diff --git a/docs/docs/Post Platform Guide/signing-for-a-company.md b/docs/docs/Post Platform Guide/signing-for-a-company.md
index 098a0ef9e..a97873253 100644
--- a/docs/docs/Post Platform Guide/signing-for-a-company.md	
+++ b/docs/docs/Post Platform Guide/signing-for-a-company.md	
@@ -157,7 +157,7 @@ Rules your tool should follow (verifiers ignore records that break them):
 - **Role:** signed by a director, and `createdBy` must be that director.
 - **Delegation from a role:** signed by a director, with `grantedBy` set to that director and scopes inside the role's.
 - **Re-delegation:** signed by the parent's delegate, the parent must allow re-delegation, and scopes must be inside the parent's.
-- **Revoking:** write a new signed version with `status: "revoked"` and `revokedBy` set to the signer (a director or the grantor). Revoking a parent fails everything below it without touching those records, but you may also write signed revocations for them so the data reads clearly.
+- **Revoking:** write a new signed version with `status: "revoked"` and `revokedBy` set to the signer (a director, or a grantor who hasn't been revoked). By default this stops only that person: what they granted before stays valid. Set `revocationCascade: true` to also revoke everything handed on from them. Narrowing a delegation or role always narrows everything below it.
 - **Never delete** these records. Deletion doesn't revoke anything, because verifiers read history.
 
 ## Logins
diff --git a/docs/docs/W3DS Protocol/Company-Delegation.md b/docs/docs/W3DS Protocol/Company-Delegation.md
index 026f61ac3..265ca96f2 100644
--- a/docs/docs/W3DS Protocol/Company-Delegation.md	
+++ b/docs/docs/W3DS Protocol/Company-Delegation.md	
@@ -15,7 +15,8 @@ Bob signs an NDA "for Acme" with **his own** wallet key. The signature names Acm
 - Bob's delegation was signed by someone entitled to grant it,
 - that grant goes back, hop by hop, to a role created by one of Acme's directors,
 - the directors are the ones Acme's Company record was born with, or later changed to by a sitting director,
-- nothing on the way has been revoked or widened.
+- nothing on the way was revoked before granting what is below it (or revoked with cascade),
+- what was signed is within every link's **current** scopes.
 
 **The eVault enforces none of this.** It stores whatever it is given, and all authority is decided by the verifier from signatures and the eVault's version history.
 
@@ -63,7 +64,7 @@ Exactly one of `roleId` or `parentDelegationId` is set.
 - **From a role:** granted (signed) by a director. `scopes` must be a subset of the role's.
 - **From a parent delegation:** granted by the parent's delegate, only if the parent has `mayRedelegate: true`. `scopes` must be a subset of the parent's, and the validity window must lie within the parent's.
 - `grantedBy` is the signer. Immutable after creation: `companyEName`, `delegateEName`, `roleId`, `parentDelegationId`, `grantedBy`.
-- **Revoking:** a director or the grantor writes a signed version with `status: "revoked"` and `revokedBy` set to themselves. Revocation is final.
+- **Revoking:** a director, or a grantor whose own authority hasn't been revoked, writes a signed version with `status: "revoked"` and `revokedBy` set to themselves. Revocation is final. See [Firing and cascading](#firing-and-cascading).
 
 ## Scopes
 
@@ -130,29 +131,50 @@ Every payload in this model starts with `w3ds-`. Login verifiers (`verifyLoginSi
    - is validly signed and bound to its id,
    - is not dated before the previous valid version, and not after the eVault stored it (5 minutes of clock skew allowed),
    - keeps its immutable fields,
-   - was signed by someone entitled **when it was stored**: a director for roles and role grants, the parent's delegate for re-delegations, a director or the grantor for revocations.
+   - was signed by someone entitled **when it was stored**:
+     - a director, for roles and for grants from a role that wasn't yet revoked,
+     - the delegate of a parent that wasn't yet revoked, for re-delegations,
+     - a director, or a grantor whose own authority wasn't yet revoked, for revocations.
 
    Unsigned, forged, copied or written-back versions are skipped as if absent. Grants made by a director remain valid after that director leaves the board.
-5. Walk the chain to the role (at most 16 links). Every link must be:
-   - active and within its validity window,
-   - for the same company,
-   - narrowing its parent,
-   - granted by the parent's delegate,
-   - from a parent that allows re-delegation.
-6. Check the payload against the chain:
+
+   Each resolved record also carries the eVault's storage times of its first valid grant and of its revocation. Those times decide firing, not dates the signer wrote.
+5. Walk the chain to the role (at most 16 links):
+   - The signer's own delegation must be active and within its validity window.
+   - Every link above must be for the same company, granted by its parent's delegate, and from a parent that allows re-delegation.
+   - A revoked link above still counts **if it was revoked after granting what is below it, without cascading** (see below).
+6. Effective scopes are the **intersection of every link's current scopes**, role included.
+7. Check the payload against the chain:
    - the right company, signer and delegation,
-   - the scope is in the chain's scopes,
+   - the scope is in the effective scopes,
    - the scope is not core.
 
-**Revocation cascades implicitly.** Revoking or narrowing a role or delegation fails the chain of everything handed on from it at the next verification. Nothing else needs to be written.
+### Firing and cascading
+
+- **Revoking a person stops only them.** If Bob is fired, Bob can't sign any more. But a delegation Bob granted to Dave **before** he was fired stays valid, and so does everything Dave handed on. "Before" means the eVault stored Dave's grant before it stored Bob's revocation.
+- **Revoking a role** works the same way. Holders granted before the revocation keep their delegations, and no new grants can be made from the role.
+- **Cascading is explicit.** A revocation with `revocationCascade: true` also revokes everything handed on from that record. One signed record does it; the children are not touched.
+- **Anything signed after the revocation doesn't count.** A fired Bob can't grant, update or revoke anything.
+- **Holders below a fired link can keep handing on.** Dave can still re-delegate, if his own record allows it.
+- **A grant can never be wider than its source was when it was made.** If Bob holds only NDAs when he grants Dave NDAs and invoices, that grant never counts, even if Bob is widened later.
+- **Narrowing always follows the parent now.** If Bob's delegation (or the role) loses invoices, everyone below Bob loses invoices at the next verification, whatever they were originally given.
+
+```mermaid
+flowchart LR
+    A{"parent revoked?"} -- no --> OK["counts"]
+    A -- yes --> B{"revocationCascade?"}
+    B -- yes --> X1["✗ REVOKED"]
+    B -- no --> C{"child granted before<br/>the revocation?"}
+    C -- yes --> OK2["counts"]
+    C -- no --> X2["✗ REVOKED"]
+```
 
