lmcp-api#297: a client says at uninstall that its identity is gone. Two independent parts.

The token part (utils/identity_retire.retire_token): the presented token row and what was issued under it. The signed part (retire_signed), read only with LMCP_RETIRE_SIGNED=1: the signer's enrollment, its key and every token of it. A signed part that is refused retires nothing by itself and never blocks the token part. With the switch on, rule R-a: a token whose row carries ANOTHER non-empty machine id than the one the request names is not retired (a computer running on another computer's token must not cut it).

One answer, 200 {"ok": true}, for every well-formed request (live, revoked or never-issued token, any signature), so the endpoint says neither whether a token or a machine exists nor what was retired. A never-issued token, an id without a live key and a repeat write nothing, not even an event: a flood leaves no rows behind but its address's one counter (which also bounds the refusal events). 400 for a body that is not the shape, 429 per address.