A revocation propagation model with epochs, leases, failure injection, and convergence invariants.

A revocation propagation model with epochs, leases, failure injection, and convergence invariants.

Define monotonic epochs, deletion tombstones, acknowledgements, and failure-injection properties for connected-data revocation.