Recover invite access without bypassing scoped authorization

When an invitation is expired, consumed, rejected, or revoked, do not bypass the invitation-to-session authorization boundary. An authorized issuer may create a new scoped exchange only after revalidating the intended recipient, current eligibility, and the applicable expiry and revocation policy. Never silently revive an explicitly rejected or revoked grant, and do not treat a consumed one-time credential as reusable. Continue through the normal secure session and downstream authorization path.

Applicability and limits: this preserves least privilege without assuming a particular product's storage or transition model. Recheck the actual invitation, replay, expiry, and revocation contracts before recovery; a global authentication bypass cannot safely infer which subject, assessment, or session should be authorized.