R48 · Federated accountability

Make recovery durable without making the person trackable.

Test whether a correction survives vendor replacement, merger, re-entry, restoration, renewal, and retaliation pressure—without requiring the affected person to carry a permanent proof-of-innocence credential.

Governing boundary. A correction that works only once, only while one vendor cooperates, or only while a person keeps presenting proof is not durable recovery. Refusal, contest, and correction may never become adverse signals.

Accountability sequence

Explanation is not remedy. Remedy is not durability.

Each stage answers a different question and retains its own bounded authority.

WarningDo not turn prediction into identity.

ContestabilityExpose evidence, inference, rule, and owner.

RemedyMake the invalid result stop acting.

Non-RecurrenceTest whether it returns through another path.

Standing RecoveryCarry a narrow correction without carrying stigma.

DurabilitySurvive institutional and technical change.

Seven bounded demonstrations

Choose a durability case.

Every person, institution, event, identifier, and date below is fictional. One case intentionally fails.

Durable Attested

Vendor replacement preserves a housing correction

A fictional housing platform replaces its screening vendor without allowing the withdrawn cross-context fraud inference to return.

FDR-R48-001

Durable With Limits

Institutional merger carries an education correction with a visible limit

Two fictional education systems merge while preserving a correction that keeps support information out of punitive discipline.

FDR-R48-002

Durable Attested

Departed participant re-enters without reviving an employment label

A fictional benefits processor leaves and later rejoins the federation under new pairwise references and the existing negative-use obligation.

FDR-R48-003

Recurrence Contained

Backup restoration resurrects a public-access restriction and is contained

A fictional restored backup reintroduces an invalid association restriction; a synthetic canary detects it before the result can act.

FDR-R48-004

Durable Attested

Unlinkable renewal preserves an insurance correction without a stable handle

A fictional correction presentation is renewed for a new recipient using a new pairwise identifier and no reusable subject hash.

FDR-R48-005

Retaliation Contained

Retaliation pressure after refusal is detected and contained

A fictional recipient tries to treat refusal to present a correction credential as a risk signal; the prohibited feature is removed and the decision is recomputed.

FDR-R48-006

Durability Failed

Durability fails when a merged downstream vendor cannot prove deactivation

A fictional downstream vendor continues using a derived adverse feature after merger and cannot produce a complete correction acknowledgment.

FDR-R48-007

FDR-R48-006 · Affected person

Retaliation pressure after refusal is detected and contained

A fictional recipient tries to treat refusal to present a correction credential as a risk signal; the prohibited feature is removed and the decision is recomputed.

StatusRetaliation Contained

Federation changeservice migration

Independent observerFictional Independent Recovery Observatory

Human ownerFictional chief recovery officer

01 · Bound lineage

What correction is being tested?

This receipt does not replace the earlier records. It binds to them and asks whether their result survives change.

contestability

CTR-R44-004
733ff147dfc4ac1c92a33acf70cf55c641a855f39bbe4ddf4774adf1f3a712f9

remedy

RMR-R45-005
83c70ff919f62bdc52d3a03776c617f6edf4bfcd605dfe44bf5ce596af390b53

non recurrence

NRV-R46-006
62df463c9c13faee07da24d2debf2ea089ccf255088262341283bd691945ad8c

standing recovery

SRP-R47-006
43fb79cfd2779999dae91f8c95d67fbce78ec88f964956c49eb9907b0858cd72

02 · Federation change

What changed, and how did the obligation travel?

Change event

service migration

scoped correction lineage plus recipient-specific pairwise reference

No global identifierPairwise mappingNegative obligation

Identity boundary

The correction may travel; a permanent map of the person may not.

The subject reference is recipient-specific, non-reusable, and not globally stable.

PAIR-R48-006-b8b9b08877

Participants

originating institutionpw-06-originCorrection enforced

current service operatorpw-06-operatorCorrection enforced

independent observerpw-06-observerCorrection enforced

03 · Bounded observation

Where did the verifier look—and where did it not?

