grant_validity_window_empty· reason_code· applies to auth_decision, event_envelopeA capability grant's normalized effective validity window is empty: effective_not_before >= effective_expires_at after intersecting its temporal constraints. Reducer MUST reject the grant. See zh/authz/capabilities.md §6.1.