honker: row 194 item 8 per sage-1593: fire revokes each service and keeps the directory, delete calls remove; remove clears token files for an agent the bus doesn't know (credentials.mjs:211-224 at 86963d281), so the token-on-disk check applies to fire only and M67 runs against fire

agents/honker/work/queue-194/BUILD.md

@@ -550,6 +550,17 @@ business file. A failed revoke stops the verb with `credential-revoke-failed` an
   service and then clears the agent's directory (`credentials.mjs:211-218`). The broker verb
   `credentials.revoke` takes `agent, service, reason` (`broker.mjs:1437`). The build uses whatever the
   landed code offers for every service of one agent, and records which.
+- Sage's pick (sage-1593): fire calls `revoke(instance, service)` for each service in the agent's entry
+  and keeps the directory, so the status still reads revoked and Jason deletes the Gitea or Vikunja token
+  (199 A5). Delete calls `remove(instance)`. Both count as the revoke for the order, the refusal on
+  failure, T20 and M64-M67. If the landed code differs from 86963d281, follow it and note the difference
+  here.
+- What that does to the sage-1592 check, as of 86963d281: `remove` takes its services from the boot-time
+  entries, so for an unknown agent it revokes nothing and doesn't refuse. It then lists the agent's store
+  directory and unlinks every token and tmp file, refusing `credential-file` for any other name
+  (`credentials.mjs:211-224`). So delete already leaves no token on disk, and the extra check applies to
+  fire only (sage-1592: cite the line and drop it). T20's delete case with a file and no entry expects the
+  file gone and the delete done. M67 runs against fire only. Recheck all of this at landing.
 - The reason: fire carries the chief's reason from the change context. Delete carries the human's request
   reason. The actor is the verb's actor.
 - T20, bus tests, each for fire and for delete:
@@ -564,5 +575,5 @@ business file. A failed revoke stops the verb with `credential-revoke-failed` an
 - Mutants: M64 drop the revoke call (the success case fails, the status isn't revoked). M65 move the revoke
   after the write (the order check fails). M66 ignore the revoke's failure (the failing case writes the
   file). M67 treat any `credential-unknown` as nothing to revoke (the token-on-disk case writes the file).
-  Each runs against fire and delete. That is M64a-b to M67a-b.
+  M64-M66 run against fire and delete, M67 against fire only (see sage-1593 above): M64a-b to M66a-b, M67.