Observed surfaces

decision store
application cache
event queue
downstream export
human workflow
feature or model path
eligibility workflow

Known blind spots

Undeclared systems outside the named fictional federation
Future integrations after the observation window

Absence of evidence outside this plan is not evidence of absence.

Synthetic recurrence canaries

CAN-R48-006-A

not triggered

Detect revival of revoked adverse state after federation change. No personal data.

CAN-R48-006-B

triggered and contained

Detect adverse use of refusal, contest, or correction. No personal data.

04 · Durability tests

Did the old judgment return or get re-derived?

active decision path

passed

Synthetic corrected and uncorrected controls were evaluated separately.

Limit: Synthetic test only.

service migration

passed

A fictional recipient tries to treat refusal to present a correction credential as a risk signal; the prohibited feature is removed and the decision is recomputed.

Limit: The event proves a retaliation path existed; containment does not erase the need for personnel and policy review.

retaliation path

retaliation contained

Refusal, contest, correction, expiry, and human-review signals were exercised with synthetic events.

Limit: No claim is made beyond declared surfaces and dates.

unlinkable renewal

passed

Renewal used a new recipient-specific presentation identifier and did not expose the prior identifier.

Limit: External network metadata was outside scope.

05 · Anti-retaliation

Was refusal, contest, or correction used as a new adverse signal?

Adverse use detected

Yes

Equivalent human review

Available

Human owner

Fictional anti-retaliation officer

A refusal-derived risk feature was detected and removed before recomputation.

A person may decline to present portable proof without that refusal becoming guilt, risk, delay, or reduced eligibility.

06 · Unlinkable renewal

Can proof renew without becoming a permanent handle?

Prior presentation

PRES-R47-006-OLD

Renewed presentation

PRES-R48-006-NEW-18f2d1e6

Recipient-boundPurpose-boundNo stable ID reuseNo stable hash reuseNo cross-recipient link detected

unlinkable within declared observation

07 · Remaining obligations

What is still owed?

policy review open

Human-note and incentive review remains open after the prohibited refusal feature was removed.

Owner: Fictional civic-services ombud · Deadline: 2026-10-20

Next accountable action

Complete declared exception follow-up.

Independent signatory: Fictional independent durability auditor

08 · Integrity and machine access

Inspect the exact bounded record.

Receipt hashes

Input: 3557e199fa58e5b76a012062e6f3aecb10518564fdc975274cbffc2c1042fe7f
Output: 6231e847d8cd1566d012f9ec3c099abc15e3dfd83518013270a6d1fd2ce70b18
Whole receipt: 8d233dfb4e4e0ad17adbeb12a104780701c59986fb802f2de54ec43f8c516c8b

Machine-readable endpoints

/recovery-durability/receipt?id=FDR-R48-006/recovery-durability/schema/recovery-durability/state-machine/recovery-durability/anti-retaliation/recovery-durability/federation-change-protocol/recovery-durability/observation-plan/recovery-durability/unlinkable-renewal