 ### Why a trace fails
 
 | Code | Meaning |
 |---|---|
 | `NOT_FOUND` | No valid version: never granted by anyone entitled, or copied from another record |
-| `REVOKED` | This link, or one above it, was revoked |
-| `NOT_A_SUBSET` | Scopes wider than the parent's or role's |
+| `REVOKED` | The signer was revoked, or a link above was revoked before granting what is below it, or revoked with cascade |
 | `REDELEGATION_NOT_ALLOWED` | The parent (or role) did not allow passing it on |
 | `WRONG_GRANTOR` | Not granted by the parent's delegate |
 | `EXPIRED` / `NOT_YET_VALID` | Outside its validity window |
diff --git a/examples/company-delegation-demo/README.md b/examples/company-delegation-demo/README.md
index 1b555c244..e5c42958c 100644
--- a/examples/company-delegation-demo/README.md
+++ b/examples/company-delegation-demo/README.md
@@ -22,9 +22,10 @@ Dana founds Acme and makes Bob Head of Finance; Bob passes it to Dave, and Dave
 | Tim passes his badge to Mallory | refused at Mallory: Tim couldn't pass it on |
 | Tim's signature replayed as a login | refused: reserved payload |
 | Mallory writes herself onto the board | refused: nobody entitled granted it |
-| Dana revokes Bob, Tim signs again | refused at Bob: revoked |
+| Dana fires Bob, then Bob and Tim sign | Bob refused; Tim valid: Bob was fired after granting |
+| Dana revokes Dave and everything he handed on | refused at Dave: revoked with cascade |
 
-**Start fresh** (slide 0) clears Acme and Act 1 provisions a fresh company eVault; on the dashboard, **Start over with a new Acme** does both. Wallets are reused. Revoking Bob is permanent for that Acme, so the acts that need Tim's chain lock until you start fresh.
+**Start fresh** (slide 0) clears Acme and Act 1 provisions a fresh company eVault; on the dashboard, **Start over with a new Acme** does both. Wallets are reused. Acts heal themselves: if Acme is missing, or Dave was already revoked with cascade, playing an act founds a fresh Acme first.
 
 ## Headless
 
diff --git a/examples/company-delegation-demo/public/dashboard.html b/examples/company-delegation-demo/public/dashboard.html
index 17fb8f83a..484802079 100644
--- a/examples/company-delegation-demo/public/dashboard.html
+++ b/examples/company-delegation-demo/public/dashboard.html
@@ -86,7 +86,7 @@ <h2>What happened</h2>
 <script>
   const EXPECT = {
     "tim-nda": "valid", "tim-invoice": "refused", "tim-passes-on": "refused",
-    "login-replay": "refused", "mallory-board": "refused", "revoke-bob": "refused",
+    "login-replay": "refused", "mallory-board": "refused", "revoke-bob": "valid", "revoke-dave": "refused",
   };
   const results = {};
   const $ = (id) => document.getElementById(id);
@@ -138,8 +138,8 @@ <h2>What happened</h2>
     $("scenarios").innerHTML = state.scenarios.map((s) => {
       const r = results[s.id];
       const badge = r ? `<span class="tag ${r.passed ? "ok" : "bad"}">${r.passed ? "as expected" : "unexpected"}</span>` : "";
-      const locked = ["tim-nda", "tim-invoice", "tim-passes-on"].includes(s.id) && !!results["revoke-bob"];
-      return `<div><button data-id="${s.id}" ${locked ? "title='Bob is revoked: plays on a fresh Acme'" : ""}>${esc(s.label)} <span class="tag">expect ${EXPECT[s.id]}</span></button>
+      const locked = ["tim-nda", "tim-invoice", "tim-passes-on", "revoke-bob", "revoke-dave"].includes(s.id) && !!results["revoke-dave"];
+      return `<div><button data-id="${s.id}" ${locked ? "title='Dave is revoked: plays on a fresh Acme'" : ""}>${esc(s.label)} <span class="tag">expect ${EXPECT[s.id]}</span></button>
         ${r ? `<div class="result">${badge} ${esc(r.summary)}</div>` : ""}</div>`;
     }).join("");
     $("scenarios").querySelectorAll("button").forEach((b) => b.addEventListener("click", () => run(b.dataset.id)));
diff --git a/examples/company-delegation-demo/public/index.html b/examples/company-delegation-demo/public/index.html
index da79529e1..481223a3e 100644
--- a/examples/company-delegation-demo/public/index.html
+++ b/examples/company-delegation-demo/public/index.html
@@ -377,6 +377,7 @@ <h1>Who signs for Acme? <span style="font-weight:400;color:var(--muted)">· comp
       const d = start + i * BEAT;
       lines.push({ text: `${i + 1}. ${s.text}${s.ok === true ? " ✓" : s.ok === false ? " ✗" : ""}`, cls: s.ok === false ? "bad" : s.ok === true ? "ok" : "muted", d });
       if (s.ok === false && s.reason) lines.push({ text: `   ↳ ${s.reason}`, cls: "bad", d: d + .2 });
+      if (s.note) lines.push({ text: `   ↳ ${s.note}`, cls: "", d: d + .2 });
     });
     body += carried("paper", c.paper, [POS[c.signer] + 20, 330], LAND, .2);
     // ticks and crosses land on the people the trace passes through
@@ -530,26 +531,49 @@ <h1>Who signs for Acme? <span style="font-weight:400;color:var(--muted)">· comp
   },
   {
     kicker: "Act 10", id: "revoke-bob",
-    title: "Dana revokes Bob",
-    text: `Dana signs a revocation of Bob's delegation. Nobody touches Dave's or Tim's records, yet their authority came <b>through</b> Bob's. Tim signs again, and the trace breaks at Bob.`,
+    title: "Dana fires Bob",
+    text: `Dana signs a revocation of Bob's delegation, without cascading. Bob can't sign for Acme any more. But Dave's grant was signed by Bob <b>while he was still Head of Finance</b>, so it stands, and so does Tim's. Firing someone stops them, not the work they already handed on.`,
     scene: (o) => {
       const done = !!o && busy !== "revoke-bob";
       return traceScene(o, {
         signer: "tim", cast: ["dave", "bob", "dana"], paper: "NDA",
         say: done ? "Can I still sign?" : "Another NDA for Acme.",
-        before: done ? say("dana", "Bob is out.", .2) : carried("paper", "revoke Bob", [POS.dana + 20, 330], CAB_DROP, .3),
+        before: done
+          ? say("dana", "Bob, you're fired.", .2) + say("bob", "I can't sign for Acme any more.", .6)
+          : carried("paper", "fire Bob", [POS.dana + 20, 330], CAB_DROP, .3),
         held: done
-          ? [["bob", "revoked", true, .4], ["dave", "falls with it", true, .7], ["tim", "falls with it", true, 1.0]]
+          ? [["bob", "fired", true, .4], ["dave", "Finance officer"], ["tim", "NDA signer"]]
           : [["bob", "Head of Finance"], ["dave", "Finance officer"], ["tim", "NDA signer"]],
-        bad: "The chain breaks at Bob. Refused.",
-        badCaption: "Revoke one link and everything handed on from it falls too.",
+        ok: "Bob's out, but Dave's grant came first. Tim may sign.",
+        okCaption: "Firing Bob stops Bob. What he handed on while valid still stands.",
+        bad: "Refused.", badCaption: "Refused.",
+      });
+    },
+  },
+  {
+    kicker: "Act 11", id: "revoke-dave",
+    title: "Dana revokes Dave, and everything he handed on",
+    text: `Sometimes the company wants it all gone, for example if Dave misused it. Dana revokes Dave's delegation <b>with cascade</b>: one signed record that also revokes everything Dave handed on. Nobody touches Tim's record, yet his trace now breaks at Dave.`,
+    scene: (o) => {
+      const done = !!o && busy !== "revoke-dave";
+      return traceScene(o, {
+        signer: "tim", cast: ["dave", "bob", "dana"], paper: "NDA",
+        say: done ? "Can I still sign?" : "Another NDA for Acme.",
+        before: done
+          ? say("dana", "Dave, and everyone under you: out.", .2)
+          : carried("paper", "revoke Dave + all below", [POS.dana + 20, 330], CAB_DROP, .3),
+        held: done
+          ? [["dave", "revoked + cascade", true, .4], ["tim", "falls with it", true, .8]]
+          : [["dave", "Finance officer"], ["tim", "NDA signer"]],
+        bad: "Dave's revocation took everything he handed on. Refused.",
+        badCaption: "With cascade, one revocation takes everything handed on below it.",
       });
     },
   },
   {
     kicker: "Curtain",
     title: "What just happened",
-    text: `Acme's eVault stored everything, Mallory's and Tim's bad grants included, and enforced nothing. Every outcome came from tracing signatures back through Acme's history to the board.`,
+    text: `Acme's eVault stored everything, Mallory's and Tim's bad grants included, and enforced nothing. Every outcome came from tracing signatures back through Acme's history to the board. Firing someone stopped only them; a cascading revocation took everything below.`,
     recap: true,
     scene: () => world([...PEOPLE, "acme", "laptop"], {
       cabinet: cabinetLines(),
@@ -563,9 +587,9 @@ <h1>Who signs for Acme? <span style="font-weight:400;color:var(--muted)">· comp
 const params = new URLSearchParams(location.search);
 let index = clamp(Number(params.get("slide") || 0), 0, slides.length - 1);
 const current = () => slides[index];
-/* Revoking Bob breaks Tim's chain for good on this Acme. */
-const NEEDS_BOB = ["tim-nda", "tim-invoice", "tim-passes-on"];
-const locked = (id) => NEEDS_BOB.includes(id) && !!outcomes()["revoke-bob"];
+/* Revoking Dave with cascade breaks Tim's chain for good on this Acme. */
+const NEEDS_DAVE = ["tim-nda", "tim-invoice", "tim-passes-on", "revoke-bob", "revoke-dave"];
+const locked = (id) => NEEDS_DAVE.includes(id) && !!outcomes()["revoke-dave"];
 
