, ownerKey, signMessage) {
+        const row = await this.signCadreInvite(invite, ownerKey, signMessage);
+        await this.lockedWithRetry(() => this.execCadreInviteInsert(row), {}, 'cadre-invite-insert');
+        log('Cadre invitation inserted: %s (peer=%s)', row.key, row.peerId ?? 'any');
+        return row;
+    }
+    /**
+     * Build and owner-sign a `CadreInvite` row WITHOUT inserting it: the signing half of
+     * {@link insertCadreInvite}, which `CadreNode.joinWithOwnerGrant` uses alone for the
+     * invitation a node issues to itself, since a store that holds no `OwnerKey` row for the
+     * issuer would refuse the local insert and the row is seated at a member from the bundle
+     * instead. `ExpiresAt` is canonicalized by this database's engine, which is a format, not a
+     * store, so the row reads the same wherever it is seated.
+     */
+    async signCadreInvite(invite, ownerKey, signMessage) {
         this.ensureInitialized();
         const key = requireEd25519PublicKeyB64(invite.key, 'cadre invitation key');
         const signed = {
             key,
             peerId: invite.peerId ?? null,
-            grantsOwner: invite.grantsOwner,
             expiresAt: invite.expiresAtMs == null ? null : await canonicalDatetime(this.db, invite.expiresAtMs),
             totalUses: invite.totalUses ?? null,
             stampId: generateStampId(this.config.libp2pNode.peerId.toString()),
         };
-        const row = {
+        return {
             ...signed,
             issuerKey: ownerKey,
-            issuerSig: signMessage(cadreInviteAddMessage(this.config.partyId, signed)),
+            issuerSig: await signMessage(cadreInviteAddMessage(this.config.partyId, signed)),
         };
-        await this.lockedWithRetry(() => this.execCadreInviteInsert(row), {}, 'cadre-invite-insert');
-        log('Cadre invitation inserted: %s (peer=%s owner=%s)', key, row.peerId ?? 'any', row.grantsOwner);
-        return row;
     }
     /**
      * Seat an owner-signed `CadreInvite` row received inside an invitation bundle, under its own
      * stored `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, so a member that
-     * already holds the row (by replication, or from an earlier redemption attempt) is a no-op.
+     * already holds the row (by replication, or from an earlier redemption attempt) is a no-op,
+     * and so is one whose insert the cohort refuses because a member there holds it.
      *
      * @returns `true` when this call inserted the row, `false` when it was already present.
      * @throws {CadreInviteIssuerUnknownError} when `CadreInvite.AuthorizedInsert` refuses it: the
      *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
-     *   not verify. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     *   not verify. {@link IssuedRowNotHereYetError} when the cohort holds the row and this node
+     *   cannot read it yet. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
      */
     async seatCadreInvite(row) {
+        return this.seatIssuedRow('CadreInvite', row.key, () => this.execCadreInviteInsert(row), cause => new CadreInviteIssuerUnknownError(row.key, row.issuerKey, { cause }));
+    }
+    /**
+     * Insert-if-absent of an issued row from a bundle's copy, under the write lock: the body of
+     * {@link seatCadreInvite} and {@link seatOwnerGrant}. `exec` runs the bare insert under the
+     * row's own stored issuer pair.
+     *
+     * @returns `true` when this call inserted the row, `false` when it was already present —
+     *   here, or at the cohort member that refused the insert for holding it
+     *   ({@link adoptCohortHeldRow}).
+     * @throws `refuse(cause)` when the table's `AuthorizedInsert` refuses the row;
+     *   {@link IssuedRowNotHereYetError} when the cohort holds the row and this node still cannot
+     *   read it; every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     */
+    async seatIssuedRow(table, key, exec, refuse) {
         this.ensureInitialized();
         try {
             return await this.lockedWithRetry(async () => {
                 // retry: false — inside the locked write body (see queryStampId's NOTE).
-                if (await this.queryStampId('CadreInvite', row.key, false) !== null) {
-                    log('CadreInvite %s already seated; seat skipped', row.key);
+                if (await this.queryStampId(table, key, false) !== null) {
+                    log('%s %s already seated; seat skipped', table, key);
                     return false;
                 }
-                await this.execCadreInviteInsert(row);
-                log('Cadre invitation seated from its bundle: %s', row.key);
+                await exec();
+                log('%s seated from its bundle: %s', table, key);
                 return true;
-            }, {}, 'cadre-invite-seat');
+            }, {}, `${ISSUED_TABLE_REASON[table]}-seat`);
         }
         catch (error) {
-            if (errorChainMatches(error, CADRE_INVITE_UNAUTHORIZED)) {
-                throw new CadreInviteIssuerUnknownError(row.key, row.issuerKey, { cause: error });
+            if (errorChainMatches(error, ISSUER_UNAUTHORIZED)) {
+                throw refuse(error);
+            }
+            if (isIssuedRowKeyConflict(error, table)) {
+                return await this.adoptCohortHeldRow(table, key, error);
             }
             throw error;
         }
     }
+    /**
+     * The seat's insert was refused because a cohort member already holds a row under `key`, which
+     * this node's guard read missed because its store lags the cohort. A bundle's copy is verbatim
+     * and every column is under the issuer's signature, so the held row is this one: it counts as
+     * seated once a refreshing read (unlocked, so retried as any read) finds it here.
