The app claims a pre-token from the onboarding and gets a NEW tunnel token.

lmcp-api#358: this answered the existing live token of (address, machine id). Neither is proven here: the address is typed, the pre-token's machine id is set by /install/ping and its address by the set-up page, all without authentication, so anyone holding an old pre-token could read out another person's token. Now every claim mints, as /tunnel/token does (#229): email NULL, the address in contact_email, under the mint limits (_mint_guarded). No answer carries a token that existed before the call, and a repeat mints again.

No row is read by address: the 403 «Token revocado» for an address whose rows were all revoked is gone (review of #358). It protected nothing once every claim mints a token of its own, anyone could lift or cause it for an (address, machine id) pair, and it told a caller whether an address had revoked rows. A revoked token stays revoked; the claim never revives one. The claim is a retired path (no pre-token has been minted since 2026-06-12).