What

Implements the daily-refreshed revocation cache from CONTRACT.md §2.5. Public surface is createRevocationCache(opts) for testability plus a default singleton isRevoked(lid) / refreshRevocations() wired to the real C5 HTTP client.

Stacked on #221 (C5) because the cache calls getRevocations. Order: #217 (C1) → #221 (C5) → this PR.

Design

The cache is intentionally fail-open:

• Storage read throw → treat as cold cache, refresh.
• Network refresh throw → keep serving the stale cache. Cold-and-network-down resolves to false (not revoked).

Rationale: revocation is defense-in-depth on top of expires_at. Locking users out of cloud features during a transient outage is a worse failure than briefly missing a freshly-revoked id. The signed expires_at boundary still holds.

Concurrent refreshes coalesce into a single fetch via an inFlight Promise — prevents N parallel /v1/license/revocations calls during first paint.

fetchFresh receives the previous as_of as the since argument, matching the contract's ?since=<iso> shape for incremental polling.

Why the default storage is in-memory only

The C6 spec calls for persisting under app.getPath('userData')/lumina-cloud-revocations.json. That path requires the same Electron-IPC plumbing question that has C3 blocked (#219). Rather than block C6 too, I shipped the cache logic with an in-memory default RevocationStorage:

• The factory pattern means swapping in a real disk-backed storage is a one-line change once C3's IPC question lands.
• Within a session the cache still de-dupes refreshes; across-restart persistence is the only thing missing.
• All four C6 test cases (cold / warm / expired / network-fail) pass with the injected storage abstraction.

If you want persistence to ship in the same merge as the cache, point me at the same answer as C3 and I'll wire it.

Acceptance criteria

• Refreshes if cache age > 24h (configurable via ttlMs).
• Quietly succeeds with stale cache on network failure.
• Tests: cold cache, warm cache, expired cache, network failure with stale cache.

How I tested

• npm run typecheck: pass.
• npm test -- --run src/services/luminaCloud/revocations.test.ts: 7/7 pass.
• npm test -- --run src/services/luminaCloud/: 28/28 pass on this branch (revocations + C5 client).

Touched files outside src/services/luminaCloud/

• cloud/TASKS.md only. No other surfaces touched.

Notes for Lead

• Tests use a deferred-Promise pattern for the coalesce test so the resolver is set before any fetch is invoked. (First attempt timed out because resolveFetch was assigned during fetchFresh's body, after the synchronous test code had already called the no-op stub.)
• The cache returns false for "no cache + network down" — fail open. Easy to flip to true (fail closed) if you'd rather be conservative; just make getCurrent return the stale-or-null cache and have isRevoked treat a null cache as "revoked".
• I exported RevocationCacheData, RevocationStorage, RevocationCacheOptions, createRevocationCache, and REVOCATIONS_DEFAULT_TTL_MS from the barrel so consumers (and the future disk-backed storage adapter) can wire the factory cleanly.