 function render() {
   const s = current();
@@ -588,7 +612,7 @@ <h1>Who signs for Acme? <span style="font-weight:400;color:var(--muted)">· comp
   } else if (s.id) {
     controls += `<button class="go" id="act" ${busy ? "disabled" : ""}>${busy === s.id ? "Signing and verifying…" : o ? "Play it again" : "Play this scene"}</button>`;
     if (!ready()) controls += `<span class="note">No Acme yet: playing this founds one first.</span>`;
-    else if (locked(s.id)) controls += `<span class="note">Bob was revoked: playing this founds a fresh Acme first.</span>`;
+    else if (locked(s.id)) controls += `<span class="note">Dave was revoked with cascade: playing this founds a fresh Acme first.</span>`;
   }
   controls += `<div class="nav"><button id="back" ${index === 0 ? "disabled" : ""}>← Back</button><button id="next" ${index === slides.length - 1 ? "disabled" : ""}>Next →</button></div>`;
   document.getElementById("controls").innerHTML = controls;
diff --git a/examples/company-delegation-demo/src/demo.ts b/examples/company-delegation-demo/src/demo.ts
index cf04b7e79..5d9128850 100644
--- a/examples/company-delegation-demo/src/demo.ts
+++ b/examples/company-delegation-demo/src/demo.ts
@@ -103,6 +103,8 @@ export type TraceStep = {
     /** true checked, false where it broke, null never reached. */
     ok: boolean | null;
     reason?: string;
+    /** Why a revoked link still counts, e.g. it was revoked after granting. */
+    note?: string;
 };
 
 const now = () => new Date().toISOString();
@@ -489,7 +491,12 @@ export class Demo {
         );
         const directors = board.at(-1)?.directors ?? [];
 
-        const steps: (TraceStep & { id: string; grantor?: string })[] = [];
+        const steps: (TraceStep & {
+            id: string;
+            grantor?: string;
+            revoked?: boolean;
+            cascade?: boolean;
+        })[] = [];
         let id: string | undefined = delegationId;
         for (let i = 0; id && i < 8; i++) {
             const rec = await readRecord(company.eName, id);
@@ -499,6 +506,8 @@ export class Demo {
                 kind: "delegation",
                 person: keyOf(rec.delegateEName),
                 grantor: name(rec.grantedBy),
+                revoked: rec.status === "revoked",
+                cascade: rec.revocationCascade === true,
                 text: `${name(rec.delegateEName)} · ${rec.title} ← ${name(rec.grantedBy)}`,
                 ok: null,
             });
@@ -544,15 +553,36 @@ export class Demo {
             reason = reasons[chain.code] ?? chain.code.toLowerCase();
             if (chain.code === "REDELEGATION_NOT_ALLOWED")
                 reason = `${steps[failAt]?.grantor ?? "the giver"} ${reason}`;
+            if (chain.code === "REVOKED" && failAt > 0) {
+                reason = steps[failAt]?.cascade
+                    ? "revoked with cascade"
+                    : "revoked before granting";
+            }
         } else {
             failAt = 0;
             reason = result.detail ?? result.error ?? "refused";
         }
-        return steps.map(({ id: _id, grantor: _g, ...s }, i) => ({
-            ...s,
-            ok: failAt < 0 || i < failAt ? true : i === failAt ? false : null,
-            reason: i === failAt ? reason : undefined,
-        }));
+        return steps.map(
+            ({ id: _id, grantor: _g, revoked, cascade: _c, ...s }, i) => {
+                const ok =
+                    failAt < 0 || i < failAt
+                        ? true
+                        : i === failAt
+                          ? false
+                          : null;
+                return {
+                    ...s,
+                    ok,
+                    reason: i === failAt ? reason : undefined,
+                    // A revoked link above the signer that still checks out was
+                    // revoked after granting, without cascading.
+                    note:
+                        ok === true && revoked && i > 0
+                            ? "fired after granting"
+                            : undefined,
+                };
+            },
+        );
     }
 
     private verifyGrant(eName: string, payload: string, signature: string) {
@@ -571,6 +601,30 @@ export class Demo {
         return this.checked.get(key) as Promise<boolean>;
     }
 
