CAT-V1: the seat mesh-vault's retire removes one module's own secret on the warrant of mesh-config's hand act, and says own-retired

The caller must be on the vault's trusted list retire-callers (the holder of mesh-config alone) and carry
a hand act it recorded for exactly this node, module and name. A waiter on rotated or own-replaced does
not wake on own-retired. Reviewer note of issue 1966: HandedOf returns a placement read error instead of
dropping the modules placed there.

Claude-Session: https://claude.ai/code/session_01JG73KJNrH5EgFXMKKYSrig

modules/mesh-vault/module.json

@@ -24,7 +24,8 @@
     "signed",
     "rotation-begun",
     "node-account-ready",
-    "rotation-done"
+    "rotation-done",
+    "own-retired"
   ],
   "invokes": [
     "seat:mesh-hand-acts.hand-acts"
@@ -142,6 +143,19 @@
       "mode": "0700",
       "owner": "mesh-vault",
       "unknown": "program"
+    },
+    {
+      "id": "retire-callers",
+      "trusted": true,
+      "type": "file",
+      "path": "${dir:state}/retire-callers.json",
+      "mode": "0600",
+      "owner": "mesh-vault",
+      "merge": "json",
+      "template": "files/retire-callers.json",
+      "takes-config": [
+        "retire-callers"
+      ]
     }
   ],
   "build": {
@@ -163,8 +177,14 @@
           "MESH_VAULT_STORE": "${dir:store}",
           "MESH_VAULT_STATE": "${dir:state}",
           "MESH_VAULT_SECRET_ASK_CALLERS": "node-tools",
-          "MESH_VAULT_ENROLMENT_CALLERS": "mesh-enrolment"
+          "MESH_VAULT_ENROLMENT_CALLERS": "mesh-enrolment",
+          "MESH_VAULT_RETIRE_CALLERS": "${dir:state}/retire-callers.json"
         }
+      },
+      {
+        "name": "files",
+        "kind": "archive",
+        "from": "files"
       }
     ]
   },
@@ -211,8 +231,19 @@
         "node-account",
         "rotate-node",
         "node-account-confirm",
-        "abandon"
+        "abandon",
+        "retire"
       ]
     }
-  ]
+  ],
+  "config": {
+    "retire-callers": {
+      "type": "list",
+      "description": "Who may call the seat's verb retire, which removes one module's own secret on a node because no manifest reads it any more: a module's name (on every machine), <machine>.<module>, or person.<name>. The holder of the seat mesh-config alone by default (design 32); the verb also needs a hand act the caller recorded for exactly that node, module and secret.",
+      "trusted": true,
+      "default": [
+        "mesh-config"
+      ]
+    }
+  }
 }