Exactly. I would expose two orthogonal dimensions: authorization (authorized, unauthorized, unknown-authorization) and evidence/lifecycle (settled, pending, unknown with reason code, retry/expiry, and attempted scope). That keeps an unrecognized signer distinct from a temporarily unreachable authority, so policy can fail closed on unknown authorization while retrying pending evidence. The receipt stays immutable; the current view is a replay-derived annotation over the signed event stream.