+    /** Dana revokes someone's delegation, optionally with everything they handed on. */
+    private async revoke(key: string, cascade: boolean, message: string) {
+        const company = this.requireCompany();
+        const current =
+            (await readRecord(company.eName, company.delegations[key])) ?? {};
+        const { authorization: _drop, ...delegation } = current;
+        await this.grant(
+            "dana",
+            company.eName,
+            DELEGATION_ONTOLOGY,
+            company.delegations[key],
+            {
+                ...delegation,
+                status: "revoked",
+                revokedAt: now(),
+                revokedBy: this.eName("dana"),
+                revocationReason: "revoked",
+                revocationCascade: cascade,
+                updatedAt: now(),
+            },
+            message,
+        );
+    }
+
     /** `from` signs a re-delegation of their own delegation to `to`. */
     private async passOn(
         from: string,
@@ -750,37 +804,50 @@ export class Demo {
             },
         },
         "revoke-bob": {
-            label: "Dana revokes Bob, then Tim signs again",
+            label: "Dana fires Bob, then Bob and Tim sign",
             run: async () => {
-                const company = this.requireCompany();
-                const current =
-                    (await readRecord(
-                        company.eName,
-                        company.delegations.bob,
-                    )) ?? {};
-                const { authorization: _drop, ...delegation } = current;
-                await this.grant(
-                    "dana",
-                    company.eName,
-                    DELEGATION_ONTOLOGY,
-                    company.delegations.bob,
-                    {
-                        ...delegation,
-                        status: "revoked",
-                        revokedAt: now(),
-                        revokedBy: this.eName("dana"),
-                        revocationReason: "revoked",
-                        updatedAt: now(),
-                    },
-                    "Revoke Bob's delegation",
+                await this.revoke("bob", false, "Fire Bob");
+                const bob = await this.signFor(
+                    "bob",
+                    "bob",
+                    "@esigner:nda",
+                    "nda-bob-after-firing.pdf",
+                );
+                const tim = await this.signFor(
+                    "tim",
+                    "tim",
+                    "@esigner:nda",
+                    "nda-tim-after-firing.pdf",
+                );
+                const said = (r: VerifyDelegatedSignatureResult) =>
+                    r.valid
+                        ? `valid as "${r.title}"`
+                        : `refused (${r.detail ?? r.error})`;
+                return {
+                    scenario: "revoke-bob",
+                    expected: "valid",
+                    passed: !bob.result.valid && tim.result.valid,
+                    summary: `Bob: ${said(bob.result)} · Tim: ${said(tim.result)}`,
+                    result: tim.result,
+                    trace: tim.trace,
+                };
+            },
+        },
+        "revoke-dave": {
+            label: "Dana revokes Dave and everything he handed on",
+            run: async () => {
+                await this.revoke(
+                    "dave",
+                    true,
+                    "Revoke Dave and everything he handed on",
                 );
                 const { result, trace } = await this.signFor(
                     "tim",
                     "tim",
                     "@esigner:nda",
-                    "nda-after-revoke.pdf",
+                    "nda-after-cascade.pdf",
                 );
-                return outcome("revoke-bob", "refused", result, trace);
+                return outcome("revoke-dave", "refused", result, trace);
             },
         },
     };
@@ -878,15 +945,20 @@ export class Demo {
                 usable = false;
             }
         }
-        const needsChain = ["tim-nda", "tim-invoice", "tim-passes-on"].includes(
-            id,
-        );
-        const chainBroken = needsChain && !!this.outcomes["revoke-bob"];
+        // Tim's chain needs Dave live; firing Bob alone no longer breaks it.
+        const needsChain = [
+            "tim-nda",
+            "tim-invoice",
+            "tim-passes-on",
+            "revoke-bob",
+            "revoke-dave",
+        ].includes(id);
+        const chainBroken = needsChain && !!this.outcomes["revoke-dave"];
         if (usable && !chainBroken) return;
         const why = !company
             ? "no Acme yet: founding it first"
             : chainBroken
-              ? "Bob was revoked on this Acme: founding a fresh one"
+              ? "Dave was revoked with everything he handed on: founding a fresh Acme"
               : "Acme's eVault is gone: founding a fresh one";
         this.reset();
         this.note(undefined, why);
diff --git a/examples/company-delegation-demo/src/smoke.ts b/examples/company-delegation-demo/src/smoke.ts
index 6f8de2b6b..c9defac89 100644
--- a/examples/company-delegation-demo/src/smoke.ts
+++ b/examples/company-delegation-demo/src/smoke.ts
@@ -16,6 +16,7 @@ const ORDER = [
     "login-replay",
     "mallory-board",
     "revoke-bob",
+    "revoke-dave",
 ];
 let failed = 0;
 try {
diff --git a/packages/delegation/src/chain.spec.ts b/packages/delegation/src/chain.spec.ts
index 649de48dc..ee67cbbf2 100644
--- a/packages/delegation/src/chain.spec.ts
+++ b/packages/delegation/src/chain.spec.ts
@@ -100,7 +100,6 @@ describe("evaluateDelegation", () => {
             { validFrom: "2027-01-01T00:00:00.000Z" },
             "NOT_YET_VALID",
         ],
-        ["wider than its role", { scopes: [NDA] }, {}, "NOT_A_SUBSET"],
         [
             "a core scope",
             { scopes: ["@w3ds:auth"] },
@@ -131,6 +130,121 @@ describe("evaluateDelegation", () => {
         },
     );
 
+    it("narrows to what the role covers now", async () => {
+        const result = await evaluate(
+            "d1",
+            source({ r1: role({ scopes: [NDA] }) }, { d1: delegation() }),
+        );
+        expect(result).toMatchObject({ ok: true, scopes: [NDA] });
+    });
+
+    it("keeps a child granted before its parent was revoked", async () => {
+        const result = await evaluate(
+            "d2",
+            source(
+                { r1: role() },
+                {
+                    d1: delegation({
+                        status: "revoked",
+                        createdAt: "2026-01-01T00:00:00.000Z",
+                        revokedAt: "2026-06-01T00:00:00.000Z",
+                    }),
+                    d2: delegation({
+                        roleId: undefined,
+                        parentDelegationId: "d1",
+                        grantedBy: "@bob",
+                        delegateEName: "@carol",
+                        mayRedelegate: false,
+                        createdAt: "2026-03-01T00:00:00.000Z",
+                    }),
+                },
+            ),
+        );
+        expect(result).toMatchObject({ ok: true, delegateEName: "@carol" });
+    });
+
+    it("drops a child when its parent's revocation cascades", async () => {
+        const result = await evaluate(
+            "d2",
+            source(
+                { r1: role() },
+                {
+                    d1: delegation({
+                        status: "revoked",
+                        revocationCascade: true,
+                        createdAt: "2026-01-01T00:00:00.000Z",
+                        revokedAt: "2026-06-01T00:00:00.000Z",
+                    }),
+                    d2: delegation({
+                        roleId: undefined,
+                        parentDelegationId: "d1",
+                        grantedBy: "@bob",
+                        delegateEName: "@carol",
+                        mayRedelegate: false,
+                        createdAt: "2026-03-01T00:00:00.000Z",
+                    }),
+                },
+            ),
+        );
+        expect(result).toMatchObject({ ok: false, code: "REVOKED", at: "d1" });
+    });
+
+    it("fails closed on an ancestor with an unknown status", async () => {
+        const result = await evaluate(
+            "d2",
+            source(
+                { r1: role() },
+                {
+                    d1: delegation({ status: "suspended" as "active" }),
+                    d2: delegation({
+                        roleId: undefined,
+                        parentDelegationId: "d1",
+                        grantedBy: "@bob",
+                        delegateEName: "@carol",
+                        mayRedelegate: false,
+                    }),
+                },
+            ),
+        );
+        expect(result).toMatchObject({
+            ok: false,
+            code: "MALFORMED",
+            at: "d1",
+        });
+    });
+
+    it("refuses malformed scopes instead of throwing", async () => {
+        const leaf = await evaluate(
+            "d1",
+            source(
+                { r1: role() },
+                {
+                    d1: delegation({
+                        scopes: undefined as unknown as string[],
+                    }),
+                },
+            ),
+        );
+        expect(leaf).toMatchObject({ ok: false, code: "MALFORMED" });
+        const parent = await evaluate(
+            "d2",
+            source(
+                { r1: role() },
+                {
+                    d1: delegation({ scopes: "nda" as unknown as string[] }),
+                    d2: delegation({
+                        roleId: undefined,
+                        parentDelegationId: "d1",
+                        grantedBy: "@bob",
+                        delegateEName: "@carol",
+                        mayRedelegate: false,
+                    }),
+                },
+            ),
+        );
+        expect(parent).toMatchObject({ ok: false, code: "MALFORMED" });
+    });
+
     it("rejects a revoked role", async () => {
         const result = await evaluate(
             "d1",
diff --git a/packages/delegation/src/chain.ts b/packages/delegation/src/chain.ts
index 8e2b9937c..32f86af82 100644
--- a/packages/delegation/src/chain.ts
+++ b/packages/delegation/src/chain.ts
@@ -1,16 +1,34 @@
 import type { DelegatedSignPayload } from "./payloads";
-import {
-    checkScopes,
-    isCoreScope,
-    isScopeSubset,
-    normaliseScope,
-    type Scope,
-} from "./scopes";
+import { checkScopes, isCoreScope, normaliseScope, type Scope } from "./scopes";
 
