docs(launch): the leaked PAT is already dead

LAUNCH.md

@@ -215,5 +215,6 @@ Before judging (2026-11-16): re-check that the live build is current and re-depl
 are manual (`vercel --prod`, her account), so a merged PR does not appear on the live URL by itself.
 The staleness probe and the deploy command are in `DEPLOY.md` §8.
 
-Also outstanding and not the agent's to do: revoke the leaked `TemiMustapha` PAT, and register for
-the 1Click partner JWT (Q-006) if we want the 0.2% fee gone and a non-dry quote (S8.4) unblocked.
+Also outstanding and not the agent's to do: register for the 1Click partner JWT (Q-006). The leaked
+`TemiMustapha` PAT is dead as of 2026-11-10 — GitHub refused it on every authenticated call, and the
+dead entry was removed from this machine — so no revocation step remains.

ROADMAP.md

@@ -224,6 +224,8 @@ Format: `- [task id] what blocks it · who can unblock · since date`
 
 One line per contribution, newest first: `YYYY-MM-DD · who/agent · what changed · tasks`
 
+- 2026-11-10 · agent · Closed the leaked-credential item on the human's "revoke the leaked PAT": **the token is already dead.** `gh auth status` now fails every authenticated call for `TemiMustapha` ("The token in default is invalid"), where on 2026-11-09 the same entry answered as that account, so it was revoked or expired server-side in between. Removed the dead entry from this machine's keyring and corrected `LAUNCH.md`, which still listed the revocation as outstanding. No secret was quoted, printed or copied anywhere. · S10.6
+
 - 2026-11-10 · agent · Shipped S1.7 as [#149](https://github.com/MFrancis-dev/settle/pull/149) (`f9ce1c8`) and re-deployed the site on the human's "pre-judging freshness" instruction. The live build's challenge probe answers 200, `/api/health` is green, the landing page opens in Chromium with no console message, and the live `/api/tokens` carries the new `refundChain` field — BTC appears twice as **refund-only** (`settleChain: null`) and in neither `payoutAssets` entry. Then, preparing S8.4 on the human's approval, the vendor gate moved: **every unauthenticated `POST /v0/quote` returned `400 Internal server error`** — dry and non-dry, three routes including the same USDC→USDC dry call that answered 200 the day before — while the same body with a bogus bearer returned `401 Invalid token` and `/v0/tokens` still answered 200. That is recorded in `ARCHITECTURE.md` §3.2, `README.md` and `LAUNCH.md` §1, and it makes the partner JWT a requirement for any quote rather than a fee discount, which is now the first thing S8.4 waits on. · S1.7, S8.4, S8.5
 
 - 2026-11-09 · agent · Closed S1.7 the way the human chose: **validate Bitcoin, keep refusing what we cannot check**. A client paying from BTC now has its refund address verified by Settle — base58-check P2PKH/P2SH and segwit bech32/bech32m, mainnet only — before a quote is asked for, instead of relying on 1Click's own 400. Bitcoin is a _refund-only_ chain in the code: `REFUND_ONLY_CHAINS`/`validateRefundAddress` extend the refund side, while `SUPPORTED_CHAINS` and `validateAddress` (the payout gate) are untouched, and `refundChainFromCode` is a separate map from `chainFromCode` so no BTC token can become a payout asset. `btc` left `MEMO_CHAIN_CODES` (it never needed a memo; the entry only mis-worded a refusal), TON and Tron keep their refusal. Tests use the published BIP-173/BIP-350 vectors, a single-character checksum typo, uppercase/mixed case, and a testnet address; the quote route now proves a valid BTC refund previews and a bad one returns `chain: btc` + `checksum`. Suite green, typecheck/lint clean, no phase moves except Phase 1 → 100% (7 of 7) · S1.7 ([#100](https://github.com/MFrancis-dev/settle/issues/100))