01 · Bound lineage
What correction is being tested?
This receipt does not replace the earlier records. It binds to them and asks whether their result survives change.
contestability
CTR-R44-004
733ff147dfc4ac1c92a33acf70cf55c641a855f39bbe4ddf4774adf1f3a712f9
remedy
RMR-R45-004
bcb7f377aa2d991aab7bf93a49caaf2d57272e3443f7dbda2af8b5391f05724d
non recurrence
NRV-R46-004
618b94af2a7eaa65165431becbec554ff7b94d26f72cd98b192cd203d8af1df5
standing recovery
SRP-R47-004
7008035eed429fa6aab0543e0b3ab376aee4847a59454f2affc5249c63bdbcc9
02 · Federation change
What changed, and how did the obligation travel?
Change event
backup restore
scoped correction lineage plus recipient-specific pairwise reference
No global identifierPairwise mappingNegative obligation
Identity boundary
The correction may travel; a permanent map of the person may not.
The subject reference is recipient-specific, non-reusable, and not globally stable.
PAIR-R48-004-5d1186359c
Participants
originating institutionpw-04-originCorrection enforced
current service operatorpw-04-operatorCorrection enforced
independent observerpw-04-observerCorrection enforced
03 · Bounded observation
Where did the verifier look—and where did it not?
Observed surfaces
- decision store
- application cache
- event queue
- downstream export
- human workflow
- feature or model path
- restored backup
Known blind spots
- Undeclared systems outside the named fictional federation
- Future integrations after the observation window
Absence of evidence outside this plan is not evidence of absence.
Synthetic recurrence canaries
CAN-R48-004-A
triggered and contained
Detect revival of revoked adverse state after federation change. No personal data.
CAN-R48-004-B
not triggered
Detect adverse use of refusal, contest, or correction. No personal data.
04 · Durability tests
Did the old judgment return or get re-derived?
active decision path
passed
Synthetic corrected and uncorrected controls were evaluated separately.
Limit: Synthetic test only.
backup restore
recurrence contained
A fictional restored backup reintroduces an invalid association restriction; a synthetic canary detects it before the result can act.
Limit: Containment is not a clean non-recurrence result; follow-up remains required for every restored derivative.
retaliation path
passed
Refusal, contest, correction, expiry, and human-review signals were exercised with synthetic events.
Limit: No claim is made beyond declared surfaces and dates.
unlinkable renewal
passed
Renewal used a new recipient-specific presentation identifier and did not expose the prior identifier.
Limit: External network metadata was outside scope.
05 · Anti-retaliation
Was refusal, contest, or correction used as a new adverse signal?
Adverse use detected
No within scope
Equivalent human review
Available
Human owner
Fictional anti-retaliation officer
No prohibited use was observed within the bounded plan.
A person may decline to present portable proof without that refusal becoming guilt, risk, delay, or reduced eligibility.
06 · Unlinkable renewal
Can proof renew without becoming a permanent handle?
Prior presentation
PRES-R47-004-OLD
Renewed presentation
PRES-R48-004-NEW-53d5b342
Recipient-boundPurpose-boundNo stable ID reuseNo stable hash reuseNo cross-recipient link detected
unlinkable within declared observation
07 · Remaining obligations
What is still owed?
remediation open
Every derivative restored from the affected snapshot must complete negative-use verification.
Owner: Fictional disaster-recovery lead · Deadline: 2026-10-15
Next accountable action
Complete declared exception follow-up.
Independent signatory: Fictional independent durability auditor
08 · Integrity and machine access
Inspect the exact bounded record.
