Interface RevokeAllForSubjectResult

Everything that was asked for actually happened.

The one field a caller has to check. Deriving it from the other four is a four-way condition every integrator would have to get right independently, and getting it wrong reads as a successful revocation — so it is computed here once.

Store calls that were wired, attempted, and threw. Empty on the happy path. See RevokeAllForSubjectFailure for why this is separate from unavailable.

Session ids whose cascade failed — still live, safe to retry.

Session ids whose cascade completed.

Whether the access-token watermark was written.

Capabilities that were not wired, and therefore not exercised.

Load-bearing rather than informational: the caller invokes this immediately after writing a new credential, and a bare success while nothing was revoked is the worst outcome this helper could produce. A non-empty list means the revocation was partial and the caller must treat it as a failure.