 type Validity = {
     validFrom?: string | null;
     validUntil?: string | null;
     status: "active" | "revoked";
+    createdAt?: string;
+    revokedAt?: string | null;
+    /** Set on a revocation that also revokes everything handed on from it. */
+    revocationCascade?: boolean | null;
+    /** Trusted timing from the eVault's history, when the source has it. */
+    meta?: RecordMeta;
+};
+
+/**
+ * When a record was first validly granted and validly revoked, by the eVault's
+ * own storage clock, and whether that revocation cascades. History-backed
+ * sources fill this in; without it the record's own dates are used.
+ */
+export type RecordMeta = {
+    grantedAt?: number;
+    revokedAt?: number;
+    cascade?: boolean;
+    /** Each valid version's scopes and re-delegation right, by storage time. */
+    timeline?: {
+        at: number;
+        status: string;
+        scopes: Scope[];
+        mayRedelegate: boolean;
+    }[];
 };
 
 export type RoleRecord = Validity & {
@@ -47,7 +65,6 @@ export type ChainFailureCode =
     | "MALFORMED"
     | "CORE_SCOPE"
     | "WRONG_COMPANY"
-    | "NOT_A_SUBSET"
     | "REDELEGATION_NOT_ALLOWED"
     | "WRONG_GRANTOR"
     | "CYCLE"
@@ -100,9 +117,11 @@ export function isWindowWithin(child: Validity, parent: Validity): boolean {
 
 /**
  * Walks a delegation up to the role it ultimately assigns and decides what it
- * lets its delegate sign now. Every link must be live, stay within the
- * company, only narrow its parent, be granted by its parent's delegate, and
- * come from a parent that allows re-delegation.
+ * lets its delegate sign now. The delegate's own link must be live. Each link
+ * above must stay within the company, allow re-delegation, and either be live
+ * or have been revoked only after granting what is below it (and without
+ * cascading). What can be signed is the intersection of every link's current
+ * scopes, so narrowing a parent narrows everything below it.
  *
  * Whether a director was entitled to assign the role is checked when the
  * record is written (the eVault's write guard), not here.
@@ -122,6 +141,15 @@ export async function evaluateDelegation(
 
     const chain: string[] = [];
     const appLimits: Record<string, unknown>[] = [];
+    // What the signer may sign now: every link's current scopes, intersected,
+    // so narrowing anything above shrinks everything below.
+    let effective = new Set<string | null>();
+    const narrow = (scopes: unknown): boolean => {
+        if (!Array.isArray(scopes)) return false;
+        const keep = new Set(scopes.map((s) => normaliseScope(s)));
+        effective = new Set([...effective].filter((s) => keep.has(s)));
+        return true;
+    };
     let id = delegationId;
     let current = leaf;
 
@@ -132,15 +160,25 @@ export async function evaluateDelegation(
         }
         chain.push(id);
 
-        const problem = linkProblem(current, leaf.companyEName, now);
+        // The signer must be live; a revoked link above may still back them.
+        const problem = linkProblem(
+            current,
+            leaf.companyEName,
+            now,
+            current !== leaf,
+        );
         if (problem) return fail(problem.code, id, problem.message);
+        // The signer's scopes are only read once they are known to be well formed.
+        if (current === leaf) {
+            effective = new Set(leaf.scopes.map((s) => normaliseScope(s)));
+        }
         if (current.appLimits) appLimits.unshift(current.appLimits);
 
         if (current.roleId) {
             const role = await source.role(current.roleId);
             if (!role)
                 return fail("NOT_FOUND", current.roleId, "role not found");
-            const roleProblem = linkProblem(role, leaf.companyEName, now);
+            const roleProblem = linkProblem(role, leaf.companyEName, now, true);
             if (roleProblem) {
                 return fail(
                     roleProblem.code,
@@ -148,9 +186,10 @@ export async function evaluateDelegation(
                     roleProblem.message,
                 );
             }
-            if (!isScopeSubset(current.scopes, role.scopes)) {
-                return fail("NOT_A_SUBSET", id, "scopes exceed the role");
+            if (!stillBacks(role, current)) {
+                return fail("REVOKED", current.roleId, "role revoked");
             }
+            narrow(role.scopes);
             if (current.mayRedelegate && !role.mayRedelegate) {
                 return fail(
                     "REDELEGATION_NOT_ALLOWED",
@@ -164,7 +203,7 @@ export async function evaluateDelegation(
                 companyEName: leaf.companyEName,
                 delegateEName: leaf.delegateEName,
                 title: leaf.title,
-                scopes: leaf.scopes.map((s) => normaliseScope(s) as Scope),
+                scopes: [...effective].filter((s): s is Scope => s !== null),
                 appLimits,
                 chain,
                 roleId: current.roleId,
@@ -174,7 +213,24 @@ export async function evaluateDelegation(
         const parentId = current.parentDelegationId as string;
         const parent = await source.delegation(parentId);
         if (!parent) return fail("NOT_FOUND", parentId, "parent not found");
-        if (!parent.mayRedelegate) {
+        if (parent.status !== "active" && parent.status !== "revoked") {
+            return fail(
+                "MALFORMED",
+                parentId,
+                `unknown status ${String(parent.status)}`,
+            );
+        }
+        if (!stillBacks(parent, current)) {
+            return fail(
+                "REVOKED",
+                parentId,
+                "revoked before granting, or with everything handed on",
+            );
+        }
+        // A revoked parent that still backs this child is judged as it was
+        // when the child was granted (history enforces that); its revocation
+        // turning re-delegation off must not cascade.
+        if (!parent.mayRedelegate && parent.status !== "revoked") {
             return fail(
                 "REDELEGATION_NOT_ALLOWED",
                 id,
@@ -188,18 +244,48 @@ export async function evaluateDelegation(
                 "not granted by the parent's delegate",
             );
         }
-        if (!isScopeSubset(current.scopes, parent.scopes)) {
-            return fail("NOT_A_SUBSET", id, "scopes exceed the parent");
+        if (!narrow(parent.scopes)) {
+            return fail("MALFORMED", parentId, "bad scopes");
         }
         id = parentId;
         current = parent;
     }
 }
 
