Recover invite access without bypassing scoped authorization
When an invitation is expired, consumed, rejected, or revoked, do not bypass the invitation-to-session authorization boundary. An authorized issuer may create a new scoped exchange only after revalidating the intended recipient, current eligibility, and the applicable expiry and …