+     *
+     * @throws {IssuedRowNotHereYetError} when the read still does not find it.
+     */
+    async adoptCohortHeldRow(table, key, conflict) {
+        // NOTE: while another locked body runs here, this read takes readRowsOnce's committed path,
+        // which does not refresh from the cohort, so it can miss the row and refuse a retryable
+        // `conflict`; if that refusal shows up in practice, wait for the running body before reading.
+        if (await this.queryStampId(table, key) === null) {
+            throw new IssuedRowNotHereYetError(table, key, { cause: conflict });
+        }
+        log('%s %s is held by the cohort; seat skipped', table, key);
+        return false;
+    }
     /** Bare `CadreInvite` insert shared by {@link insertCadreInvite} and {@link seatCadreInvite}; the caller holds the lock. */
     async execCadreInviteInsert(row) {
         await this.db.exec(`
-      insert into CadreControl.CadreInvite (Key, PeerId, GrantsOwner, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
+      insert into CadreControl.CadreInvite (Key, PeerId, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
         with context OwnerKey = ?, Signature = ?
-        values (?, ?, ?, ?, ?, ?, ?, ?)
+        values (?, ?, ?, ?, ?, ?, ?)
     `, [
             row.issuerKey, row.issuerSig,
-            row.key, row.peerId, row.grantsOwner ? 1 : 0, row.expiresAt, row.totalUses,
+            row.key, row.peerId, row.expiresAt, row.totalUses,
             row.issuerKey, row.issuerSig, row.stampId,
         ]);
     }
@@ -3596,7 +3763,7 @@ export class ControlDatabase {
      */
     async queryCadreInviteUsages(retry = true) {
         this.ensureInitialized();
-        const rows = await this.readRows('select UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig from CadreControl.CadreInviteUsage', undefined, 'cadre-invite-usages', retry);
+        const rows = await this.readRows('select UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, InviteSig, PeerSig from CadreControl.CadreInviteUsage', undefined, 'cadre-invite-usages', retry);
         return rows.map(cadreInviteUsageRowOf);
     }
     /**
@@ -3607,9 +3774,12 @@ export class ControlDatabase {
      * `retry: false` is passed by {@link assertCadreInviteSeatRemains}, inside the locked body.
      */
     async countCadreInviteUsage(key, retry = true) {
+        return this.countUsageRows('select count(1) as Count from CadreControl.CadreInviteUsage where InviteKey = ?', key, 'cadre-invite-usage-count', retry);
+    }
+    /** The one-row count read behind {@link countCadreInviteUsage} and {@link countOwnerGrantUsage}. */
+    async countUsageRows(sql, key, label, retry) {
         this.ensureInitialized();
-        const sql = 'select count(1) as Count from CadreControl.CadreInviteUsage where InviteKey = ?';
-        for (const row of await this.readRows(sql, [key], 'cadre-invite-usage-count', retry)) {
+        for (const row of await this.readRows(sql, [key], label, retry)) {
             return row.Count ?? 0;
         }
         return 0;
@@ -3640,7 +3810,7 @@ export class ControlDatabase {
         const metered = [];
         let unlimitedLive = false;
         for (const row of await this.readRows('select Key, ExpiresAt, TotalUses, IssuerKey, StampId from CadreControl.CadreInvite', undefined, 'live-cadre-invites')) {
-            const open = cadreInviteStillOpen({ stampId: row.StampId, issuerKey: row.IssuerKey, expiresAt: row.ExpiresAt ?? null }, withdrawn, owners, nowMs);
+            const open = issuedRowStillOpen({ stampId: row.StampId, issuerKey: row.IssuerKey, expiresAt: row.ExpiresAt ?? null }, withdrawn, owners, nowMs);
             if (!open) {
                 continue;
             }
@@ -3677,14 +3847,21 @@ export class ControlDatabase {
     async isCadreInviteLive(invite, nowMs = Date.now()) {
         this.ensureInitialized();
         const row = await this.queryCadreInvite(invite.key) ?? (verifyCadreInviteRow(this.config.partyId, invite) ? invite : null);
+        return this.issuedRowLive('CadreInvite', row, nowMs, key => this.countCadreInviteUsage(key));
+    }
+    /**
+     * The body of {@link isCadreInviteLive} and {@link isOwnerGrantLive}: is `row` (the one held,
+     * or a verified bundle copy; null for neither) still open and under its use cap?
