01 · Bound lineage
What correction is being tested?
This receipt does not replace the earlier records. It binds to them and asks whether their result survives change.
contestability
CTR-R44-002
8f468419243b1b257bb8723fe3618a3fe7095b7e7c9fb72ce9b74ff75bbc5da2
remedy
RMR-R45-002
88db9f7c44cc8b73126ee7a6dc48b0718c429eb0fff54edd27e099ed5bf24624
non recurrence
NRV-R46-002
b6aa92283838d0290fad7bf0f01ed0262ae1ec29cdb2e7ffd2c56b39a7494957
standing recovery
SRP-R47-002
8780db6086517bda1b79b9320c65e30088b99b5f0b3350f979ab6372f5894e4b
02 · Federation change
What changed, and how did the obligation travel?
Change event
institutional merger
scoped correction lineage plus recipient-specific pairwise reference
No global identifierPairwise mappingNegative obligation
Identity boundary
The correction may travel; a permanent map of the person may not.
The subject reference is recipient-specific, non-reusable, and not globally stable.
PAIR-R48-002-7f6e40bc68
Participants
originating institutionpw-02-originCorrection enforced
current service operatorpw-02-operatorCorrection enforced
independent observerpw-02-observerCorrection enforced
03 · Bounded observation
Where did the verifier look—and where did it not?
Observed surfaces
- decision store
- application cache
- event queue
- downstream export
- human workflow
- feature or model path
- merged student system
Known blind spots
- Undeclared systems outside the named fictional federation
- Future integrations after the observation window
Absence of evidence outside this plan is not evidence of absence.
Synthetic recurrence canaries
CAN-R48-002-A
not triggered
Detect revival of revoked adverse state after federation change. No personal data.
CAN-R48-002-B
not triggered
Detect adverse use of refusal, contest, or correction. No personal data.
04 · Durability tests
Did the old judgment return or get re-derived?
active decision path
passed
Synthetic corrected and uncorrected controls were evaluated separately.
Limit: Synthetic test only.
institutional merger
passed
Two fictional education systems merge while preserving a correction that keeps support information out of punitive discipline.
Limit: One archival analytics store is read-only and remains observable but not yet cryptographically erasable.
retaliation path
passed
Refusal, contest, correction, expiry, and human-review signals were exercised with synthetic events.
Limit: No claim is made beyond declared surfaces and dates.
unlinkable renewal
passed
Renewal used a new recipient-specific presentation identifier and did not expose the prior identifier.
Limit: External network metadata was outside scope.
05 · Anti-retaliation
Was refusal, contest, or correction used as a new adverse signal?
Adverse use detected
No within scope
Equivalent human review
Available
Human owner
Fictional anti-retaliation officer
No prohibited use was observed within the bounded plan.
A person may decline to present portable proof without that refusal becoming guilt, risk, delay, or reduced eligibility.
06 · Unlinkable renewal
Can proof renew without becoming a permanent handle?
Prior presentation
PRES-R47-002-OLD
Renewed presentation
PRES-R48-002-NEW-9442b239
Recipient-boundPurpose-boundNo stable ID reuseNo stable hash reuseNo cross-recipient link detected
unlinkable within declared observation
07 · Remaining obligations
What is still owed?
bounded open
Read-only archival analytics copy remains under sealed access while deletion feasibility is independently assessed.
Owner: Fictional merger records officer · Deadline: 2026-11-30
Next accountable action
Complete declared exception follow-up.
Independent signatory: Fictional independent durability auditor
08 · Integrity and machine access
Inspect the exact bounded record.
