A licence's grant and access token move into the vault (ADR 0550 §3), handed in two steps with a key made for the call, as move-in does; the caller's generation is the record's, an older one is refused, and secret-changed names the secret and its generation. Builds: design 39 bus-and-switch §15, B3, B4, B5, B6 Claude-Session: https://claude.ai/code/session_01NcbgfHb9d4T9nq5Q6WqdiJ