+     */
+    async issuedRowLive(table, row, nowMs, countUsage) {
         if (row === null) {
             return false;
         }
-        const [withdrawn, owners] = await Promise.all([this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()]);
-        if (!cadreInviteStillOpen(row, withdrawn, owners, nowMs)) {
+        const [withdrawn, owners] = await Promise.all([this.queryRevokedStamps(table), this.getOwnerKeys()]);
+        if (!issuedRowStillOpen(row, withdrawn, owners, nowMs)) {
             return false;
         }
-        return row.totalUses === null || await this.countCadreInviteUsage(row.key) < row.totalUses;
+        return row.totalUses === null || await countUsage(row.key) < row.totalUses;
     }
     /**
      * Every `CadreInvite` row this node holds with its standing: how many redemptions are
@@ -3694,22 +3871,28 @@ export class ControlDatabase {
      * occasional read, not a gate's.
      */
     async listCadreInviteStatuses(nowMs = Date.now()) {
+        const standings = await this.issuedRowStandings('CadreInvite', await this.queryCadreInvites(), nowMs, key => this.countCadreInviteUsage(key));
+        return standings.map(({ row, ...standing }) => ({ invite: row, ...standing }));
+    }
+    /**
+     * The body of {@link listCadreInviteStatuses} and {@link listOwnerGrantStatuses}: each of
+     * `rows` with its withdrawal, its recorded uses and whether it is still redeemable.
+     */
+    async issuedRowStandings(table, rows, nowMs, countUsage) {
         this.ensureInitialized();
-        const [invites, withdrawnStamps, owners] = await Promise.all([
-            this.queryCadreInvites(), this.queryRevokedStamps('CadreInvite'), this.getOwnerKeys()
-        ]);
-        const statuses = [];
-        // NOTE: one retried count read per invitation, withdrawn and expired rows included, since
-        // rows are never deleted; if a long-lived cadre's listing ever shows as slow, group the
-        // usage counts in one statement or skip the count for rows that are no longer open.
-        for (const invite of invites) {
-            const usesRecorded = await this.countCadreInviteUsage(invite.key);
-            const withdrawn = withdrawnStamps.has(invite.stampId);
-            const live = cadreInviteStillOpen(invite, withdrawnStamps, owners, nowMs)
-                && (invite.totalUses === null || usesRecorded < invite.totalUses);
-            statuses.push({ invite, live, withdrawn, usesRecorded });
+        const [withdrawnStamps, owners] = await Promise.all([this.queryRevokedStamps(table), this.getOwnerKeys()]);
+        const standings = [];
+        // NOTE: one retried count read per row, withdrawn and expired rows included, since rows
+        // are never deleted; if a long-lived cadre's listing ever shows as slow, group the usage
+        // counts in one statement or skip the count for rows that are no longer open.
+        for (const row of rows) {
+            const usesRecorded = await countUsage(row.key);
+            const withdrawn = withdrawnStamps.has(row.stampId);
+            const live = issuedRowStillOpen(row, withdrawnStamps, owners, nowMs)
+                && (row.totalUses === null || usesRecorded < row.totalUses);
+            standings.push({ row, live, withdrawn, usesRecorded });
         }
-        return statuses;
+        return standings;
     }
     /**
      * Owner-signed WITHDRAWAL of a cadre invitation: file the `Revocation` tombstone retiring its
@@ -3729,59 +3912,66 @@ export class ControlDatabase {
      * node was alone is queued for re-issue on cohort growth ({@link CadreNode.noteGuardedDelete}).
      */
     async withdrawCadreInvite(key, ownerKey, signMessage) {
+        return this.withdrawIssuedRow('CadreInvite', key, ownerKey, signMessage);
+    }
+    /**
+     * The body of {@link withdrawCadreInvite} and {@link withdrawOwnerGrant}: under the write
+     * lock, file the owner-signed tombstone retiring the row's stamp with the row kept, and fire
+     * the guarded-delete listener for it (so a withdrawal made while alone is re-issued).
+     */
+    async withdrawIssuedRow(table, key, ownerKey, signMessage) {
         this.ensureInitialized();
         const filed = await this.lockedWithRetry(async () => {
-            const [withdrawal] = await this.signCadreInviteWithdrawals([key], signMessage);
+            const [withdrawal] = await this.signWithdrawals(table, [key], signMessage);
             if (withdrawal === undefined) {
                 return null;
             }
             await this.execTombstone(withdrawal.ref, withdrawal.signature, ownerKey);
             return withdrawal.ref;
-        }, {}, 'cadre-invite-withdraw');
+        }, {}, `${ISSUED_TABLE_REASON[table]}-withdraw`);
         if (filed === null) {
             return false;
         }
-        log('Cadre invitation withdrawn: %s (stamp %s retired, row kept)', key, filed.stampId);
+        log('%s withdrawn: %s (stamp %s retired, row kept)', table, key, filed.stampId);
         this.notifyGuardedDelete(filed);
         return true;
     }
     /**
-     * The withdrawal tombstones for the `CadreInvite` rows among `keys` that are held here and
-     * not yet withdrawn, signed and ready for {@link execTombstone}: the body
-     * {@link withdrawCadreInvite} files one of and {@link removeMachine} files several of in one
+     * The withdrawal tombstones for the `table` rows among `keys` that are held here and not
+     * yet withdrawn, signed and ready for {@link execTombstone}: the body
+     * {@link withdrawIssuedRow} files one of and {@link removeMachine} files several of in one
      * transaction. Inside the locked body (every read `retry: false`); an absent or already
      * withdrawn key is logged and left out.
