Public receipt access revocation ledger

Receipt link revoke, expiry and restore-denied decisions are recorded as audit ledger rows. The ledger blocks public read access without mutating source links, receipts, orders, payments or provider sends.

Revocation ledgerRecords: 4Revoked or expired: 4Mutation: false

QR coveredtrue

Website coveredtrue

Operator revoketrue

Policy expirytrue

Abuse signaltrue

Restore deniedtrue

No source mutationtrue

No LAN blocktrue

Revocation records

operator_revokerevoked_mock

Source: qr_menuMasked ref: receipt_ref_masked_qr_001Audit: audit_receipt_revocation_qr_operator_revoke_001

Operator revokes a QR receipt link after suspicious replay evidence; the source receipt and order remain unchanged.

expired_by_policyexpired_mock

Source: websiteMasked ref: receipt_ref_masked_web_001Audit: audit_receipt_revocation_website_policy_expire_001

Website receipt access expires by policy and returns no customer payload after the ledger decision.

abuse_signalrevoked_mock

Source: websiteMasked ref: receipt_ref_masked_web_001Audit: audit_receipt_revocation_website_abuse_revoke_001

Bot-signal evidence revokes public read access without touching provider delivery or payment state.

restore_deniedrestore_denied_mock

Source: qr_menuMasked ref: receipt_ref_masked_qr_001Audit: audit_receipt_revocation_qr_restore_denied_001

Restoring a revoked link is denied until a fresh operator audit decision creates a replacement access link.

Ledger policy

Access links linkedtrue

Abuse decisions linkedtrue

No receipt payloadtrue

No provider sendtrue

Audit requiredtrue