What does "revocation that propagates" actually mean?

Most systems treat revocation as fire-and-forget: flip the flag, hope caches expire. In a fleet, hope is not a control.

CueCrux revocation is a three-step protocol with evidence at each step:

1. Signed pull. The revocation is issued as a signed instruction, so its origin and scope are provable.
2. Per-agent acknowledgements. Every agent holding the revoked grant, credential, or memory acknowledges the pull. Outstanding holders are visible by name in the console; you always know exactly who has not complied yet.
3. Attestation at zero. When no holders remain, the system issues an attestation: a signed statement that the revocation has fully settled.

The result is that "is it gone?" has a yes/no answer backed by receipts, and "it is still propagating" comes with a list of exactly where. Propagating revocation ships with the Governance tier.