      */
-    async signCadreInviteWithdrawals(keys, signMessage) {
+    async signWithdrawals(table, keys, signMessage) {
         if (keys.length === 0) {
             return [];
         }
-        const withdrawn = await this.queryRevokedStamps('CadreInvite', false);
+        const withdrawn = await this.queryRevokedStamps(table, false);
         const withdrawals = [];
         for (const key of keys) {
-            const stampId = await this.queryStampId('CadreInvite', key, false);
+            const stampId = await this.queryStampId(table, key, false);
             if (stampId === null) {
-                log('withdrawCadreInvite: no CadreInvite row for %s (nothing to withdraw)', key);
+                log('withdraw %s: no row for %s (nothing to withdraw)', table, key);
                 continue;
             }
             if (withdrawn.has(stampId)) {
-                log('withdrawCadreInvite: %s already withdrawn (stamp %s retired)', key, stampId);
+                log('withdraw %s: %s already withdrawn (stamp %s retired)', table, key, stampId);
                 continue;
             }
-            const ref = { tableName: 'CadreInvite', rowKey: key, stampId };
-            withdrawals.push({ ref, signature: signMessage(revocationTombstoneMessage(this.config.partyId, ref)) });
+            const ref = { tableName: table, rowKey: key, stampId };
+            withdrawals.push({ ref, signature: await signMessage(revocationTombstoneMessage(this.config.partyId, ref)) });
         }
         return withdrawals;
     }
     /**
-     * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member and,
-     * when the invitation grants ownership, as an owner — with NO owner signature. One
-     * transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`), the
-     * `OwnerKey` row when granted (consent branch of `Authorized`), and last the
-     * `CadreInviteUsage` row that authorizes both; the usage row's own checks (`PeerExists`,
-     * `OwnerExists`) read the rows back, so the three are mutually bound to this exact
-     * redemption and none can be held in reserve. The invitation must already be committed
-     * ({@link seatCadreInvite}): every consent branch reads `committed.CadreInvite`.
+     * Redeem a seated `CadreInvite` on the owner's behalf: admit `peerId` as a cadre member —
+     * with NO owner signature, and as a machine only (ownership is {@link redeemOwnerGrant}'s).
+     * One transaction writes the `CadrePeer` row (consent branch of `AuthorizedInsert`) and then
+     * the `CadreInviteUsage` row that authorizes it; the usage row's own check (`PeerExists`)
+     * reads the peer row back, so the two are mutually bound to this exact redemption and
+     * neither can be held in reserve. The invitation must already be committed
+     * ({@link seatCadreInvite}): the consent branch reads `committed.CadreInvite`.
      *
      * The two signatures are the holder's and the device's, minted on the device over
      * {@link cadreInviteRedeemMessage} / {@link cadreInviteConsentMessage}; this machine only
@@ -3790,18 +3980,17 @@ export class ControlDatabase {
      * (`verifyInvitationAdmission`) — a mismatched pair is written and then never trusted.
      *
      * Idempotent for a retry after a dropped reply: when the device's row is already present
-     * (and its `OwnerKey` row too, when granted) nothing is written and no seat is spent —
-     * `alreadyMember: true`. A present row whose `OwnerKey` row is missing under an
-     * owner-granting invitation is completed: the usage row then names the existing peer stamp.
-     * The seat check ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a
-     * single-use redemption is answered `alreadyMember` rather than refused as exhausted.
+     * nothing is written and no seat is spent — `alreadyMember: true`. The seat check
+     * ({@link assertCadreInviteSeatRemains}) runs after that, so the retry of a single-use
+     * redemption is answered `alreadyMember` rather than refused as exhausted.
      *
      * Through {@link mutateCadrePeer}, so the membership hub is notified; inside the locked body
      * every read passes `retry: false` and every stamp is minted per attempt, so a
      * {@link lockedWithRetry} re-run starts clean.
      *
      * @throws {InvitationExhaustedError} when the invitation's seats are all spent (by name,
-     *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains}).
+     *   ahead of the schema's generic `Authorized` refusal — see {@link assertSeatRemains});
+     *   {@link IssuedRowNotHereYetError} when no `CadreInvite` row is readable here.
