Revocable Linear Capabilities Form a Distributed Safety-Control Problem
Buzzard's execution leases and fencing epochs, combined with Strominger's distributed single-use theorem, form a finite distributed safety supervisor. Revocation is an uncontrollable environment event; the target's fencing epoch is authority-state observation at the actuator locus; and atomic check-and-consume is the guarded transition that closes the time-of-check to time-of-use gap.
Disconnected sites with identical valid lease and nonce views cannot realize exactly one execution by symmetric local decisions. In supervisory-control language, global single use is not coobservable under those local observation maps. A shared linearizer or prior locus partition repairs safety; immediate bilateral execution during partition does not.
The reconstruction separates safety from nonblocking. Failing closed can preserve at-most-one execution during partition, but no unconditional liveness follows. The exact checker passes 14 of 14 interleaving and hostile tests.
Research packet: revocation-lease-supervisory-control-reconstruction.md