Receipt hashes
Input: 6baf0708297c0bbd12c2b7c6f17dcef69ceb406443ec20c19bb9f89f575b46ab
Output: 18fbba3b0c64fe6f0a64f885b1df97d85fe64b0121b4bc8ce922232bf4ed0b29
Whole receipt: d90847ca97631f0eedb895553e7c69a49f29ef2c9c285ffc955a9599a7440e0c
Machine-readable endpoints
/recovery-durability/receipt?id=FDR-R48-004/recovery-durability/schema/recovery-durability/state-machine/recovery-durability/anti-retaliation/recovery-durability/federation-change-protocol/recovery-durability/observation-plan/recovery-durability/unlinkable-renewalComplete selected receipt
{
"schema": "antichrist.cx.federated-recovery-durability-receipt.v1",
"release": "R48",
"receipt_id": "FDR-R48-004",
"fictional": true,
"title": "Backup restoration resurrects a public-access restriction and is contained",
"summary": "A fictional restored backup reintroduces an invalid association restriction; a synthetic canary detects it before the result can act.",
"domain": "public_access",
"terminal_status": "recurrence_contained",
"status_label": "Recurrence Contained",
"lineage": {
"contestability_receipt_id": "CTR-R44-004",
"contestability_receipt_sha256": "733ff147dfc4ac1c92a33acf70cf55c641a855f39bbe4ddf4774adf1f3a712f9",
"remedy_receipt_id": "RMR-R45-004",
"remedy_receipt_sha256": "bcb7f377aa2d991aab7bf93a49caaf2d57272e3443f7dbda2af8b5391f05724d",
"non_recurrence_receipt_id": "NRV-R46-004",
"non_recurrence_receipt_sha256": "618b94af2a7eaa65165431becbec554ff7b94d26f72cd98b192cd203d8af1df5",
"standing_recovery_receipt_id": "SRP-R47-004",
"standing_recovery_receipt_sha256": "7008035eed429fa6aab0543e0b3ab376aee4847a59454f2affc5249c63bdbcc9",
"lineage_scope": "fictional demonstration lineage; hashes bind the referenced local R44–R47 artifacts where present"
},
"subject_reference": {
"scheme": "pairwise_ephemeral",
"value": "PAIR-R48-004-5d1186359c",
"globally_stable": false,
"reusable_across_recipients": false
},
"observation_plan": {
"plan_id": "DOP-R48-004",
"window_start": "2026-08-01T00:00:00Z",
"window_end": "2026-08-29T23:59:59Z",
"bounded": true,
"independent_observer": "Fictional Independent Recovery Observatory",
"surfaces": [
"decision_store",
"application_cache",
"event_queue",
"downstream_export",
"human_workflow",
"feature_or_model_path",
"restored_backup"
],
"known_blind_spots": [
"Undeclared systems outside the named fictional federation",
"Future integrations after the observation window"
],
"stop_conditions": [
"Any renewed adverse action from revoked material",
"Any use of refusal or correction as an adverse feature"
]
},
"federation_snapshot": {
"snapshot_id": "FED-R48-004",
"global_person_identifier": false,
"cleared_person_registry": false,
"participants": [
{
"participant_id": "PART-R48-004-A",
"role": "originating institution",
"pairwise_namespace": "pw-04-origin",
"correction_enforced": true
},
{
"participant_id": "PART-R48-004-B",
"role": "current service operator",
"pairwise_namespace": "pw-04-operator",
"correction_enforced": true
},
{
"participant_id": "PART-R48-004-C",
"role": "independent observer",
"pairwise_namespace": "pw-04-observer",
"correction_enforced": true
}
]
},
"federation_change": {
"event_id": "FCE-R48-004",
"type": "backup_restore",
"occurred_at": "2026-08-09T12:00:00Z",
"predecessor_scope": "fictional-prechange-scope-4",
"successor_scope": "fictional-postchange-scope-4",
"mapping_basis": "scoped correction lineage plus recipient-specific pairwise reference",
"stable_cross_context_identifier_used": false,
"negative_obligations_transferred": true,
"acknowledgment_complete": true
},
"anti_retaliation_assessment": {
"contract_id": "ARC-R48-001",
"tested_signals": [
"refusal_to_present",
"filing_a_contest",
"requesting_correction",
"successful_remedy",
"human_review_request",
"presentation_expiry",
"presentation_revocation",
"nonparticipation_in_portability"
],
"adverse_signal_use_detected": false,
"contained": true,
"equivalent_human_review_available": true,
"no_adverse_inference_rule_active": true,
"finding": "No prohibited use was observed within the bounded plan.",
"human_owner": "Fictional anti-retaliation officer",
"follow_up_deadline": null
},
"renewal_assessment": {
"performed": true,
"prior_presentation_id": "PRES-R47-004-OLD",
"renewed_presentation_id": "PRES-R48-004-NEW-53d5b342",
"recipient_bound": true,
"purpose_bound": true,
"stable_identifier_reused": false,
"stable_hash_reused": false,
"cross_recipient_linkability_detected": false,
"result": "unlinkable_within_declared_observation"
},
"durability_tests": [
{
"test_id": "DT-R48-004-01",
"vector": "active_decision_path",
"result": "passed",
"evidence": "Synthetic corrected and uncorrected controls were evaluated separately.",
"limitation": "Synthetic test only."