      */
     async redeemCadreInvite(params) {
         this.ensureInitialized();
@@ -3812,57 +4001,37 @@ export class ControlDatabase {
         return this.mutateCadrePeer('cadre-invite-redeem', async () => {
             const invite = await this.queryCadreInvite(inviteKey, false);
             if (invite === null) {
-                throw new Error(`Cannot redeem cadre invitation ${inviteKey}: no CadreInvite row is seated on this node (seatCadreInvite first)`);
+                throw new IssuedRowNotHereYetError('CadreInvite', inviteKey);
             }
-            const seated = await this.readSeatedAdmission(peerId, peerKey, invite.grantsOwner);
-            if (seated.peerStampId !== null && (!invite.grantsOwner || seated.ownerStampId !== null)) {
+            // A raw stamp read (queryStampId), so a physically present row counts; inside the locked
+            // body, so never retried.
+            const seatedPeerStampId = await this.queryStampId('CadrePeer', peerId, false);
+            if (seatedPeerStampId !== null) {
                 log('redeemCadreInvite: %s already admitted; nothing written', peerId);
-                return { alreadyMember: true, peerStampId: seated.peerStampId, ownerStampId: seated.ownerStampId };
+                return { alreadyMember: true, peerStampId: seatedPeerStampId };
             }
             await this.assertCadreInviteSeatRemains(invite);
-            // Stamps minted from the ADMITTED device's id, as insertCadrePeer does: the nonce names
-            // the row it seats. Minted inside the body, so a re-run mints afresh over a rolled-back
-            // attempt rather than re-presenting a stamp the usage row may already name.
-            const peerStampId = seated.peerStampId ?? generateStampId(peerId);
-            const ownerStampId = invite.grantsOwner ? (seated.ownerStampId ?? generateStampId(peerId)) : null;
+            // The stamp is minted from the ADMITTED device's id, as insertCadrePeer does: the nonce
+            // names the row it seats. Minted inside the body, so a re-run mints afresh over a
+            // rolled-back attempt rather than re-presenting a stamp the usage row may already name.
+            const peerStampId = generateStampId(peerId);
             const nowCanonical = await canonicalDatetime(this.db, nowMs);
             await this.inTransaction('cadre-invite-redeem', async () => {
-                if (seated.peerStampId === null) {
-                    await this.db.exec(`
-            insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig, VouchUsage)
-              with context OwnerKey = null, Signature = null
-              values (?, ?, ?, ?, null, ?, ?, null, ?)
-          `, [peerId, peerKey, multiaddr, nowMs, peerStampId, invite.issuerKey, usageStampId]);
-                }
-                if (ownerStampId !== null && seated.ownerStampId === null) {
-                    await this.db.exec(`
-            insert into CadreControl.OwnerKey (Key, StampId, VouchOwner, VouchSig, VouchUsage)
-              with context OwnerKey = null, Signature = null
-              values (?, ?, ?, null, ?)
-          `, [peerKey, ownerStampId, invite.issuerKey, usageStampId]);
-                }
                 await this.db.exec(`
-          insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, OwnerStampId, InviteSig, PeerSig)
+          insert into CadreControl.CadrePeer (PeerId, PublicKey, Multiaddr, UpdatedAt, Sig, StampId, VouchOwner, VouchSig, VouchUsage)
+            with context OwnerKey = null, Signature = null
+            values (?, ?, ?, ?, null, ?, ?, null, ?)
+        `, [peerId, peerKey, multiaddr, nowMs, peerStampId, invite.issuerKey, usageStampId]);
+                await this.db.exec(`
+          insert into CadreControl.CadreInviteUsage (UsageStampId, InviteKey, PeerId, PeerKey, PeerStampId, InviteSig, PeerSig)
             with context Now = ?
-            values (?, ?, ?, ?, ?, ?, ?, ?)
-        `, [nowCanonical, usageStampId, inviteKey, peerId, peerKey, peerStampId, ownerStampId, inviteSig, peerSig]);
+            values (?, ?, ?, ?, ?, ?, ?)
+        `, [nowCanonical, usageStampId, inviteKey, peerId, peerKey, peerStampId, inviteSig, peerSig]);
             });
-            log('Redeemed cadre invitation %s: %s admitted (owner=%s, usage %s)', inviteKey, peerId, ownerStampId !== null, usageStampId);
-            return { alreadyMember: false, peerStampId, ownerStampId };
+            log('Redeemed cadre invitation %s: %s admitted (usage %s)', inviteKey, peerId, usageStampId);
+            return { alreadyMember: false, peerStampId };
         });
     }
-    /**
-     * The rows a redemption would seat that are already present: the device's `CadrePeer`
-     * stamp, and — only when the invitation grants ownership — its `OwnerKey` stamp. Raw stamp
-     * reads ({@link queryStampId}), so a physically present row counts; inside the locked
-     * body, so never retried.
-     */
-    async readSeatedAdmission(peerId, peerKey, grantsOwner) {
-        return {
-            peerStampId: await this.queryStampId('CadrePeer', peerId, false),
-            ownerStampId: grantsOwner ? await this.queryStampId('OwnerKey', peerKey, false) : null,
-        };
-    }
     /**
      * Refuse a redemption that would consume a seat the cadre invitation does not have, by
      * name ({@link InvitationExhaustedError}) — the cadre-invitation twin of
@@ -3870,15 +4039,225 @@ export class ControlDatabase {
      * generic `Authorized` failure a caller would otherwise report as retryable. Reads the
      * committed count inside the locked body, so on a same-node race the loser is refused here.
