Claim mints an uncommitted entry {amount: contribution, mixed: 0} owned by your tree key — a standalone transaction, so it never races your nonce against anyone else's signatures. The builder carries one signature slot per selected input, right after the outputs: sign fills exactly the slots owned by the active key — switch key and sign again for another identity — and co-signers' signatures are pasted straight into theirs, and submit takes the form as it stands — every slot required. Export JSON hands the unsigned transaction to co-signers so they have the exact object to sign against. Every output pays one mixed hop (1..max_mix), sum of output mixed ≥ input mixed + output count. Open half only.
One pipeline for everything: build (or paste a transaction), others join with their own self-balancing inputs+outputs, everyone signs with their active key in the signature block under the audit — one editable slot per input, sign fills the active key's, the rest are paste targets — the assembler merges the returned copies (or lines) slot by slot, and submit requires every slot filled. All signatures cover the same 32-byte tx id, one per input in input order; joining after signing invalidates existing signatures, and an abandoned draft costs nothing. Works for shared transfers too.
Build a hash-onion commit for a candidate. The voter picks the depth (how many slots the entry can validate); the seed must be given to the candidate — the node needs it in its onion file to reveal.
Sign consent to be added or moved. Copy the signature and send it to the parent.
Move a child to yourself as new parent. Active key = new parent.
Leave your current parent. Active key leaves.