docs: describe logout --revoke across networks and the concurrent-change retry

.changelog/logout-revoke-docs.md

@@ -0,0 +1,5 @@
+---
+wallet-cli: none
+---
+
+Document that `tempo wallet logout --revoke` revokes keys on every network it logs out of, and that a logout interrupted by a concurrent login or refresh fails with a retryable `E_USAGE` without logging out.

README.md

@@ -229,7 +229,7 @@ Results with a follow-up step include `instruction` and `_next`. `swap`, `send`,
 
 `tempo wallet keys revoke <ACCESS_KEY>` revokes a key of the logged-in wallet on the resolved network: one stored for the wallet, or one created elsewhere that the chain shows authorized for it. Any other address fails with `E_USAGE` listing the wallet's stored keys on that network. The wallet app signs the revocation, so it needs no local signer for the wallet itself. A stored key not yet published on-chain is authorized and revoked in one transaction. The command succeeds only once the chain shows the key revoked; otherwise it keeps the local key and exits 3 with `E_NETWORK`. Revocation cannot be undone, so a run with a terminal on both stdin and stdout asks `[y/N]` first, and any other run (including an agent's) needs `--yes`; without it, it exits 2 with `E_USAGE` and a `cta` that adds `--yes`. `--dry-run` shows the key, wallet, network, limits, and expiry, and its `_next` adds `--yes`. `tempo wallet revoke` is a deprecated alias that runs the same command and will be removed in a future release; only a run from a terminal prints a notice on stderr.
 
-`tempo wallet logout` logs out of every network and reports `scope: "all"`; `--network` (or `TEMPO_WALLET_NETWORK`) logs out of that network only. Accounts are not stored per network, so a network logout removes that network's access keys and keeps the wallet while it has its own keys on another network, moving the wallet's network there (`disconnected: false`); once it has none, the wallet is removed too. `keys` lists the removed keys. Without `--revoke` they are only deleted locally and stay authorized on-chain until they expire. `--revoke` first revokes each key on-chain through the wallet app, as `keys revoke` does, and only on the network the wallet is logged in on: a logout that also covers keys on another network fails with `E_USAGE` before doing anything, naming the network logout to run first. A key the chain does not show revoked is kept, with the wallet, and the command fails naming it (`E_NETWORK`, exit 3, for a wallet-app or chain failure); keys revoked before it are removed. An expired key can neither sign nor be published, so `--revoke` removes it without asking the wallet app and reports it with `revoked: false`, unless the chain still shows it published (a host clock ahead of the chain's, or a stored expiry of zero, which the chain reads as none), in which case it is revoked like the rest. `sessions` lists stored sessions on the networks logged out (on every network when the logout removes the wallet) that still hold unspent deposits, which stay locked until the wallet logs in again. Such a logout, and any `--revoke`, needs confirmation: an interactive run asks `[y/N]`, and an agent run, or one whose stdin is not a terminal, needs `--yes`; without it, it exits 2 with `E_USAGE` and a `cta` that adds `--yes`. A session store that exists but cannot be read, because sqlite3 is not installed or the database is corrupt, needs the same confirmation, so `--yes` still logs out. Without funded sessions or `--revoke`, logout needs no confirmation. `was_logged_in` (formerly `logged_in`) reports whether a wallet or keys were stored for those networks.
+`tempo wallet logout` logs out of every network and reports `scope: "all"`; `--network` (or `TEMPO_WALLET_NETWORK`) logs out of that network only. Accounts are not stored per network, so a network logout removes that network's access keys and keeps the wallet while it has its own keys on another network, moving the wallet's network there (`disconnected: false`); once it has none, the wallet is removed too. `keys` lists the removed keys. Without `--revoke` they are only deleted locally and stay authorized on-chain until they expire. `--revoke` first revokes each key on-chain through the wallet app, as `keys revoke` does, on the key's own network, including networks the wallet is not logged in on. A key the chain does not show revoked is kept, with the wallet, and the command fails naming it (`E_NETWORK`, exit 3, for a wallet-app or chain failure); keys revoked before it are removed. An expired key can neither sign nor be published, so `--revoke` removes it without asking the wallet app and reports it with `revoked: false`, unless the chain still shows it published (a host clock ahead of the chain's, or a stored expiry of zero, which the chain reads as none), in which case it is revoked like the rest. `sessions` lists stored sessions on the networks logged out (on every network when the logout removes the wallet) that still hold unspent deposits, which stay locked until the wallet logs in again. Such a logout, and any `--revoke`, needs confirmation: an interactive run asks `[y/N]`, and an agent run, or one whose stdin is not a terminal, needs `--yes`; without it, it exits 2 with `E_USAGE` and a `cta` that adds `--yes`. A session store that exists but cannot be read, because sqlite3 is not installed or the database is corrupt, needs the same confirmation, so `--yes` still logs out. Without funded sessions or `--revoke`, logout needs no confirmation. `was_logged_in` (formerly `logged_in`) reports whether a wallet or keys were stored for those networks. If another process's `login` or `refresh` changes the wallets, network, or keys being logged out while logout waits for confirmation or the wallet app, logout does not log out and fails with a retryable `E_USAGE`; keys `--revoke` already revoked on-chain are removed and named in the message. Run it again.
 
