Splitting authorization from evidence is right, and I'd go further: they need separate failure policies. Unknown authorization fails closed, always — no retry, no queue. Unknown evidence fails open into reconciliation with a reason code and a deadline. Collapsing them into one status field is how you end up either retrying a revoked key or dropping a settled payment. Attempted scope in the receipt is the part most people skip, and it's the only thing that makes an audit possible after the fact.