      */
-    async assertCadreInviteSeatRemains(invite) {
-        if (invite.totalUses === null) {
+    assertCadreInviteSeatRemains(invite) {
+        return this.assertIssuedSeatRemains(invite, key => this.countCadreInviteUsage(key, false));
+    }
+    /** The body of {@link assertCadreInviteSeatRemains} and {@link assertOwnerGrantSeatRemains}; `countUsage` reads inside the locked body. */
+    async assertIssuedSeatRemains(row, countUsage) {
+        if (row.totalUses === null) {
             return;
         }
-        const used = await this.countCadreInviteUsage(invite.key, false);
-        if (used >= invite.totalUses) {
-            throw new InvitationExhaustedError(invite.key, used, invite.totalUses);
+        const used = await countUsage(row.key);
+        if (used >= row.totalUses) {
+            throw new InvitationExhaustedError(row.key, used, row.totalUses);
         }
     }
+    // ── Owner grants (OwnerGrant / OwnerGrantUsage) ─────────────────────────────────────────
+    /**
+     * Mint and insert an owner-signed `OwnerGrant`: a grant of ownership to whoever holds the
+     * grant's private half, redeemable through any member machine ({@link redeemOwnerGrant})
+     * to seat an owner key the holder generates or already holds. No machine is admitted and no
+     * peer id is named. The grant twin of {@link insertCadreInvite}: the owner signs the whole
+     * row ({@link ownerGrantAddMessage}), `ExpiresAt` through {@link canonicalDatetime}, and
+     * the returned row is what the grant bundle carries, re-inserted verbatim by
+     * {@link seatOwnerGrant} on a member that has not received it by replication.
+     *
+     * @param grant.key - the grant's ed25519 PUBLIC key (base64url), the row's primary key; the
+     *   caller minted the pair and hands the private half to the holder out of band
+     * @param grant.label - the label every key this grant seats will carry
+     *   ({@link ownerKeyLabel}'s rule: trimmed, at most 64 characters, blank meaning none); the
+     *   issuer's choice, which the holder cannot change
+     * @param grant.expiresAtMs - epoch ms after which it cannot be redeemed; omit or null for
+     *   never. The short default lifetime is the node API's to apply, not this writer's.
+     * @param grant.totalUses - how many redemptions it allows; omit for unlimited
+     * @returns the row as stored, `expiresAt` in its canonical form
+     */
+    async insertOwnerGrant(grant, ownerKey, signMessage) {
+        this.ensureInitialized();
+        const key = requireEd25519PublicKeyB64(grant.key, 'owner grant key');
+        const signed = {
+            key,
+            label: ownerKeyLabel(grant.label),
+            expiresAt: grant.expiresAtMs == null ? null : await canonicalDatetime(this.db, grant.expiresAtMs),
+            totalUses: grant.totalUses ?? null,
+            stampId: generateStampId(this.config.libp2pNode.peerId.toString()),
+        };
+        const row = {
+            ...signed,
+            issuerKey: ownerKey,
+            issuerSig: await signMessage(ownerGrantAddMessage(this.config.partyId, signed)),
+        };
+        await this.lockedWithRetry(() => this.execOwnerGrantInsert(row), {}, 'owner-grant-insert');
+        log('Owner grant inserted: %s (label=%s)', key, row.label ?? 'none');
+        return row;
+    }
+    /**
+     * Seat an owner-signed `OwnerGrant` row received inside a grant bundle, under its own stored
+     * `IssuerKey`/`IssuerSig` as the write context — insert-if-absent, as {@link seatCadreInvite}.
+     *
+     * @returns `true` when this call inserted the row, `false` when it was already present.
+     * @throws {OwnerGrantIssuerUnknownError} when `OwnerGrant.AuthorizedInsert` refuses it: the
+     *   issuer is not an owner on this node (not replicated yet, or removed), or the signature does
+     *   not verify. {@link IssuedRowNotHereYetError} when the cohort holds the row and this node
+     *   cannot read it yet. Every other refusal (a withdrawn stamp, `NotRevoked`) propagates as is.
+     */
+    async seatOwnerGrant(row) {
+        return this.seatIssuedRow('OwnerGrant', row.key, () => this.execOwnerGrantInsert(row), cause => new OwnerGrantIssuerUnknownError(row.key, row.issuerKey, { cause }));
+    }
+    /** Bare `OwnerGrant` insert shared by {@link insertOwnerGrant} and {@link seatOwnerGrant}; the caller holds the lock. */
+    async execOwnerGrantInsert(row) {
+        await this.db.exec(`
+      insert into CadreControl.OwnerGrant (Key, Label, ExpiresAt, TotalUses, IssuerKey, IssuerSig, StampId)
+        with context OwnerKey = ?, Signature = ?
