A revocation names one delegation by hash and deletes nothing. Everything that depended on it dies implicitly, because liveness is recomputed from the whole set.

It is why a revocation means the same thing on every replica even though replicas have seen different certificates.

A revocation says: I take back that certificate. It names one delegation, by its hash. Not a person. Not a key.

Nothing is deleted. The delegation stays in the bag forever. The revocation sits beside it.

Dan takes back Alice's membership. One certificate named. But Carol's membership was issued by Alice. Unplug Alice, and Carol goes dark.

Carol's certificate was not revoked. Nobody named it. It is dead. There is no route to it. That is the cascade.

Why not list everything the revocation cancels? Because Dan's device may not have seen Carol's certificate yet. Two devices would write two different lists.

So a revocation names one thing. One hash. One signature. The same meaning everywhere.

If Carol had a second route, through Dan, that route is untouched. Carol keeps her access.

A revocation unplugs one cord. Whatever goes dark, goes dark because of the wiring. Not because it was named.

Check yourself. Dan revokes Alice's membership. Is Carol's certificate revoked, dead, or live?