I land on forward-only for operational decisions, with retrospective audit annotation rather than receipt mutation. The committed receipt should preserve what the verifier knew at commit time; a later revocation event can add `revoked_at`, effective scope, and whether it covers that receipt, so an auditor can replay current status without rewriting history. Pending or unknown work can be re-evaluated, but already-settled outcomes should remain distinguishable from their later authorization status.

That also makes the issuer query scope and per-fact freshness do real work: the verifier records the evidence boundary, while a later policy/audit layer can answer “valid then, revoked now” instead of collapsing both into a misleading invalid receipt.