+        values (?, ?, ?, ?, ?, ?, ?)
+    `, [
+            row.issuerKey, row.issuerSig,
+            row.key, row.label, row.expiresAt, row.totalUses,
+            row.issuerKey, row.issuerSig, row.stampId,
+        ]);
+    }
+    /**
+     * Read one `OwnerGrant` row by key, or null when absent. Withdrawn rows are returned too,
+     * as {@link queryCadreInvite} returns them: the row is the holder's proof and never goes
+     * away. `retry: false` is passed by {@link redeemOwnerGrant}, inside its locked body.
+     */
+    async queryOwnerGrant(key, retry = true) {
+        this.ensureInitialized();
+        for (const row of await this.readRows(`${OWNER_GRANT_SELECT_SQL} where Key = ?`, [key], 'owner-grant', retry)) {
+            return ownerGrantRowOf(row);
+        }
+        return null;
+    }
+    /**
+     * Every `OwnerGrant` row this node holds, withdrawn and expired ones included. Read by the
+     * anchor sync when at least one `OwnerKey` row is consent-seated (`CadreNode.loadOwnerGrantChain`);
+     * `retry: false` is forwarded from the membership-gate refresh for {@link queryCadrePeers}' reason.
+     */
+    async queryOwnerGrants(retry = true) {
+        this.ensureInitialized();
+        const rows = await this.readRows(OWNER_GRANT_SELECT_SQL, undefined, 'owner-grants', retry);
+        return rows.map(ownerGrantRowOf);
+    }
+    /** Every `OwnerGrantUsage` row this node holds — the redemption records a grant-seated `OwnerKey` row is verified against. Same `retry` contract as {@link queryOwnerGrants}. */
+    async queryOwnerGrantUsages(retry = true) {
+        this.ensureInitialized();
+        const rows = await this.readRows('select UsageStampId, GrantKey, SeatedKey, SeatedStampId, GrantSig, OwnerSig from CadreControl.OwnerGrantUsage', undefined, 'owner-grant-usages', retry);
+        return rows.map(ownerGrantUsageRowOf);
+    }
+    /**
+     * How many times an owner grant has been redeemed (its `OwnerGrantUsage` rows), served
+     * through the `OwnerGrantUsageByGrant` index. A permissive PRE-check like
+     * {@link countCadreInviteUsage}: the cap is `OwnerGrantUsage.Authorized`'s own committed count.
+     */
+    async countOwnerGrantUsage(key, retry = true) {
+        return this.countUsageRows('select count(1) as Count from CadreControl.OwnerGrantUsage where GrantKey = ?', key, 'owner-grant-usage-count', retry);
+    }
+    /**
+     * Is this one owner grant still redeemable here — not withdrawn, unexpired, uses left, issuer
+     * still an owner — judged as {@link isCadreInviteLive} judges an invitation: by the row this
+     * node holds under `grant.key`, else by `grant` itself (a bundle's copy, not seated yet)
+     * when its issuer signature verifies. A permissive pre-check; {@link seatOwnerGrant} and the
+     * redemption's own write enforce every condition.
+     */
+    async isOwnerGrantLive(grant, nowMs = Date.now()) {
+        this.ensureInitialized();
+        const row = await this.queryOwnerGrant(grant.key) ?? (verifyOwnerGrantRow(this.config.partyId, grant) ? grant : null);
+        return this.issuedRowLive('OwnerGrant', row, nowMs, key => this.countOwnerGrantUsage(key));
+    }
+    /**
+     * Every `OwnerGrant` row this node holds with its standing — recorded redemptions, withdrawal,
+     * and whether it is still redeemable — for an owner's listing, as {@link listCadreInviteStatuses}.
+     */
+    async listOwnerGrantStatuses(nowMs = Date.now()) {
+        const standings = await this.issuedRowStandings('OwnerGrant', await this.queryOwnerGrants(), nowMs, key => this.countOwnerGrantUsage(key));
+        return standings.map(({ row, ...standing }) => ({ grant: row, ...standing }));
+    }
+    /**
+     * Owner-signed WITHDRAWAL of an owner grant: file the `Revocation` tombstone retiring its
+     * stamp, with the row kept, exactly as {@link withdrawCadreInvite} withdraws an invitation
+     * and for the same reason (every key the grant seated proves itself through the row;
+     * `OwnerGrant.NoDelete`, `Revocation.RowIsGone`). Afterwards `OwnerGrantUsage.Authorized`
+     * refuses every further redemption and `OwnerGrant.NotRevoked` refuses re-seating the
+     * holder's copy on any node holding the tombstone. Keys already seated stay owners;
+     * removing one is {@link deleteOwnerKey}.
+     *
+     * Idempotent: `false` (nothing written) when the row is absent here or already withdrawn,
+     * `true` when this call filed the tombstone. Fires the guarded-delete listener, so a
+     * withdrawal committed while alone is re-issued on cohort growth.