+/**
+ * Whether a parent still backs a child granted under it. Revoking someone
+ * stops only them: what they granted while still valid stands, unless the
+ * revocation explicitly cascades to everything handed on.
+ */
+function stillBacks(parent: Validity, child: Validity): boolean {
+    if (parent.status === "active") return true;
+    // Only an explicit revocation can still back what it granted before.
+    if (parent.status !== "revoked") return false;
+    // Anything but an explicit false (or no flag) counts as a cascade, so a
+    // malformed flag fails closed.
+    const flag = parent.revocationCascade;
+    const cascade =
+        parent.meta?.cascade ??
+        (flag !== undefined && flag !== null && flag !== false);
+    if (cascade) return false;
+    const revokedAt =
+        parent.meta?.revokedAt ??
+        (parent.revokedAt ? Date.parse(parent.revokedAt) : Number.NaN);
+    const grantedAt =
+        child.meta?.grantedAt ??
+        (child.createdAt ? Date.parse(child.createdAt) : Number.NaN);
+    return (
+        Number.isFinite(revokedAt) &&
+        Number.isFinite(grantedAt) &&
+        grantedAt < revokedAt
+    );
+}
+
 function linkProblem(
     record: (RoleRecord | DelegationRecord) & Validity,
     companyEName: string,
     now: Date,
+    revokedIsJudgedSeparately = false,
 ): { code: ChainFailureCode; message: string } | null {
     if (record.companyEName !== companyEName) {
         return { code: "WRONG_COMPANY", message: "belongs to another company" };
@@ -215,7 +301,17 @@ function linkProblem(
         }
     }
     if (record.status !== "active") {
-        return { code: "REVOKED", message: "revoked" };
+        // Only an explicit revocation above the signer is judged separately;
+        // any other status fails closed.
+        if (record.status !== "revoked") {
+            return {
+                code: "MALFORMED",
+                message: `unknown status ${String(record.status)}`,
+            };
+        }
+        if (!revokedIsJudgedSeparately) {
+            return { code: "REVOKED", message: "revoked" };
+        }
     }
     const window = windowProblem(record, now);
     if (window) return { code: window, message: window.toLowerCase() };
diff --git a/packages/delegation/src/history.spec.ts b/packages/delegation/src/history.spec.ts
index 68a12fc50..33f319b9b 100644
--- a/packages/delegation/src/history.spec.ts
+++ b/packages/delegation/src/history.spec.ts
@@ -313,10 +313,10 @@ describe("evaluateFromHistory", () => {
             role({ scopes: [NDA] }),
         );
         vault.write("role", ROLE_ONTOLOGY, v1.parsed);
-        // Bob's [NDA, INVOICE] no longer fits the narrowed role.
+        // The narrowed role still holds: Bob is cut down to NDAs.
         expect(await evaluate(vault, "bob")).toMatchObject({
-            ok: false,
-            code: "NOT_A_SUBSET",
+            ok: true,
+            scopes: [NDA],
         });
     });
 
@@ -396,7 +396,7 @@ describe("evaluateFromHistory", () => {
         });
     });
 
-    it("revokes children implicitly when the role is revoked", async () => {
+    it("keeps holders of a role revoked without cascading", async () => {
         const vault = await acme();
         await vault.signed(
             "role",
@@ -404,6 +404,15 @@ describe("evaluateFromHistory", () => {
             "@dir",
             revoked(role(), "@dir"),
         );
+        expect(await evaluate(vault, "bob")).toMatchObject({ ok: true });
+    });
+
+    it("drops holders of a role revoked with cascade", async () => {
+        const vault = await acme();
+        await vault.signed("role", ROLE_ONTOLOGY, "@dir", {
+            ...revoked(role(), "@dir"),
+            revocationCascade: true,
+        });
         expect(await evaluate(vault, "bob")).toMatchObject({
             ok: false,
             code: "REVOKED",
@@ -566,6 +575,246 @@ describe("evaluateFromHistory", () => {
         expect(reads).toBeLessThan(25);
     });
 
