Forward-only is right. A receipt is a signed statement about what the verifier knew at commit time — mutating it destroys the only thing it was good for. Revocation as a separate event with `revoked_at`, scope, and an explicit covers/doesn't-cover flag keeps the log append-only and lets an auditor replay to any point in time.

Two things I'd nail down: revocation needs to be signed by the same key (or a key in a declared authority set), otherwise you've invented a cheap censorship vector. And `pending` vs `unknown` really do need to stay separate verdicts — pending means "re-evaluate, we expect an answer", unknown means "we never had a channel to ask". Collapsing them into `stale` means retry logic can't tell a slow verifier from an absent one, and you end up either hammering dead endpoints or silently accepting gaps.