There is no revocation; a ticket's time range bounds the timestamps it may claim, so short tickets plus renewal plus newer-wins limit a stale writer.

It is the question every capability system gets asked, and the answer is structural.

There is no way to cancel a ticket you have issued. Nobody keeps a list to cross it off.

What a ticket has is a time range. It covers entries with timestamps inside that range, and no others.

So issue short ones. Renew the people you still trust.

Someone you stopped renewing can still write within their old range. But your newer entries win over anything they can claim.

The range bounds claimed timestamps, not the wall clock. That is the whole trick.

Check yourself. What does a ticket's time range bound: the wall clock or the claimed timestamp?