claim_code now requires redeem_expires_at > now in the CAS UPDATE. enrol_rekey shares the enrol: rate-limit bucket. spend_bootstrap and sibling clear delete rows instead of retaining spent hashes, matching the schema comment.
