docs(retro): record cross-session grants (PROJECT/GLOBAL) + revoke

c36d41b + 8df0ec7, with the cross-session live-QA gate noted.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

RETRO.md

@@ -7,6 +7,27 @@ could not be run here.
 
 ---
 
+## 2026-06-21 — wider grants + revoke (branch `feat/backlog-burndown`)
+
+Operator-requested (not a prior BACKLOG item): grants that outlive a single session, plus a
+revoke path. Two commits, each compiled + unit-tested green.
+
+| Commit | What |
+|--------|------|
+| `c36d41b` | **Cross-session grant scopes (PROJECT/GLOBAL) + revoke.** `GrantScope.GLOBAL(toolName)` added; `PROJECT` made tool-bound. Engine `scopeMatches`: GLOBAL matches the bound tool anywhere, PROJECT when the session's `projectId` (derived from the bound workspace root via `ProjectIdentity.of`) AND tool match. New reserved `GRANT_LEDGER_SESSION_ID` stream holds PROJECT/GLOBAL grants; the approval gate unions the ledger's grants with the session's. `RevokeGrant` → `ApprovalGrantExpiredEvent` on the ledger (reducer already drops it); `ListGrants`/`GrantList` expose the active standing grants. **Server-side T2 grant ceiling removed** per operator request — a grant may now authorize any tier (incl. T3/T4); tool-binding is the remaining guard. New `GrantScopeMatchingTest` (5). |
+| `8df0ec7` | **TUI: scope picker (A) + standing-grants viewer.** `A` (approve-always) opens a session/project/global picker (SESSION default = old behaviour); `p`/`g` create wider grants. `grants` palette command + `G` shortcut open `OverlayGrants` listing scope/tool/tiers/path with `x`/enter to revoke. `protocol.go`: `TypeGrantList`+`GrantDto`, `RevokeGrant`/`ListGrants` encoders. Both overlays rendered via `cmd/preview` (kinds `grants`, `grant-scope`). |
+
+**Why the design:** session grants are event-sourced per-session and die with the session;
+project/global grants must outlive any one session, so they live in a dedicated ledger stream
+the gate folds in — keeps grants in the audit log (invariant #9) rather than config.
+
+**⚠️ Live-QA gate (move out of RETRO once passed):** unit tests cover the engine matching,
+reducer, and ledger fold, but the *cross-session* behaviour — create a GLOBAL/PROJECT grant in
+session A, confirm a **different** session B auto-clears that tool, then revoke and confirm it
+prompts again — needs a running server + model. Not runnable in this sandbox.
+
+---
+
 ## 2026-06-20 — backlog burndown (branch `feat/backlog-burndown`)
 
 Nine tracks, each compiled + unit-tested green before commit.