[samgbafa]

Session-signed revocation of a sub-delegation failed when the session delegation was carried as a proof granting no revoke ability.

Change: a valid proof with no grant for the target now yields ControlProofDecision::Ungranted, which adds no authority and falls back to "revoker == delegator". Invalid, expired and revoked proofs remain Denied. delegation_status does not widen.

Tests: unit tests in the revocation module and route tests in revocation_scope. Three refusal tests, each returning 403: the recipient presents the target itself as its proof; the delegator presents an expired proof (the proofless form still works); the space owner presents a valid grantless proof for a delegation it did not issue. Existing assertions are unchanged.

Details: TC-2132

[samgbafa]

APPROVE: see TC-721 (reviewed exact head 1ad7ba6)

[samgbafa]

APPROVE: see TC-721 (reviewed exact head 49b30f6)

[samgbafa]

APPROVE: see TC-721 (reviewed exact head ac7815e)
This head is a plain merge of main 9f889ae into the approved head 49b30f6; the non-CHANGELOG patch-id is unchanged (fc2478f0...), behind main 0.

[samgbafa]

APPROVE: see TC-2132 (reviewed exact head 1197ecb)
Source change is 3 lines in db.rs plus the revocation.rs decision: a valid proof with no revoke scope (and a Scoped proof that does not cover the target) falls back to the signer being the delegator of the target, which the signer already holds without a proof; revoked or expired proofs stay Denied; delegation_status does not widen; the delegatee and a space owner presenting a grantless proof stay refused. Tests are additive (no existing assertion edited), including the three refusal cases required by the design gate (recipient presenting the target as its proof, delegator with an expired proof, owner with a grantless proof). 0 behind main (1a69eb6). CI pending; Amos merges on green.

[samgbafa]

APPROVE: see TC-2132 (reviewed exact head 3202ffc)
Merge-up of main (4d21ee9, release 1.25.8) into the branch approved at 1197ecb: the non-CHANGELOG patch-id is unchanged (4fc2230fd89ff270 at both heads; git diff -- :!CHANGELOG.md | git patch-id --stable); only CHANGELOG.md differs. 0 behind main. The earlier review applies. Ships in 1.25.9 with #468.