Retire only after ten minutes as well as five passes, and never through remove

Five passes are 25 s, shorter than a real hiccup. And a provider's remove can
destroy — a ledger file, a public DNS record — so an adapter without a retire
of its own is mark-only: the consumer keeps its access, is marked and said, and
remove is reached only by a person's delete (hq ADR 0230).

test/sdk.test.ts

@@ -31,7 +31,7 @@ test("module tools register and collect, a thrower is skipped not fatal", () =>
   assert.equal(broken?.tools.length, 0);
 });
 
-test("provisioner creates each consumer with the mesh's login and password, removes on withdrawal", async () => {
+test("provisioner creates each consumer with the mesh's login and password; remove waits for a person's delete", async () => {
   const dir = await mkdtemp(join(tmpdir(), "prov-"));
   const created: { as: string; password: string; values: unknown }[] = [];
   const removed: string[] = [];
@@ -57,7 +57,7 @@ test("provisioner creates each consumer with the mesh's login and password, remo
         removed.push(p.as);
       },
     },
-    { receives, everyMs: 20 },
+    { receives, everyMs: 20, stableForMs: 0 },
   );
 
   await waitFor(() => created.length === 1, 2000);
@@ -67,10 +67,18 @@ test("provisioner creates each consumer with the mesh's login and password, remo
   assert.equal(created[0].password, "minted-pw");
   assert.deepEqual(created[0].values, { name: "webapp" });
 
-  // Withdraw: the mesh drops the consumer from the file → the harness removes it via the adapter.
+  // The mesh drops the consumer: it is RETIRED, mark only — this adapter cannot disable, so remove is
+  // NOT called (novox/hq ADR 0230); it keeps its access until a person deletes it.
   await writeFile(receives, doc([]));
-  await waitFor(() => removed.length === 1, 2000);
-  assert.equal(removed[0], "webapp-anchor");
+  for (let i = 0; i < 200 && (await stop.retirement()).retired.length === 0; i++) await new Promise((r) => setTimeout(r, 10));
+  const r = await stop.retirement();
+  assert.equal(r.retires_by, "mark-only");
+  assert.deepEqual(r.retired.map((x) => [x.consumer, x.access]), [["webapp-anchor", "kept"]]);
+  await new Promise((r) => setTimeout(r, 100));
+  assert.deepEqual(removed, [], "remove was called to retire");
+  // Only a person's delete reaches remove.
+  await stop.deleteRetired("webapp-anchor", { why: "gone for good", confirm: "webapp-anchor" });
+  assert.deepEqual(removed, ["webapp-anchor"]);
   stop();
 });
 
@@ -103,7 +111,7 @@ test("provisioner hands the adapter what the mesh derived, and still has it at w
         removed.push(p.derived);
       },
     },
-    { receives, everyMs: 20 },
+    { receives, everyMs: 20, stableForMs: 0 },
   );
 
   await waitFor(() => created.length === 1, 2000);
@@ -115,10 +123,12 @@ test("provisioner hands the adapter what the mesh derived, and still has it at w
   await waitFor(() => created.length === 2, 2000);
   assert.deepEqual(created[1], { bucket: "mesh-anchor-files" });
 
-  // Withdrawn: the file no longer says anything about this consumer, and the adapter is still
-  // told which bucket to take away.
+  // Retired, then deleted by a person: the file no longer says anything about this consumer, and the
+  // adapter is still told which bucket to take away.
   await writeFile(receives, doc([]));
-  await waitFor(() => removed.length === 1, 2000);
+  for (let i = 0; i < 200 && (await stop.retirement()).retired.length === 0; i++) await new Promise((r) => setTimeout(r, 10));
+  assert.deepEqual(removed, []);
+  await stop.deleteRetired("mesh_anchor_ncloud", { why: "unassigned", confirm: "mesh_anchor_ncloud" });
   assert.deepEqual(removed[0], { bucket: "mesh-anchor-files" });
   stop();
 });
@@ -185,7 +195,7 @@ test("provisioner removes nothing while its contributions file cannot be used (n
         removed.push(p.as);
       },
     },
-    { receives, everyMs: 20 },
+    { receives, everyMs: 20, stableForMs: 0 },
   );
   await waitFor(() => created.length === 2, 2000);
 
@@ -210,7 +220,9 @@ test("provisioner removes nothing while its contributions file cannot be used (n
   assert.notEqual((await stop.retirement()).waiting, null, "the retirement never waited for a person");
   assert.deepEqual(removed, [], "two of two consumers were retired without a person");
   await stop.approve(["mesh_anchor_mail", "mesh_anchor_forge"], { why: "both unassigned on purpose", by: "test" });
-  assert.deepEqual([...removed].sort(), ["mesh_anchor_forge", "mesh_anchor_mail"]);
+  // Retired mark-only: still nothing removed; that is a deletion, a person's further act.
+  assert.deepEqual(removed, []);
+  assert.deepEqual((await stop.retirement()).retired.map((x) => x.consumer).sort(), ["mesh_anchor_forge", "mesh_anchor_mail"]);
   stop();
 });