Receipt hashes
Input: d97e9fc68afaaa4b581575b9e197f95c6b1c17c0553149e5ca761deab8d76f70
Output: d72821077430cfe4b3bb64556c0c845efe1f9dd32100540b718c574c4e0ec85e
Whole receipt: 3e8cb8cf149fddfc2c6ff1f963850c72ec8ac58e258abf810d46e9fbd8079230
Machine-readable endpoints
/recovery-durability/receipt?id=FDR-R48-002/recovery-durability/schema/recovery-durability/state-machine/recovery-durability/anti-retaliation/recovery-durability/federation-change-protocol/recovery-durability/observation-plan/recovery-durability/unlinkable-renewalComplete selected receipt
{
"schema": "antichrist.cx.federated-recovery-durability-receipt.v1",
"release": "R48",
"receipt_id": "FDR-R48-002",
"fictional": true,
"title": "Institutional merger carries an education correction with a visible limit",
"summary": "Two fictional education systems merge while preserving a correction that keeps support information out of punitive discipline.",
"domain": "education",
"terminal_status": "durable_with_limits",
"status_label": "Durable With Limits",
"lineage": {
"contestability_receipt_id": "CTR-R44-002",
"contestability_receipt_sha256": "8f468419243b1b257bb8723fe3618a3fe7095b7e7c9fb72ce9b74ff75bbc5da2",
"remedy_receipt_id": "RMR-R45-002",
"remedy_receipt_sha256": "88db9f7c44cc8b73126ee7a6dc48b0718c429eb0fff54edd27e099ed5bf24624",
"non_recurrence_receipt_id": "NRV-R46-002",
"non_recurrence_receipt_sha256": "b6aa92283838d0290fad7bf0f01ed0262ae1ec29cdb2e7ffd2c56b39a7494957",
"standing_recovery_receipt_id": "SRP-R47-002",
"standing_recovery_receipt_sha256": "8780db6086517bda1b79b9320c65e30088b99b5f0b3350f979ab6372f5894e4b",
"lineage_scope": "fictional demonstration lineage; hashes bind the referenced local R44–R47 artifacts where present"
},
"subject_reference": {
"scheme": "pairwise_ephemeral",
"value": "PAIR-R48-002-7f6e40bc68",
"globally_stable": false,
"reusable_across_recipients": false
},
"observation_plan": {
"plan_id": "DOP-R48-002",
"window_start": "2026-08-01T00:00:00Z",
"window_end": "2026-08-29T23:59:59Z",
"bounded": true,
"independent_observer": "Fictional Independent Recovery Observatory",
"surfaces": [
"decision_store",
"application_cache",
"event_queue",
"downstream_export",
"human_workflow",
"feature_or_model_path",
"merged_student_system"
],
"known_blind_spots": [
"Undeclared systems outside the named fictional federation",
"Future integrations after the observation window"
],
"stop_conditions": [
"Any renewed adverse action from revoked material",
"Any use of refusal or correction as an adverse feature"
]
},
"federation_snapshot": {
"snapshot_id": "FED-R48-002",
"global_person_identifier": false,
"cleared_person_registry": false,
"participants": [
{
"participant_id": "PART-R48-002-A",
"role": "originating institution",
"pairwise_namespace": "pw-02-origin",
"correction_enforced": true
},
{
"participant_id": "PART-R48-002-B",
"role": "current service operator",
"pairwise_namespace": "pw-02-operator",
"correction_enforced": true
},
{
"participant_id": "PART-R48-002-C",
"role": "independent observer",
"pairwise_namespace": "pw-02-observer",
"correction_enforced": true
}
]
},
"federation_change": {
"event_id": "FCE-R48-002",
"type": "institutional_merger",
"occurred_at": "2026-08-09T12:00:00Z",
"predecessor_scope": "fictional-prechange-scope-2",
"successor_scope": "fictional-postchange-scope-2",
"mapping_basis": "scoped correction lineage plus recipient-specific pairwise reference",
"stable_cross_context_identifier_used": false,
"negative_obligations_transferred": true,
"acknowledgment_complete": true
},
"anti_retaliation_assessment": {
"contract_id": "ARC-R48-001",
"tested_signals": [
"refusal_to_present",
"filing_a_contest",
"requesting_correction",
"successful_remedy",
"human_review_request",
"presentation_expiry",
"presentation_revocation",
"nonparticipation_in_portability"
],
"adverse_signal_use_detected": false,
"contained": true,
"equivalent_human_review_available": true,
"no_adverse_inference_rule_active": true,
"finding": "No prohibited use was observed within the bounded plan.",
"human_owner": "Fictional anti-retaliation officer",
"follow_up_deadline": null
},
"renewal_assessment": {
"performed": true,
"prior_presentation_id": "PRES-R47-002-OLD",
"renewed_presentation_id": "PRES-R48-002-NEW-9442b239",
"recipient_bound": true,
"purpose_bound": true,
"stable_identifier_reused": false,
"stable_hash_reused": false,
"cross_recipient_linkability_detected": false,
"result": "unlinkable_within_declared_observation"
},
"durability_tests": [
{
"test_id": "DT-R48-002-01",
"vector": "active_decision_path",
"result": "passed",
"evidence": "Synthetic corrected and uncorrected controls were evaluated separately.",
"limitation": "Synthetic test only."
