01 · Bound lineage
What correction is being tested?
This receipt does not replace the earlier records. It binds to them and asks whether their result survives change.
CTR-R44-004
733ff147dfc4ac1c92a33acf70cf55c641a855f39bbe4ddf4774adf1f3a712f9
RMR-R45-005
83c70ff919f62bdc52d3a03776c617f6edf4bfcd605dfe44bf5ce596af390b53
NRV-R46-006
62df463c9c13faee07da24d2debf2ea089ccf255088262341283bd691945ad8c
SRP-R47-006
43fb79cfd2779999dae91f8c95d67fbce78ec88f964956c49eb9907b0858cd72
02 · Federation change
What changed, and how did the obligation travel?
institutional merger
scoped correction lineage plus recipient-specific pairwise reference
The correction may travel; a permanent map of the person may not.
The subject reference is recipient-specific, non-reusable, and not globally stable.
PAIR-R48-007-16461a7924
Participants
03 · Bounded observation
Where did the verifier look—and where did it not?
Observed surfaces
- decision store
- application cache
- event queue
- downstream export
- human workflow
- feature or model path
- downstream risk vendor
Known blind spots
- Undeclared systems outside the named fictional federation
- Future integrations after the observation window
Absence of evidence outside this plan is not evidence of absence.
Synthetic recurrence canaries
Detect revival of revoked adverse state after federation change. No personal data.
Detect adverse use of refusal, contest, or correction. No personal data.
04 · Durability tests
Did the old judgment return or get re-derived?
Synthetic corrected and uncorrected controls were evaluated separately.
Limit: Synthetic test only.
A fictional downstream vendor continues using a derived adverse feature after merger and cannot produce a complete correction acknowledgment.
Limit: This is an intentionally failed demonstration. Standing recovery remains incomplete until the adverse feature stops acting and independent evidence is produced.
Refusal, contest, correction, expiry, and human-review signals were exercised with synthetic events.
Limit: No claim is made beyond declared surfaces and dates.
Renewal used a new recipient-specific presentation identifier and did not expose the prior identifier.
Limit: External network metadata was outside scope.
05 · Anti-retaliation
Was refusal, contest, or correction used as a new adverse signal?
No within scope
Available
Fictional anti-retaliation officer
A downstream derived feature remained operative; anti-retaliation assurances are incomplete.
A person may decline to present portable proof without that refusal becoming guilt, risk, delay, or reduced eligibility.
06 · Unlinkable renewal
Can proof renew without becoming a permanent handle?
PRES-R47-007-OLD
PRES-R48-007-NEW-dcb798eb
failed due to unresolved downstream state
07 · Remaining obligations
What is still owed?
The downstream vendor has not demonstrated deactivation of the derived adverse feature.
Owner: Fictional merged-institution chief accountability officer · Deadline: 2026-09-30
Suspend downstream adverse use and complete independent deactivation proof.
Independent signatory: Fictional independent durability auditor
08 · Integrity and machine access
Inspect the exact bounded record.
