identity: RFC 7662 full introspection metadata — introspect_full (+9 tests)

introspect_full returns {active, Subject, Client, Scope, Exp, Iat, bearer}
for live tokens and {inactive} otherwise — deepening the opaque-token /
live-lookup model. Access tokens now carry Iat (clock-at-issue); exp = iat +
ttl. Simple introspect is unchanged (all prior suites green). New
tests/introspect.sx. 210/210.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/identity-on-sx.md

@@ -19,7 +19,7 @@ through the event log, all authorization questions delegated to `acl-on-sx`.
 
 ## Status (rolling)
 
-`bash lib/identity/conformance.sh` → **201/201** (4 phases + 10 ext)
+`bash lib/identity/conformance.sh` → **210/210** (4 phases + 11 ext)
 
 ## Ground rules
 
@@ -88,8 +88,16 @@ lib/identity/api.sx ── (identity/login) (identity/grant?) (identity/revoke)
 - [x] unify `api.sx` over membership + audit (one facade, audited login/logout)
 - [x] subject-wide session management: `sessions(Subject)` + `logout_all` (log out everywhere)
 - [x] token exchange (RFC 8693): downscope a token into a new independent token
+- [x] RFC 7662 full introspection metadata (`introspect_full`: sub/client_id/scope/exp/iat/token_type)
 
 ## Progress log
+- 2026-06-07 — full introspection (ext, RFC 7662 §2.2): `introspect_full`
+  returns {active, Subject, Client, Scope, Exp, Iat, bearer} for live tokens,
+  {inactive} otherwise — deepening the opaque-token/live-lookup model the
+  whole design rests on. Access tokens now carry `Iat` (clock-at-issue);
+  exp = iat + ttl. Simple `introspect` unchanged. New tests/introspect.sx (9).
+  201→210. NOTE: conformance now needs an explicit long timeout (>120s, 19
+  suites) — run with `timeout 580`.
 - 2026-06-07 — token exchange (ext, RFC 8693 §2.1): `oauth.sx` gains
   `token_exchange(SubjectToken, RequestedScope)` — a valid access token is
   downscoped into a NEW independent grant for the same subject (subset only,