revocation_freshness_unknown· reason_code· applies to auth_decision, federation_transaction, state_resolutionRevocation / grant freshness cannot be established for a high-risk, cross-domain, or delegated action. Receiver MUST fail closed and return freshness diagnostics instead of treating missing revoke evidence as allow.