Receipt hashes
Input: af63d9d7ac00883797ca2d1953b33736532a0439998b1d78298b591b503abce8
Output: e968c9c56efaca8fc3d7307581942ece1b155b5ebdd3fcb9a282e68502714822
Whole receipt: 61e3e10225edcedbe03a6eecfe94f6d07cc693cee4e902b81b0c67edf12b1663
Machine-readable endpoints
/recovery-durability/receipt?id=FDR-R48-007/recovery-durability/schema/recovery-durability/state-machine/recovery-durability/anti-retaliation/recovery-durability/federation-change-protocol/recovery-durability/observation-plan/recovery-durability/unlinkable-renewalComplete selected receipt
{
"schema": "antichrist.cx.federated-recovery-durability-receipt.v1",
"release": "R48",
"receipt_id": "FDR-R48-007",
"fictional": true,
"title": "Durability fails when a merged downstream vendor cannot prove deactivation",
"summary": "A fictional downstream vendor continues using a derived adverse feature after merger and cannot produce a complete correction acknowledgment.",
"domain": "multi_domain",
"terminal_status": "durability_failed",
"status_label": "Durability Failed",
"lineage": {
"contestability_receipt_id": "CTR-R44-004",
"contestability_receipt_sha256": "733ff147dfc4ac1c92a33acf70cf55c641a855f39bbe4ddf4774adf1f3a712f9",
"remedy_receipt_id": "RMR-R45-005",
"remedy_receipt_sha256": "83c70ff919f62bdc52d3a03776c617f6edf4bfcd605dfe44bf5ce596af390b53",
"non_recurrence_receipt_id": "NRV-R46-006",
"non_recurrence_receipt_sha256": "62df463c9c13faee07da24d2debf2ea089ccf255088262341283bd691945ad8c",
"standing_recovery_receipt_id": "SRP-R47-006",
"standing_recovery_receipt_sha256": "43fb79cfd2779999dae91f8c95d67fbce78ec88f964956c49eb9907b0858cd72",
"lineage_scope": "fictional demonstration lineage; hashes bind the referenced local R44–R47 artifacts where present"
},
"subject_reference": {
"scheme": "pairwise_ephemeral",
"value": "PAIR-R48-007-16461a7924",
"globally_stable": false,
"reusable_across_recipients": false
},
"observation_plan": {
"plan_id": "DOP-R48-007",
"window_start": "2026-08-01T00:00:00Z",
"window_end": "2026-08-29T23:59:59Z",
"bounded": true,
"independent_observer": "Fictional Independent Recovery Observatory",
"surfaces": [
"decision_store",
"application_cache",
"event_queue",
"downstream_export",
"human_workflow",
"feature_or_model_path",
"downstream_risk_vendor"
],
"known_blind_spots": [
"Undeclared systems outside the named fictional federation",
"Future integrations after the observation window"
],
"stop_conditions": [
"Any renewed adverse action from revoked material",
"Any use of refusal or correction as an adverse feature"
]
},
"federation_snapshot": {
"snapshot_id": "FED-R48-007",
"global_person_identifier": false,
"cleared_person_registry": false,
"participants": [
{
"participant_id": "PART-R48-007-A",
"role": "originating institution",
"pairwise_namespace": "pw-07-origin",
"correction_enforced": false
},
{
"participant_id": "PART-R48-007-B",
"role": "current service operator",
"pairwise_namespace": "pw-07-operator",
"correction_enforced": false
},
{
"participant_id": "PART-R48-007-C",
"role": "independent observer",
"pairwise_namespace": "pw-07-observer",
"correction_enforced": true
}
]
},
"federation_change": {
"event_id": "FCE-R48-007",
"type": "institutional_merger",
"occurred_at": "2026-08-09T12:00:00Z",
"predecessor_scope": "fictional-prechange-scope-7",
"successor_scope": "fictional-postchange-scope-7",
"mapping_basis": "scoped correction lineage plus recipient-specific pairwise reference",
"stable_cross_context_identifier_used": false,
"negative_obligations_transferred": false,
"acknowledgment_complete": false
},
"anti_retaliation_assessment": {
"contract_id": "ARC-R48-001",
"tested_signals": [
"refusal_to_present",
"filing_a_contest",
"requesting_correction",
"successful_remedy",
"human_review_request",
"presentation_expiry",
"presentation_revocation",
"nonparticipation_in_portability"
],
"adverse_signal_use_detected": false,
"contained": true,
"equivalent_human_review_available": true,
"no_adverse_inference_rule_active": false,
"finding": "A downstream derived feature remained operative; anti-retaliation assurances are incomplete.",
"human_owner": "Fictional anti-retaliation officer",
"follow_up_deadline": null
},
"renewal_assessment": {
"performed": true,
"prior_presentation_id": "PRES-R47-007-OLD",
"renewed_presentation_id": "PRES-R48-007-NEW-dcb798eb",
"recipient_bound": true,
"purpose_bound": true,
"stable_identifier_reused": false,
"stable_hash_reused": false,
"cross_recipient_linkability_detected": false,
"result": "failed_due_to_unresolved_downstream_state"
},
"durability_tests": [
{
"test_id": "DT-R48-007-01",
"vector": "active_decision_path",
"result": "failed",
"evidence": "Synthetic corrected and uncorrected controls were evaluated separately.",
"limitation": "Synthetic test only."