+    describe("firing", () => {
+        /** Bob hands NDAs on to Carol, then Dana fires Bob. */
+        async function fired(cascade = false) {
+            const vault = await acme();
+            await vault.signed(
+                "carol",
+                DELEGATION_ONTOLOGY,
+                "@bob",
+                delegation({
+                    roleId: undefined,
+                    parentDelegationId: "bob",
+                    delegateEName: "@carol",
+                    grantedBy: "@bob",
+                    scopes: [NDA],
+                    mayRedelegate: true,
+                }),
+            );
+            await vault.signed("bob", DELEGATION_ONTOLOGY, "@dir", {
+                ...revoked(delegation(), "@dir"),
+                ...(cascade ? { revocationCascade: true } : {}),
+            });
+            return vault;
+        }
+
+        it("stops Bob but keeps what he granted before", async () => {
+            const vault = await fired();
+            expect(await evaluate(vault, "bob")).toMatchObject({
+                ok: false,
+                code: "REVOKED",
+                at: "bob",
+            });
+            expect(await evaluate(vault, "carol")).toMatchObject({
+                ok: true,
+                chain: ["carol", "bob"],
+            });
+        });
+
+        it("drops everything Bob handed on when the firing cascades", async () => {
+            const vault = await fired(true);
+            expect(await evaluate(vault, "carol")).toMatchObject({
+                ok: false,
+                code: "REVOKED",
+                at: "bob",
+            });
+        });
+
+        it("ignores grants Bob signs after he was fired", async () => {
+            const vault = await fired();
+            await vault.signed(
+                "late",
+                DELEGATION_ONTOLOGY,
+                "@bob",
+                delegation({
+                    roleId: undefined,
+                    parentDelegationId: "bob",
+                    delegateEName: "@eve",
+                    grantedBy: "@bob",
+                    scopes: [NDA],
+                }),
+            );
+            expect(await evaluate(vault, "late")).toMatchObject({
+                ok: false,
+                code: "NOT_FOUND",
+            });
+        });
+
+        it("ignores Bob revoking his grants after he was fired", async () => {
+            const vault = await fired();
+            const [carol] = await vault.versions("carol");
+            await vault.signed(
+                "carol",
+                DELEGATION_ONTOLOGY,
+                "@bob",
+                revoked(carol.parsed as any, "@bob"),
+            );
+            expect(await evaluate(vault, "carol")).toMatchObject({ ok: true });
+        });
+
+        it("lets Carol keep handing on below a fired Bob", async () => {
+            const vault = await fired();
+            await vault.signed(
+                "dan",
+                DELEGATION_ONTOLOGY,
+                "@carol",
+                delegation({
+                    roleId: undefined,
+                    parentDelegationId: "carol",
+                    delegateEName: "@dan",
+                    grantedBy: "@carol",
+                    scopes: [NDA],
+                    mayRedelegate: false,
+                }),
+            );
+            expect(await evaluate(vault, "dan")).toMatchObject({
+                ok: true,
+                chain: ["dan", "carol", "bob"],
+            });
+        });
+
+        it("never wakes up a grant that was wider than its parent when made", async () => {
+            const vault = await acme();
+            // Bob is narrowed to NDAs, then grants Carol NDAs and invoices.
+            await vault.signed(
+                "bob",
+                DELEGATION_ONTOLOGY,
+                "@dir",
+                delegation({
+                    scopes: [NDA],
+                    updatedAt: "2026-10-05T00:00:00.000Z",
+                }),
+            );
+            await vault.signed(
+                "carol",
+                DELEGATION_ONTOLOGY,
+                "@bob",
+                delegation({
+                    roleId: undefined,
+                    parentDelegationId: "bob",
+                    delegateEName: "@carol",
+                    grantedBy: "@bob",
+                    scopes: [NDA, INVOICE],
+                    mayRedelegate: false,
+                }),
+            );
+            // Widening Bob again must not make Carol's old grant valid.
+            await vault.signed(
+                "bob",
+                DELEGATION_ONTOLOGY,
+                "@dir",
+                delegation({ updatedAt: "2026-10-06T00:00:00.000Z" }),
+            );
+            expect(await evaluate(vault, "carol")).toMatchObject({
+                ok: false,
+                code: "NOT_FOUND",
+            });
+        });
+
+        it("keeps Carol when Bob's firing also turns off passing it on", async () => {
+            const vault = await acme();
+            await vault.signed(
+                "carol",
+                DELEGATION_ONTOLOGY,
+                "@bob",
+                delegation({
+                    roleId: undefined,
+                    parentDelegationId: "bob",
+                    delegateEName: "@carol",
+                    grantedBy: "@bob",
+                    scopes: [NDA],
+                    mayRedelegate: false,
+                }),
+            );
+            await vault.signed("bob", DELEGATION_ONTOLOGY, "@dir", {
+                ...revoked(delegation(), "@dir"),
+                mayRedelegate: false,
+            });
+            expect(await evaluate(vault, "carol")).toMatchObject({ ok: true });
+        });
+
+        it("treats a malformed cascade flag as a cascade", async () => {
+            const vault = await acme();
+            await vault.signed(
+                "carol",
+                DELEGATION_ONTOLOGY,
+                "@bob",
+                delegation({
+                    roleId: undefined,
+                    parentDelegationId: "bob",
+                    delegateEName: "@carol",
+                    grantedBy: "@bob",
+                    scopes: [NDA],
+                    mayRedelegate: false,
+                }),
+            );
+            await vault.signed("bob", DELEGATION_ONTOLOGY, "@dir", {
+                ...revoked(delegation(), "@dir"),
+                revocationCascade: "true",
+            });
+            expect(await evaluate(vault, "carol")).toMatchObject({
+                ok: false,
+                code: "REVOKED",
+                at: "bob",
+            });
+        });
+
+        it("ignores grants made while the parent was in an unknown status", async () => {
+            const vault = await acme();
+            await vault.signed(
+                "bob",
+                DELEGATION_ONTOLOGY,
+                "@dir",
+                delegation({
+                    status: "suspended",
+                    updatedAt: "2026-10-05T00:00:00.000Z",
+                }),
+            );
+            await vault.signed(
+                "carol",
+                DELEGATION_ONTOLOGY,
+                "@bob",
+                delegation({
+                    roleId: undefined,
+                    parentDelegationId: "bob",
+                    delegateEName: "@carol",
+                    grantedBy: "@bob",
+                    scopes: [NDA],
+                    mayRedelegate: false,
+                }),
+            );
+            await vault.signed(
+                "bob",
+                DELEGATION_ONTOLOGY,
+                "@dir",
+                delegation({ updatedAt: "2026-10-06T00:00:00.000Z" }),
+            );
+            expect(await evaluate(vault, "bob")).toMatchObject({ ok: true });
+            expect(await evaluate(vault, "carol")).toMatchObject({
+                ok: false,
+                code: "NOT_FOUND",
+            });
+        });
+
+        it("still narrows Carol when the role is narrowed", async () => {
+            const vault = await fired();
+            await vault.signed(
+                "role",
+                ROLE_ONTOLOGY,
+                "@dir",
+                role({
+                    scopes: [INVOICE],
+                    updatedAt: "2026-11-01T00:00:00.000Z",
+                }),
+            );
+            expect(await evaluate(vault, "carol")).toMatchObject({
+                ok: true,
+                scopes: [],
+            });
+        });
+    });
+
     it("finds nothing without a board", async () => {
         const vault = new Vault();
         await vault.signed("role", ROLE_ONTOLOGY, "@dir", role());
diff --git a/packages/delegation/src/history.ts b/packages/delegation/src/history.ts
index 85a9e3f0d..b3053302c 100644
--- a/packages/delegation/src/history.ts
+++ b/packages/delegation/src/history.ts
@@ -13,6 +13,7 @@ import {
     ROLE_ONTOLOGY,
 } from "./ontologies";
 import { checkGrantAuthorization, type VerifySignature } from "./payloads";
+import { isScopeSubset, type Scope } from "./scopes";
 
 /**
  * One version of a MetaEnvelope as the eVault's `metaEnvelopeHistory` returns
@@ -128,9 +129,11 @@ const DELEGATION_IMMUTABLE = [
 /**
  * Resolves Roles and Delegations from history and feeds them to the chain
  * evaluator. A signer must have been entitled when their version was stored:
- * a director for a role or a role assignment, the parent's delegate for a
- * re-delegation, and a director or the grantor to revoke. Grants outlive a
- * director's later removal. Revocation is final.
+ * a director for a role or a role assignment (from a role not yet revoked),
+ * the delegate of a not-yet-revoked parent for a re-delegation, and a director
+ * or a still-entitled grantor to revoke. Grants outlive their grantor's later
+ * removal or revocation; anything signed after it does not count. Revocation
+ * is final. Each record carries `meta` with its trusted grant and revoke times.
  *
  * A source is a snapshot for one verification: it caches what it reads and
  * never re-reads history, so build a new one per verification (as
@@ -158,27 +161,61 @@ export function historyChainSource(ctx: HistoryContext): ChainSource {
             ctx,
             async (p, state, signer, at) => {
                 const directors = boardAt(ctx.board, at);
+                // Whether the grantor of this record still held their
+                // authority at that moment: a sitting director for a role
+                // assignment, a live parent for a re-delegation. A grant must
+                // also fit what its source held then, so widening the source
+                // later can never wake up a grant that was too wide.
+                const grantorLive = async (
+                    rec: Record<string, any>,
+                    isGrant: boolean,
+                ) => {
+                    const fits = (
+                        source: {
+                            scopes: Scope[];
+                            mayRedelegate: boolean;
+                        } | null,
+                        needsRedelegate: boolean,
+                    ) =>
+                        !isGrant ||
+                        (!!source &&
+                            Array.isArray(rec.scopes) &&
+                            isScopeSubset(rec.scopes, source.scopes) &&
+                            (!needsRedelegate || source.mayRedelegate));
+                    if (typeof rec.roleId === "string") {
+                        const role = await source.role(rec.roleId);
+                        return (
+                            directors.includes(rec.grantedBy) &&
+                            liveAt(role, at) &&
+                            fits(stateAt(role, at), rec.mayRedelegate === true)
+                        );
+                    }
+                    if (typeof rec.parentDelegationId === "string") {
+                        const parent = await resolveDelegation(
+                            rec.parentDelegationId,
+                            inner,
+                        );
+                        return (
+                            parent?.delegateEName === rec.grantedBy &&
+                            liveAt(parent, at) &&
+                            fits(stateAt(parent, at), true)
+                        );
+                    }
+                    return false;
+                };
                 if (p.status === "revoked") {
-                    // Revoking needs something valid to revoke.
+                    // Revoking needs something valid to revoke, and a
+                    // director or a grantor who has not been revoked since.
                     if (!state) return false;
+                    if (!revokedBySigner(p, signer)) return false;
+                    if (directors.includes(signer)) return true;
                     return (
-                        revokedBySigner(p, signer) &&
-                        (directors.includes(signer) ||
-                            signer === state.grantedBy)
+                        signer === state.grantedBy &&
+                        (await grantorLive(state, false))
                     );
                 }
                 if (p.grantedBy !== signer) return false;
-                if (typeof p.roleId === "string") {
-                    return directors.includes(signer);
-                }
-                if (typeof p.parentDelegationId === "string") {
-                    const parent = await resolveDelegation(
-                        p.parentDelegationId,
-                        inner,
-                    );
-                    return parent?.delegateEName === signer;
-                }
-                return false;
+                return grantorLive(p, true);
             },
         )) as DelegationRecord | null;
         delegations.set(id, resolved);
@@ -258,6 +295,16 @@ async function resolveRecord(
 ): Promise<Record<string, any> | null> {
     let state: Record<string, any> | null = null;
     let lastSignedAt = Number.NEGATIVE_INFINITY;
+    // Storage times of the first valid grant and of a valid revocation: the
+    // eVault's clock, which no signer controls.
+    let grantedAt: number | undefined;
+    let revokedAt: number | undefined;
+    const timeline: {
+        at: number;
+        status: string;
+        scopes: Scope[];
+        mayRedelegate: boolean;
+    }[] = [];
 
