Lineage is append-only
Real-world events are sometimes wrong. An inspector signs a QC report on the wrong lot. A meter's firmware fault produces a reading that's 10× the actual generation. A Bill of Lading is later disputed in arbitration. Pretending these don't happen is what makes most off-chain systems brittle.
PoV expects them. Every verification on the chain can be revoked by the originating attestor (or by governance, for proven fraud), with a structured reason. But revocation never deletes the original claim. Lineage on EDMA is append-only: corrections stack on top of the original, signed, dated, and on-chain.
Append-only is the property that makes auditing possible. A regulator asking "what did you know in May 2026" can get an exact answer, including what was later revoked and why. A buyer asking "what was the chain-of-custody on this batch" gets a complete trail. The protocol doesn't hide its history; it stacks corrections onto it.
The revocation process
- 01
Revocation submitted
The originating attestor (or governance, with timelock) submits a revocation transaction. The transaction must reference the original evidenceHash and provide a structured RevocationReason.v1, typed reasons like ERRONEOUS_DATA, FRAUD, EXPIRED_LICENSE, DUPLICATE_FILING. Free-text reasons are not accepted at the protocol level.
- 02
Dependent assets frozen
The chain queries the registry for all downstream assets that depend on the revoked verification. EMTs, ETTs, EDSD slices, derivative mints. Each one is auto-flagged with a frozen-pending-correction state. Tokens with that flag cannot be transferred or redeemed.
- 03
Correction or finalisation
The originating operator can submit a corrected dossier with new attestations. If the correction passes the gate, the chain stacks it on top of the original lineage, original PASS, original REVOKED, correction PASS, and the dependent assets unfreeze. If no correction comes, the dependent assets remain frozen.
Downstream consequences
EMT frozen
EDMA Milestone Tokens minted from the revoked verification are flagged. The corresponding EDSD slice (if already unlocked) is reversed and returned to Locked. The supplier is notified; the buyer is notified; the operator can open a correction case.
ETT held in escrow
ETTs minted from a revoked meter reading are held in protocol escrow. They can't be transferred, retired, or sold. If correction passes, escrow releases. If revocation stands, the ETTs are burned and the chain emits a public correction record.
Carbon NFT retired-frozen
Carbon Credit NFTs that were retired against the revoked verification get a "retirement-pending-correction" flag. The original retiring entity is notified. Their ESG claim is publicly contestable until the chain resolves the state.
