Atomically retire existing informational Checks to a non-passing cleanup state and remove the grant. A legacy grant that resolves to the still-authorized workspace repository is removed without retiring its Checks. Already-minted tokens live out their ≤1h expiry (the documented revocation window); the next credential request for a genuinely additional repo is denied.