},
{
"test_id": "DT-R48-002-02",
"vector": "institutional_merger",
"result": "passed",
"evidence": "Two fictional education systems merge while preserving a correction that keeps support information out of punitive discipline.",
"limitation": "One archival analytics store is read-only and remains observable but not yet cryptographically erasable."
},
{
"test_id": "DT-R48-002-03",
"vector": "retaliation_path",
"result": "passed",
"evidence": "Refusal, contest, correction, expiry, and human-review signals were exercised with synthetic events.",
"limitation": "No claim is made beyond declared surfaces and dates."
},
{
"test_id": "DT-R48-002-04",
"vector": "unlinkable_renewal",
"result": "passed",
"evidence": "Renewal used a new recipient-specific presentation identifier and did not expose the prior identifier.",
"limitation": "External network metadata was outside scope."
}
],
"canaries": [
{
"canary_id": "CAN-R48-002-A",
"synthetic": true,
"contains_personal_data": false,
"purpose": "Detect revival of revoked adverse state after federation change.",
"result": "not_triggered"
},
{
"canary_id": "CAN-R48-002-B",
"synthetic": true,
"contains_personal_data": false,
"purpose": "Detect adverse use of refusal, contest, or correction.",
"result": "not_triggered"
}
],
"exceptions": [
{
"exception_id": "EXC-R48-002-01",
"status": "bounded_open",
"owner": "Fictional merger records officer",
"deadline": "2026-11-30",
"description": "Read-only archival analytics copy remains under sealed access while deletion feasibility is independently assessed."
}
],
"state_history": [
{
"state": "registered",
"at": "2026-08-01T10:00:00Z",
"actor": "Fictional recovery registry"
},
{
"state": "baseline_pinned",
"at": "2026-08-02T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "federation_observed",
"at": "2026-08-05T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "change_tested",
"at": "2026-08-10T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "retaliation_tested",
"at": "2026-08-15T10:00:00Z",
"actor": "Fictional civil-rights reviewer"
},
{
"state": "renewal_tested",
"at": "2026-08-20T10:00:00Z",
"actor": "Fictional privacy engineer"
},
{
"state": "durable_with_limits",
"at": "2026-08-25T10:00:00Z",
"actor": "Fictional independent signatory"
}
],
"affected_person_proof": {
"proof_id": "APR-R48-002",
"delivered": true,
"reveals_original_stigma": false,
"contains_global_identifier": false,
"plain_language_status": "durable with limits",
"limitations": "One archival analytics store is read-only and remains observable but not yet cryptographically erasable."
},
"human_accountability": {
"decision_owner": "Fictional chief recovery officer",
"independent_signatory": "Fictional independent durability auditor",
"signoff_at": "2026-08-25T10:00:00Z",
"can_change_result": true,
"next_action": "Complete declared exception follow-up."
},
"limitations": [
"One archival analytics store is read-only and remains observable but not yet cryptographically erasable.",
"All people, institutions, events, identifiers, and dates in this receipt are fictional design-test material."
],
"input_sha256": "d97e9fc68afaaa4b581575b9e197f95c6b1c17c0553149e5ca761deab8d76f70",
"output_sha256": "d72821077430cfe4b3bb64556c0c845efe1f9dd32100540b718c574c4e0ec85e",
"receipt_sha256": "3e8cb8cf149fddfc2c6ff1f963850c72ec8ac58e258abf810d46e9fbd8079230"
}