diff --git a/libraries/authority-client/go/workcontext/owner_target_test.go b/libraries/authority-client/go/workcontext/owner_target_test.go
index b18a69ed..d027b6c2 100644
--- a/libraries/authority-client/go/workcontext/owner_target_test.go
+++ b/libraries/authority-client/go/workcontext/owner_target_test.go
@@ -118,4 +118,3 @@ func TestScopesKeepTheirResourceOwner(t *testing.T) {
 		}
 	}
 }
-
diff --git a/libraries/conformance/go/solution_principal.go b/libraries/conformance/go/solution_principal.go
index ad6b7642..8d1cef33 100644
--- a/libraries/conformance/go/solution_principal.go
+++ b/libraries/conformance/go/solution_principal.go
@@ -462,6 +462,18 @@ func RunSolutionPrincipalTarget(t *testing.T, conn grpc.ClientConnInterface, des
 		sp.grant(t, A, "author", sp.person(t, f.Editor))
 		before := sp.must(t)(sp.through(t, f.Viewer, A, "store"))
 		unrelated := sp.must(t)(sp.through(t, f.Editor, A, "store"))
+		// A new grant, to the holder or to anyone else, leaves both valid.
+		sp.grant(t, A, "author", sp.person(t, f.Viewer))
+		sp.grant(t, A, "viewer", sp.person(t, f.Member))
+		for _, capability := range []protoreflect.Message{before, unrelated} {
+			if err := sp.check(capability); err != nil {
+				t.Fatalf("a new grant invalidated an existing capability: %v", err)
+			}
+		}
+		sp.revoke(t, A, "author", sp.person(t, f.Viewer))
+		sp.revoke(t, A, "viewer", sp.person(t, f.Member))
+		// Reissued, so the last-grant revoke below must kill a live capability.
+		before = sp.must(t)(sp.through(t, f.Viewer, A, "store"))
 		if !slices.Contains(sp.roleGrants(t, f.Admin, f.Organization, A), "viewer person "+sp.personID(t, f.Viewer)) {
 			t.Fatalf("ListRoleGrants does not show the grant: %v", sp.roleGrants(t, f.Admin, f.Organization, A))
 		}