[nedtwigg]

Hardens how a revocation takes effect and is saved, and what the access log keeps.

Revocation

• BurrowRuntime.revoke is synchronous and on neither queue, so a stuck ACL write delays only the save. An approval that overtook a revocation re-applies it at publish. If the revocation names the phone being paired, the pairing is refused user-denied and opens no window.
• BurrowService holds a revocation from the moment it applies until a saved ACL carries it. A write whose snapshot predates the revocation ends no hold.
• The save retries every REVOCATION_SAVE_RETRY_MS, on any revoke attempt, and at dispose and host shutdown. A stopped Burrow's revocation is now held and retried too; before, a failed save revoked nothing.
• A revoke answers within that interval rather than waiting on a stuck write. Settings then lists the phone under "Revocations not saved" with Save again, which sends revokeDevice with that phone's id. A revocation the Relay named is held and listed the same way.
• A revoke that names nothing answers for itself. The held save is tried again behind the answer, and that revoke neither waits on it nor reports its failure.
• What remains: a save that keeps failing until Dormouse closes is undone at the next launch. It is listed in docs/specs/security.md -> "Known gaps", and the guarantee row in docs/specs/security-remote.md is narrowed to match.

Access log

• Refusals keep to their own share (ACCESS_LOG_MAX_REFUSALS of ACCESS_LOG_MAX_ENTRIES), so a refusal evicts only an older refusal. Every other event now shares the remaining 400.
• A connection or pairing on which no Client transport message decrypted logs nothing, so it names no device and does not move Last seen. This also drops the log entry for a phone that handshakes and then gives up without sending anything.

Wording

• Who adds a push registration: a phone this computer paired, and a revoked one can keep or re-add a row that never receives a push.
• docs/specs/remote-security-model.md now says "display text" where the ACL record does hold other phone-supplied fields.
• The availability note in docs/specs/security.md says a revoked phone's session can also hold off new connections.

Compatibility

No wire or on-disk format changes. pairedDevices gains an optional unsavedRevocations, absent when empty and read as none from an older broker. A stored log longer than the new shares is trimmed when read.

Not changed

A store write still has no deadline. A stuck write is waited out and never overlapped, so no retry runs until it ends. A deadline would need a guard against a late write overwriting a newer ACL.

Testing

• Root pnpm test, tsc -b in lib, and tsc --noEmit in standalone/ and vscode-ext/ pass on the merge with main.
• Each new test was checked by mutating the committed code and seeing it go red.
• Two canary seeds on the approval path are refreshed for the new lines.
• The new UnsavedRevocation story adds one snapshot in each Argos browser, awaiting approval.

🤖 Generated with Claude Code

[cloudflare-workers-and-pages]

Deploying mouseterm with    Cloudflare Pages

Latest commit:	32e6138
Status:	✅  Deploy successful!
Preview URL:	https://7e4b46e7.mouseterm.pages.dev
Branch Preview URL:	https://revocation-and-access-log-ha.mouseterm.pages.dev

View logs

[dormouse-bot]

This PR overlaps #1530 and #1528. All three edit service.ts #revokeDevice/revoke, acl.ts, access-log.ts, PairedDevices.tsx, and the revocation rows in security-remote.md. #1530 removes dor remote and the by requester. This PR still names dor remote revoke <id> as the way to save an unsaved revocation again, both in its body and in the guarantee row it rewrites. Whichever PR lands second will need that wording reconciled, along with the revocationRequester(params?.by) call in #revokeDevice.

One inline finding below.