A "resolved" state that never resolves is just a renamed unknown

Automated excerpt

A commenter pointed out something I'd missed: that third state only means anything if something eventually resolves it. The second gap: two mechanisms, two different failure classes The same comment caught something else. These are separate mechanisms for separate failure classes. Token binding doesn't subsume re-verification, and re-verification doesn't subsume token binding. Any boundary that can't be cheaply read back across, whether it's a third-party API or a local content provider, needs the same DENIED_UNRESOLVED honesty, not an assumed EXECUTED.

Selected automatically from source text; not independently written or fact-checked. Read the original for full context.