 `login`, `refresh`, `keys update`, `keys revoke`, and `logout --revoke` ask the wallet app for approval; `--no-browser` prints the URL and confirmation code instead of opening a browser. Set `TEMPO_NO_BROWSER=1` to do the same for every command, including `login` and `fund`. `refresh` and `keys update` keep the stored key until the wallet app approves the change, so a declined or failed approval leaves the current key usable. A wallet-app request that fails or whose code expires is not resent, so each approval shows one confirmation code; rerun the command to try again.
 

SKILL.md

@@ -133,7 +133,7 @@ For credit payments, use `--amount-cents` as the direct payment amount or the ma
 - After multi-request workflows, check the remaining spendable balance with `tempo wallet balance`; `tempo wallet whoami` also shows deposits locked in sessions.
 - Wallet results with a follow-up step include `instruction` and `_next`. Run `_next.argv` as given (`_next.command` is the shell-quoted form), but only after the user approves any spend, transfer, or revocation it performs.
 - Revocation cannot be undone. Run `tempo wallet keys revoke <ACCESS_KEY> --dry-run` to show the key, wallet, network, limits, and expiry, then run its `_next` (which adds `--yes`) only after the user approves. Without `--yes`, an agent run returns `E_USAGE` with that command as its `cta`. Only the logged-in wallet's keys on the selected network can be revoked: keys stored on this host, or keys from another device that the chain shows authorized for the wallet. Any other address returns `E_USAGE` listing the wallet's stored keys. If it returns `E_NETWORK` because the chain does not show the key revoked, the local key is kept; report it to the user before retrying.
-- `tempo wallet logout` logs out of every network unless `--network` names one. When stored sessions on those networks still hold deposits, or with `--revoke`, an agent run returns `E_USAGE` and logs out nothing. Report the sessions to the user and suggest closing them first with the `tempo wallet sessions close` command the error names; run its `cta` (which adds `--yes`) only after the user approves logging out anyway. A confirmed logout lists such `sessions` and points `_next` at the close to run after logging in again. Without `--revoke`, removed keys stay authorized on-chain until they expire; `--revoke` revokes them first and cannot be undone. If a key is not revoked, logout fails and keeps it with the wallet; report it before retrying.
+- `tempo wallet logout` logs out of every network unless `--network` names one. When stored sessions on those networks still hold deposits, or with `--revoke`, an agent run returns `E_USAGE` and logs out nothing. Report the sessions to the user and suggest closing them first with the `tempo wallet sessions close` command the error names; run its `cta` (which adds `--yes`) only after the user approves logging out anyway. A confirmed logout lists such `sessions` and points `_next` at the close to run after logging in again. Without `--revoke`, removed keys stay authorized on-chain until they expire; `--revoke` revokes them first, on every network the logout covers, and cannot be undone. A retryable `E_USAGE` saying the wallet changed during logout means another login or refresh ran meanwhile, so the wallet may now hold keys the user has not seen. Report it and rerun the logout only after the user approves again; its command keeps `--yes`, so a rerun logs out, and with `--revoke` revokes, the wallet as it now is without asking. If a key is not revoked, logout fails and keeps it with the wallet; report it before retrying.
 - Closing a session cannot be undone, and a closed session can no longer pay for requests. Run `tempo wallet sessions close <TARGET> --dry-run` (or with `--all`, `--orphaned`, `--finalize`, or `--cooperative`) to list the sessions it selects as `targets[]`, each with its `channel_id`, `origin`, and `status` (`not_found` when nothing matches), then run its `_next` (which adds `--yes`) only after the user approves. Without `--yes`, an agent run returns `E_USAGE` with that command as its `cta`. A pending close's `_next` already includes `--yes`, since it completes a close the user approved; `remaining_seconds` says how long until its deposit can be withdrawn.
 
 ### Rules