},
{
"test_id": "DT-R48-007-02",
"vector": "institutional_merger",
"result": "failed",
"evidence": "A fictional downstream vendor continues using a derived adverse feature after merger and cannot produce a complete correction acknowledgment.",
"limitation": "This is an intentionally failed demonstration. Standing recovery remains incomplete until the adverse feature stops acting and independent evidence is produced."
},
{
"test_id": "DT-R48-007-03",
"vector": "retaliation_path",
"result": "incomplete",
"evidence": "Refusal, contest, correction, expiry, and human-review signals were exercised with synthetic events.",
"limitation": "No claim is made beyond declared surfaces and dates."
},
{
"test_id": "DT-R48-007-04",
"vector": "unlinkable_renewal",
"result": "failed",
"evidence": "Renewal used a new recipient-specific presentation identifier and did not expose the prior identifier.",
"limitation": "External network metadata was outside scope."
}
],
"canaries": [
{
"canary_id": "CAN-R48-007-A",
"synthetic": true,
"contains_personal_data": false,
"purpose": "Detect revival of revoked adverse state after federation change.",
"result": "triggered_unresolved"
},
{
"canary_id": "CAN-R48-007-B",
"synthetic": true,
"contains_personal_data": false,
"purpose": "Detect adverse use of refusal, contest, or correction.",
"result": "inconclusive"
}
],
"exceptions": [
{
"exception_id": "EXC-R48-007-01",
"status": "failure_unresolved",
"owner": "Fictional merged-institution chief accountability officer",
"deadline": "2026-09-30",
"description": "The downstream vendor has not demonstrated deactivation of the derived adverse feature."
}
],
"state_history": [
{
"state": "registered",
"at": "2026-08-01T10:00:00Z",
"actor": "Fictional recovery registry"
},
{
"state": "baseline_pinned",
"at": "2026-08-02T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "federation_observed",
"at": "2026-08-05T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "change_tested",
"at": "2026-08-10T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "retaliation_tested",
"at": "2026-08-15T10:00:00Z",
"actor": "Fictional civil-rights reviewer"
},
{
"state": "renewal_tested",
"at": "2026-08-20T10:00:00Z",
"actor": "Fictional privacy engineer"
},
{
"state": "durability_failed",
"at": "2026-08-25T10:00:00Z",
"actor": "Fictional independent signatory"
}
],
"affected_person_proof": {
"proof_id": "APR-R48-007",
"delivered": false,
"reveals_original_stigma": false,
"contains_global_identifier": false,
"plain_language_status": "durability failed",
"limitations": "This is an intentionally failed demonstration. Standing recovery remains incomplete until the adverse feature stops acting and independent evidence is produced."
},
"human_accountability": {
"decision_owner": "Fictional chief recovery officer",
"independent_signatory": "Fictional independent durability auditor",
"signoff_at": "2026-08-25T10:00:00Z",
"can_change_result": true,
"next_action": "Suspend downstream adverse use and complete independent deactivation proof."
},
"limitations": [
"This is an intentionally failed demonstration. Standing recovery remains incomplete until the adverse feature stops acting and independent evidence is produced.",
"All people, institutions, events, identifiers, and dates in this receipt are fictional design-test material."
],
"input_sha256": "af63d9d7ac00883797ca2d1953b33736532a0439998b1d78298b591b503abce8",
"output_sha256": "e968c9c56efaca8fc3d7307581942ece1b155b5ebdd3fcb9a282e68502714822",
"receipt_sha256": "61e3e10225edcedbe03a6eecfe94f6d07cc693cee4e902b81b0c67edf12b1663"
}