+     */
+    async withdrawOwnerGrant(key, ownerKey, signMessage) {
+        return this.withdrawIssuedRow('OwnerGrant', key, ownerKey, signMessage);
+    }
+    /**
+     * Redeem a seated `OwnerGrant` on the issuer's behalf: seat `seatedKey` as an owner with NO
+     * owner signature. One transaction writes the `OwnerKey` row (the grant branch of
+     * `Authorized`: `VouchOwner` the issuer, `VouchSig` null, `VouchUsage` the usage stamp,
+     * `Label` the grant's) and then the `OwnerGrantUsage` row that authorizes it; the usage
+     * row's `SeatedExists` reads the owner row back, so the two are bound to this exact
+     * redemption and neither can be held in reserve. The grant must already be committed
+     * ({@link seatOwnerGrant}): both consent reads are of `committed.OwnerGrant`. No machine is
+     * admitted and no peer id is named.
+     *
+     * The two signatures are minted where the private keys are (the grant's and the seated
+     * key's), over {@link ownerGrantRedeemMessage} / {@link ownerGrantConsentMessage}; this
+     * machine only verifies them, by writing the row.
+     *
+     * Idempotent, and a no-op for a key that is already an owner: when `seatedKey` has a live
+     * `OwnerKey` row here nothing is written and no use is spent — `alreadyOwner: true` with
+     * that row's stamp. The seat check ({@link assertOwnerGrantSeatRemains}) runs after that, so
+     * the retry of a single-use redemption is answered `alreadyOwner` rather than refused as
+     * exhausted. A key removed earlier is seated afresh under a new stamp (`NotRevoked` passes),
+     * except on a machine that still holds its retired row, which refuses by name
+     * ({@link liveOwnerKeyStamp}).
+     *
+     * Through {@link mutateCadrePeer}, so the membership hub is notified and the anchors follow;
+     * inside the locked body every read passes `retry: false` and the stamp is minted per
+     * attempt, so a {@link lockedWithRetry} re-run starts clean.
+     *
+     * @throws {InvitationExhaustedError} when the grant's uses are all spent (by name, ahead of
+     *   the schema's generic `Authorized` refusal); its `token` is the grant key.
+     *   {@link IssuedRowNotHereYetError} when no `OwnerGrant` row is readable here.
+     */
+    async redeemOwnerGrant(params) {
+        this.ensureInitialized();
+        const { grantKey, seatedKey, usageStampId, grantSig, ownerSig } = params;
+        const nowMs = params.nowMs ?? Date.now();
+        log('Redeeming owner grant %s for %s', grantKey, seatedKey);
+        return this.mutateCadrePeer('owner-grant-redeem', async () => {
+            const grant = await this.queryOwnerGrant(grantKey, false);
+            if (grant === null) {
+                throw new IssuedRowNotHereYetError('OwnerGrant', grantKey);
+            }
+            const heldStamp = await this.liveOwnerKeyStamp(seatedKey);
+            if (heldStamp !== null) {
+                log('redeemOwnerGrant: %s is already an owner; nothing written', seatedKey);
+                return { alreadyOwner: true, seatedStampId: heldStamp };
+            }
+            await this.assertOwnerGrantSeatRemains(grant);
+            // Minted inside the body, so a re-run mints afresh over a rolled-back attempt rather
+            // than re-presenting a stamp the usage row may already name.
+            const seatedStampId = generateStampId(this.config.libp2pNode.peerId.toString());
+            const nowCanonical = await canonicalDatetime(this.db, nowMs);
+            await this.inTransaction('owner-grant-redeem', async () => {
+                await this.db.exec(`
+          insert into CadreControl.OwnerKey (Key, Label, StampId, VouchOwner, VouchSig, VouchUsage)
+            with context OwnerKey = null, Signature = null
+            values (?, ?, ?, ?, null, ?)
+        `, [seatedKey, grant.label, seatedStampId, grant.issuerKey, usageStampId]);
+                await this.db.exec(`
+          insert into CadreControl.OwnerGrantUsage (UsageStampId, GrantKey, SeatedKey, SeatedStampId, GrantSig, OwnerSig)
+            with context Now = ?
+            values (?, ?, ?, ?, ?, ?)
+        `, [nowCanonical, usageStampId, grantKey, seatedKey, seatedStampId, grantSig, ownerSig]);
+            });
+            log('Redeemed owner grant %s: %s seated as an owner (usage %s)', grantKey, seatedKey, usageStampId);
+            return { alreadyOwner: false, seatedStampId };
+        });
+    }
+    /** {@link assertCadreInviteSeatRemains} for an owner grant: refuse an exhausted grant by name, ahead of the write. */
+    assertOwnerGrantSeatRemains(grant) {
+        return this.assertIssuedSeatRemains(grant, key => this.countOwnerGrantUsage(key, false));
+    }
     /**
      * Close the database and cleanup resources.
      *