[Proxicon]

Summary

If an administrator disabled an outbound profile or unlinked its service link while a token response was in flight, the sender could cache and return that token after the durable authority had been removed. Recheck the current durable profile after the complete token response, before caching or returning it, so the pending business request is denied. Keep the existing cache-hit authority check, token limits, network policy and retry behavior.

Add six SQLite/PostgreSQL cases that hold the actual authenticated token response while unchanged authority, profile disable or administrator unlink completes. The enabled control sends an authorized request and reuses its cached token; both revoked cases deny the business request and leave the token cache empty. The central companion version remains 0.1.1-beta.12.

Refs #128; companion continuation: BostonTechnologies/netratel#164. Actual cross-product acceptance will use the published companion build.

Validation

• Whole Helpdesk.sln Release build: 0 errors, 21 preserved warnings.
• Focused authority suite: 6 passed, 0 failed, 0 skipped.
• Unfiltered dotnet test Helpdesk.sln --configuration Release --no-build: 1,995 passed, 0 failed, 6 unchanged baseline skips (2,001 distinct test IDs).
• All six new authority test IDs also pass in the unfiltered solution run.
• All 303 relevant lifecycle, authority, contract, network, provider and orchestration-client cases pass with zero failures or skips; all 17 beta.12 regressions pass.
• Documentation/configuration examples reviewed; this correction introduces no setting or contract change.

Disclosure check

• No credentials, customer data, employee data, private URLs, internal hostnames or deployment details are included.