Correct the revocation wording: empty responses are artifacts

Verified against subscriptions-api (code and a live grant/revoke
cycle): the server reports a revocation by returning the entitlement
as inactive and enumerates every config-mapped entitlement even for
users with no purchases, so real revocations arrive non-empty and
apply immediately. A fully empty entitlements array is a backend or
config artifact, which is the only shape the guard ignores. Update
the changelog and the guard comment to stop claiming revocations
wait for the expiry date.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: yusuftor

CHANGELOG.md

@@ -7,7 +7,7 @@ The changelog for `SuperwallKit`. Also see the [releases](https://github.com/sup
 ### Fixes
 
 - Fixes subscribers being reported as `inactive` on cold launch when the App Store has no purchases to report, which hit web and Stripe subscribers hardest. Refunded and expired App Store subscriptions still deactivate immediately.
-- Fixes paying web subscribers being reported as `inactive` on later cold launches after the server temporarily returns no entitlements for them. Revoking a web subscriber's entitlements now takes effect once their expiry date passes.
+- Fixes paying web subscribers being reported as `inactive` on later cold launches after the server temporarily returns no entitlement data for them. Revocations still take effect immediately, because the server reports revoked entitlements as inactive rather than omitting them.
 
 ## 4.16.3
 

Sources/SuperwallKit/Web/WebEntitlementRedeemer.swift

@@ -921,15 +921,18 @@ actor WebEntitlementRedeemer {
       )
 
       // A response with zero entitlements must not replace cached web
-      // entitlements that are still within their expiry date. This request is
-      // keyed on appUserId/deviceId alone, so an alias mismatch or backend
-      // hiccup can return empty for a still-paying subscriber. If it replaced
-      // the cache, the next cold launch would read the user as inactive until
-      // a network poll recovered them. The cost: revoking a web entitlement
-      // before its expiry date only takes effect once that date passes.
-      // Entitlements with no expiry date are not protected and remain
-      // revocable at any time. We skip saving the fetch date so the next
-      // poll retries without waiting out `entitlementsMaxAge`.
+      // entitlements that are still within their expiry date. The server
+      // reports a revocation by returning the entitlement as inactive —
+      // and it enumerates every config-mapped entitlement even for users
+      // with no purchases — so a fully empty array is a backend or config
+      // artifact (alias mismatch, failed upstream lookup), not a
+      // revocation. Real revocations arrive non-empty and apply
+      // immediately through the save below. If an empty response replaced
+      // the cache, the next cold launch would read the user as inactive
+      // until a network poll recovered them. Entitlements with no expiry
+      // date are not protected by this guard. We skip saving the fetch
+      // date so the next poll retries without waiting out
+      // `entitlementsMaxAge`.
       let hasUnexpiredWebEntitlements = existingWebEntitlements.contains {
         $0.isActive && ($0.expiresAt ?? .distantPast) > Date()
       }