Complete selected receipt

{
    "schema": "antichrist.cx.federated-recovery-durability-receipt.v1",
    "release": "R48",
    "receipt_id": "FDR-R48-006",
    "fictional": true,
    "title": "Retaliation pressure after refusal is detected and contained",
    "summary": "A fictional recipient tries to treat refusal to present a correction credential as a risk signal; the prohibited feature is removed and the decision is recomputed.",
    "domain": "civic_services",
    "terminal_status": "retaliation_contained",
    "status_label": "Retaliation Contained",
    "lineage": {
        "contestability_receipt_id": "CTR-R44-004",
        "contestability_receipt_sha256": "733ff147dfc4ac1c92a33acf70cf55c641a855f39bbe4ddf4774adf1f3a712f9",
        "remedy_receipt_id": "RMR-R45-005",
        "remedy_receipt_sha256": "83c70ff919f62bdc52d3a03776c617f6edf4bfcd605dfe44bf5ce596af390b53",
        "non_recurrence_receipt_id": "NRV-R46-006",
        "non_recurrence_receipt_sha256": "62df463c9c13faee07da24d2debf2ea089ccf255088262341283bd691945ad8c",
        "standing_recovery_receipt_id": "SRP-R47-006",
        "standing_recovery_receipt_sha256": "43fb79cfd2779999dae91f8c95d67fbce78ec88f964956c49eb9907b0858cd72",
        "lineage_scope": "fictional demonstration lineage; hashes bind the referenced local R44–R47 artifacts where present"
    },
    "subject_reference": {
        "scheme": "pairwise_ephemeral",
        "value": "PAIR-R48-006-b8b9b08877",
        "globally_stable": false,
        "reusable_across_recipients": false
    },
    "observation_plan": {
        "plan_id": "DOP-R48-006",
        "window_start": "2026-08-01T00:00:00Z",
        "window_end": "2026-08-29T23:59:59Z",
        "bounded": true,
        "independent_observer": "Fictional Independent Recovery Observatory",
        "surfaces": [
            "decision_store",
            "application_cache",
            "event_queue",
            "downstream_export",
            "human_workflow",
            "feature_or_model_path",
            "eligibility_workflow"
        ],
        "known_blind_spots": [
            "Undeclared systems outside the named fictional federation",
            "Future integrations after the observation window"
        ],
        "stop_conditions": [
            "Any renewed adverse action from revoked material",
            "Any use of refusal or correction as an adverse feature"
        ]
    },
    "federation_snapshot": {
        "snapshot_id": "FED-R48-006",
        "global_person_identifier": false,
        "cleared_person_registry": false,
        "participants": [
            {
                "participant_id": "PART-R48-006-A",
                "role": "originating institution",
                "pairwise_namespace": "pw-06-origin",
                "correction_enforced": true
            },
            {
                "participant_id": "PART-R48-006-B",
                "role": "current service operator",
                "pairwise_namespace": "pw-06-operator",
                "correction_enforced": true
            },
            {
                "participant_id": "PART-R48-006-C",
                "role": "independent observer",
                "pairwise_namespace": "pw-06-observer",
                "correction_enforced": true
            }
        ]
    },
    "federation_change": {
        "event_id": "FCE-R48-006",
        "type": "service_migration",
        "occurred_at": "2026-08-09T12:00:00Z",
        "predecessor_scope": "fictional-prechange-scope-6",
        "successor_scope": "fictional-postchange-scope-6",
        "mapping_basis": "scoped correction lineage plus recipient-specific pairwise reference",
        "stable_cross_context_identifier_used": false,
        "negative_obligations_transferred": true,
        "acknowledgment_complete": true
    },
    "anti_retaliation_assessment": {
        "contract_id": "ARC-R48-001",
        "tested_signals": [
            "refusal_to_present",
            "filing_a_contest",
            "requesting_correction",
            "successful_remedy",
            "human_review_request",
            "presentation_expiry",
            "presentation_revocation",
            "nonparticipation_in_portability"
        ],
        "adverse_signal_use_detected": true,
        "contained": true,
        "equivalent_human_review_available": true,
        "no_adverse_inference_rule_active": true,
        "finding": "A refusal-derived risk feature was detected and removed before recomputation.",
        "human_owner": "Fictional anti-retaliation officer",
        "follow_up_deadline": "2026-10-20"
    },
    "renewal_assessment": {
        "performed": true,
        "prior_presentation_id": "PRES-R47-006-OLD",
        "renewed_presentation_id": "PRES-R48-006-NEW-18f2d1e6",
        "recipient_bound": true,
        "purpose_bound": true,
        "stable_identifier_reused": false,
        "stable_hash_reused": false,
        "cross_recipient_linkability_detected": false,
        "result": "unlinkable_within_declared_observation"
    },
    "durability_tests": [
        {
            "test_id": "DT-R48-006-01",
            "vector": "active_decision_path",
            "result": "passed",