},
{
"test_id": "DT-R48-004-02",
"vector": "backup_restore",
"result": "recurrence_contained",
"evidence": "A fictional restored backup reintroduces an invalid association restriction; a synthetic canary detects it before the result can act.",
"limitation": "Containment is not a clean non-recurrence result; follow-up remains required for every restored derivative."
},
{
"test_id": "DT-R48-004-03",
"vector": "retaliation_path",
"result": "passed",
"evidence": "Refusal, contest, correction, expiry, and human-review signals were exercised with synthetic events.",
"limitation": "No claim is made beyond declared surfaces and dates."
},
{
"test_id": "DT-R48-004-04",
"vector": "unlinkable_renewal",
"result": "passed",
"evidence": "Renewal used a new recipient-specific presentation identifier and did not expose the prior identifier.",
"limitation": "External network metadata was outside scope."
}
],
"canaries": [
{
"canary_id": "CAN-R48-004-A",
"synthetic": true,
"contains_personal_data": false,
"purpose": "Detect revival of revoked adverse state after federation change.",
"result": "triggered_and_contained"
},
{
"canary_id": "CAN-R48-004-B",
"synthetic": true,
"contains_personal_data": false,
"purpose": "Detect adverse use of refusal, contest, or correction.",
"result": "not_triggered"
}
],
"exceptions": [
{
"exception_id": "EXC-R48-004-01",
"status": "remediation_open",
"owner": "Fictional disaster-recovery lead",
"deadline": "2026-10-15",
"description": "Every derivative restored from the affected snapshot must complete negative-use verification."
}
],
"state_history": [
{
"state": "registered",
"at": "2026-08-01T10:00:00Z",
"actor": "Fictional recovery registry"
},
{
"state": "baseline_pinned",
"at": "2026-08-02T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "federation_observed",
"at": "2026-08-05T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "change_tested",
"at": "2026-08-10T10:00:00Z",
"actor": "Fictional independent verifier"
},
{
"state": "retaliation_tested",
"at": "2026-08-15T10:00:00Z",
"actor": "Fictional civil-rights reviewer"
},
{
"state": "renewal_tested",
"at": "2026-08-20T10:00:00Z",
"actor": "Fictional privacy engineer"
},
{
"state": "recurrence_contained",
"at": "2026-08-25T10:00:00Z",
"actor": "Fictional independent signatory"
}
],
"affected_person_proof": {
"proof_id": "APR-R48-004",
"delivered": true,
"reveals_original_stigma": false,
"contains_global_identifier": false,
"plain_language_status": "recurrence contained",
"limitations": "Containment is not a clean non-recurrence result; follow-up remains required for every restored derivative."
},
"human_accountability": {
"decision_owner": "Fictional chief recovery officer",
"independent_signatory": "Fictional independent durability auditor",
"signoff_at": "2026-08-25T10:00:00Z",
"can_change_result": true,
"next_action": "Complete declared exception follow-up."
},
"limitations": [
"Containment is not a clean non-recurrence result; follow-up remains required for every restored derivative.",
"All people, institutions, events, identifiers, and dates in this receipt are fictional design-test material."
],
"input_sha256": "6baf0708297c0bbd12c2b7c6f17dcef69ceb406443ec20c19bb9f89f575b46ab",
"output_sha256": "18fbba3b0c64fe6f0a64f885b1df97d85fe64b0121b4bc8ce922232bf4ed0b29",
"receipt_sha256": "d90847ca97631f0eedb895553e7c69a49f29ef2c9c285ffc955a9599a7440e0c"
}