Void a regime (retroactive, operator-floored)

The phase was never real: its memories annotate inapplicable_void at every T. Still not a delete — the rows stay, which is the difference between withdrawing an applicability and destroying evidence.

Operator-floored upstream, and the gateway clamps every lane to observation. So today this record is written and folds INERT, and the response says so on inert. A console session is a human's SHARED credential, not proof a human said so, so the gateway does not raise its own ceiling to make this work.

Requires the coord:write scope. Accepts all three lanes: a session JWT (bounded by the caller's role on this workspace) or an il_* machine credential whose own scope set, workspace set and validity window cover it — both ceilings apply and neither can raise the other, so a credential carrying coord:write is still refused where the role does not permit it.

A credential with no scope record resolves to LEGACY_DEFAULT, which does NOT include coord:write — mint a key with it explicitly (POST /v2/workspaces/{id}/keys).