DL-466

On a transient mint failure the broker serves an agent’s last delivered credential only when that key grants no repository outside the agent’s current grants; otherwise it serves nothing, so a revoke cannot be undone by refreshing a wider cached token

Status: Active (review fix, 2026-10-11)