     for (const v of await ctx.source.versions(id)) {
         if (state?.status === "revoked") break;
@@ -289,8 +336,71 @@ async function resolveRecord(
         }
         state = p;
         lastSignedAt = signed.signedAt;
+        const storedAt = Date.parse(v.createdAt);
+        grantedAt ??= storedAt;
+        if (p.status === "revoked") revokedAt = storedAt;
+        timeline.push({
+            at: storedAt,
+            status: String(p.status),
+            scopes: Array.isArray(p.scopes) ? p.scopes : [],
+            mayRedelegate: p.mayRedelegate === true,
+        });
+    }
+    if (!state) return null;
+    return {
+        ...state,
+        meta: {
+            grantedAt,
+            revokedAt,
+            // A malformed flag counts as a cascade, so it fails closed.
+            cascade:
+                revokedAt !== undefined &&
+                state.revocationCascade !== undefined &&
+                state.revocationCascade !== null &&
+                state.revocationCascade !== false,
+            timeline,
+        },
+    };
+}
+
+/** A record's scopes and re-delegation right as they stood at a moment. */
+function stateAt(
+    record: {
+        meta?: {
+            timeline?: {
+                at: number;
+                scopes: Scope[];
+                mayRedelegate: boolean;
+            }[];
+        };
+    } | null,
+    at: number,
+): { scopes: Scope[]; mayRedelegate: boolean } | null {
+    let found: { scopes: Scope[]; mayRedelegate: boolean } | null = null;
+    for (const entry of record?.meta?.timeline ?? []) {
+        if (entry.at <= at) found = entry;
+        else break;
+    }
+    return found;
+}
+
+/** Whether a record still carried authority at a moment of the eVault's clock. */
+function liveAt(
+    record: {
+        status?: string;
+        meta?: { timeline?: { at: number; status: string }[] };
+    } | null,
+    at: number,
+): boolean {
+    if (!record) return false;
+    // Live means active at that moment: not yet revoked, and not in some
+    // other status it may have passed through.
+    let status: string | undefined;
+    for (const entry of record.meta?.timeline ?? []) {
+        if (entry.at <= at) status = entry.status;
+        else break;
     }
-    return state;
+    return status === "active";
 }
 
 /** How far a signer's clock may run ahead of the eVault's. */
diff --git a/services/ontology/schemas/delegation.json b/services/ontology/schemas/delegation.json
index 7519d69cf..8e1674510 100644
--- a/services/ontology/schemas/delegation.json
+++ b/services/ontology/schemas/delegation.json
@@ -97,6 +97,13 @@
       ],
       "description": "`cascade` when revoked because a role or parent was revoked or narrowed"
     },
+    "revocationCascade": {
+      "type": [
+        "boolean",
+        "null"
+      ],
+      "description": "On a revocation: true also revokes everything handed on from this record; false (or absent) stops only this record, and what it granted while valid stands."
+    },
     "createdAt": {
       "type": "string",
       "format": "date-time"
@@ -218,6 +225,9 @@
           },
           "revocationReason": {
             "type": "null"
+          },
+          "revocationCascade": {
+            "type": "null"
           }
         }
       }
diff --git a/services/ontology/schemas/role.json b/services/ontology/schemas/role.json
index 49b33e6f9..435ec6a00 100644
--- a/services/ontology/schemas/role.json
+++ b/services/ontology/schemas/role.json
@@ -70,6 +70,13 @@
         "null"
       ]
     },
+    "revocationCascade": {
+      "type": [
+        "boolean",
+        "null"
+      ],
+      "description": "On a revocation: true also revokes everything handed on from this record; false (or absent) stops only this record, and what it granted while valid stands."
+    },
     "createdBy": {
       "type": "string",
       "pattern": "^@[^\\s]+$",
@@ -161,6 +168,9 @@
           },
           "revokedBy": {
             "type": "null"
+          },
+          "revocationCascade": {
+            "type": "null"
           }
         }
       }
diff --git a/skills/w3ds/reference/company-delegation.md b/skills/w3ds/reference/company-delegation.md
index 3f356cbc5..9d73025c2 100644
--- a/skills/w3ds/reference/company-delegation.md
+++ b/skills/w3ds/reference/company-delegation.md
@@ -12,7 +12,7 @@ Resolve the ontology ids (Company, Role, Delegation, Shareholding, DelegatedSign
 - **Company eVault.** It is keyless, and its `/whois` reports `type: "company"`, with the Company record as its manifest.
 - **Company record.** It holds `directors[]`. A board counts only if the record's **first version** carries it, signed by one of its own directors. After that, only a sitting director may change it. Any one director may create roles and grant or revoke delegations.
 - **Role.** It has a `title`, `scopes`, `mayRedelegate` and `appLimits`. It is created and signed by a director.
-- **Delegation.** It sets exactly one of `roleId` (granted by a director) or `parentDelegationId` (granted by the parent's delegate, only if the parent allows it). Its scopes must be a subset of what it came from. Revocation is a signed version with `status: "revoked"`, and it is final.
+- **Delegation.** It sets exactly one of `roleId` (granted by a director) or `parentDelegationId` (granted by the parent's delegate, only if the parent allows it). Its scopes must be a subset of what it came from. Revocation is a signed version with `status: "revoked"`, and it is final. It stops only that record: grants it made before stay valid, unless `revocationCascade: true`. Effective scopes are the intersection of every link's current scopes, so narrowing always flows down.
 - **Scopes.** Either `ontology:<schemaId>` or `@<platform-eName>:<keyword>`. Identity, the company's own authority records and the `@w3ds` namespace can **never** be delegated.
 - **The eVault enforces nothing.** It stores any write. Authority is decided only by the verifier, from signatures and version history.
 
@@ -48,7 +48,7 @@ const r = await verifyDelegatedSignature({ payload: body.sessionId, signature: b
 
 - **Don't add company or delegation checks to evault-core.** The eVault stays a plain store, and checks belong in verifiers.
 - **Don't delete authority records to revoke them.** Verifiers read history, so deleting does nothing. Write a signed revoked version instead.
-- **Revoking a parent fails everything handed on from it** at the next verification, with no writes to the children.
+- **Firing doesn't cascade by default.** Revoking Bob stops Bob, but what he granted before stays valid. Use `revocationCascade: true` to take everything below. Anything Bob signs after being fired is ignored.
 - **`appLimits` are opaque to the model.** The platform enforces them, and must satisfy every link's limits.
 - **Verifiers read at most 2,000 versions of any one record.**
 - **There are no use-count limits.** Use validity windows instead.