Hit is whether the key is a member. It is meaningful ONLY when Refusal is empty: false with a refusal means the set could not be consulted, which is not the same as the key being clean.
Refusal is why the set could not be consulted, when it could not: never loaded, held elsewhere, or a source we hold no licence for. Non-empty means Hit must not be read as an answer.
Stale is whether the set is past its freshness bound. A stale set still answers — yesterday's list beats none — and this is how a decision knows it leaned on one.
Verdict is the tenant's own allow or deny, present only for an override. The baseline never carries one: it states facts and leaves the decision to the caller's policy.
Version is the exact baseline version consulted, composed of each contributing publisher and its content digest. It is what makes a decision reproducible: an auditor takes this string and knows precisely what was consulted.