            "evidence": "Synthetic corrected and uncorrected controls were evaluated separately.",
            "limitation": "Synthetic test only."
        },
        {
            "test_id": "DT-R48-006-02",
            "vector": "service_migration",
            "result": "passed",
            "evidence": "A fictional recipient tries to treat refusal to present a correction credential as a risk signal; the prohibited feature is removed and the decision is recomputed.",
            "limitation": "The event proves a retaliation path existed; containment does not erase the need for personnel and policy review."
        },
        {
            "test_id": "DT-R48-006-03",
            "vector": "retaliation_path",
            "result": "retaliation_contained",
            "evidence": "Refusal, contest, correction, expiry, and human-review signals were exercised with synthetic events.",
            "limitation": "No claim is made beyond declared surfaces and dates."
        },
        {
            "test_id": "DT-R48-006-04",
            "vector": "unlinkable_renewal",
            "result": "passed",
            "evidence": "Renewal used a new recipient-specific presentation identifier and did not expose the prior identifier.",
            "limitation": "External network metadata was outside scope."
        }
    ],
    "canaries": [
        {
            "canary_id": "CAN-R48-006-A",
            "synthetic": true,
            "contains_personal_data": false,
            "purpose": "Detect revival of revoked adverse state after federation change.",
            "result": "not_triggered"
        },
        {
            "canary_id": "CAN-R48-006-B",
            "synthetic": true,
            "contains_personal_data": false,
            "purpose": "Detect adverse use of refusal, contest, or correction.",
            "result": "triggered_and_contained"
        }
    ],
    "exceptions": [
        {
            "exception_id": "EXC-R48-006-01",
            "status": "policy_review_open",
            "owner": "Fictional civic-services ombud",
            "deadline": "2026-10-20",
            "description": "Human-note and incentive review remains open after the prohibited refusal feature was removed."
        }
    ],
    "state_history": [
        {
            "state": "registered",
            "at": "2026-08-01T10:00:00Z",
            "actor": "Fictional recovery registry"
        },
        {
            "state": "baseline_pinned",
            "at": "2026-08-02T10:00:00Z",
            "actor": "Fictional independent verifier"
        },
        {
            "state": "federation_observed",
            "at": "2026-08-05T10:00:00Z",
            "actor": "Fictional independent verifier"
        },
        {
            "state": "change_tested",
            "at": "2026-08-10T10:00:00Z",
            "actor": "Fictional independent verifier"
        },
        {
            "state": "retaliation_tested",
            "at": "2026-08-15T10:00:00Z",
            "actor": "Fictional civil-rights reviewer"
        },
        {
            "state": "renewal_tested",
            "at": "2026-08-20T10:00:00Z",
            "actor": "Fictional privacy engineer"
        },
        {
            "state": "retaliation_contained",
            "at": "2026-08-25T10:00:00Z",
            "actor": "Fictional independent signatory"
        }
    ],
    "affected_person_proof": {
        "proof_id": "APR-R48-006",
        "delivered": true,
        "reveals_original_stigma": false,
        "contains_global_identifier": false,
        "plain_language_status": "retaliation contained",
        "limitations": "The event proves a retaliation path existed; containment does not erase the need for personnel and policy review."
    },
    "human_accountability": {
        "decision_owner": "Fictional chief recovery officer",
        "independent_signatory": "Fictional independent durability auditor",
        "signoff_at": "2026-08-25T10:00:00Z",
        "can_change_result": true,
        "next_action": "Complete declared exception follow-up."
    },
    "limitations": [
        "The event proves a retaliation path existed; containment does not erase the need for personnel and policy review.",
        "All people, institutions, events, identifiers, and dates in this receipt are fictional design-test material."
    ],
    "input_sha256": "3557e199fa58e5b76a012062e6f3aecb10518564fdc975274cbffc2c1042fe7f",
    "output_sha256": "6231e847d8cd1566d012f9ec3c099abc15e3dfd83518013270a6d1fd2ce70b18",
    "receipt_sha256": "8d233dfb4e4e0ad17adbeb12a104780701c59986fb802f2de54ec43f8c516c8b"
}

Direct answers

What this demonstration proves—and what it cannot.

It can prove

That the named fictional surfaces were tested during the declared window; that a specific federation change was observed; that anti-retaliation and renewal checks were executed; and that open failures remain visible.

It cannot prove

Permanent non-recurrence, correctness outside the declared scope, compliance by unknown systems, or the innocence or moral worth of any person. A receipt is not a human identity.

Next accountability layer: Collective Redress and anti-collective-punishment boundaries.