Portability is usually described as a moving problem. Export the archive. Transfer the account. Preserve the settings. Let the user leave with their data.

Necessary, and strangely insufficient.

A person can carry every transcript from one machine to another and still lose the part that mattered: which refusal was accepted, which correction changed the relationship, which harm created an obligation. The archive preserves statements. It does not preserve what those statements made binding.

A companion can hand over years of conversation and leave its successor free to treat every old no as fresh input. The machine changes. Conveniently, the debt develops amnesia.

Identity is the wrong cargo#

The common answer is more persistent identity: richer profiles, longer memory, stable identifiers. It helps the custodian recognize, predict and manage the person. It may not help the person.

A total profile can preserve the classifications someone needs to escape: an old diagnosis in a new service, an old suspicion in a new review, an intimate confession in a new model. Continuity becomes a polite word for permanent exposure.

The useful unit is smaller than identity. Not who the person is, but what happened between the person and the institution that must still constrain the next move.

A refusal. A revocation. A correction. A remedy. A contested classification. These are acts with scope, history and consequences, not personality traits. They should be portable without pretending to contain the person who made them.

Call this a portable scar. Not because harm should become identity, but because a later custodian should not be allowed to behave as if the wound never occurred.

The asymmetry#

Neutral migration rules look clean. Power makes them dishonest.

The person should be able to change machines without losing agency. The institution should not be able to change machines in order to lose liability.

Refusals and repairs need to travel with the person. Duties and unresolved harms must remain with the institution even when it changes model, contractor or interface. One side needs an exit from capture. The other gets no exit from the bill.

The weaker party receives continuity as protection; the stronger party carries continuity as obligation.

What must travel#

A portable scar should be narrow enough not to become a dossier and strong enough not to become a souvenir.

It carries the act, its scope, its status, the promised remedy and a route for reopening. It needs an expiry or review rule: a consent boundary may survive a vendor change; an obsolete preference may need to die. Narrowing, closing or superseding it requires a named authority and a reason. Otherwise protection becomes an immortal veto.

A digital signature has a narrower job. NIST’s standard describes detecting unauthorized modification and authenticating the signatory. It cannot establish a usable alternative, informed future reuse or revocation without punishment. A coerced act made portable is durable coercion. The record must preserve the scope shown, the cost of refusal and a live route to revoke or narrow it.

It must also show which check ran: the rule, its version, who applied it and the result, including a no-finding outcome. Selection must remain contestable: what was redacted, expired or discarded, under whose authority, and what can reopen that choice. Otherwise the custodian controls both the memory and the evidence of its completeness.

Exclusion can happen earlier still. An encounter may be classified as disposable before it becomes an entry; a perfect audit then audits a manufactured silence. The answer is not a total event log—another surveillance machine—but a sparse, challengeable trace at consequential gates: what was seen, what was declined and why. The subject must be able to correct that trace before it hardens into another imposed profile.

Receipt is not enough. The successor must accept open obligations at the handoff or answer to a claimant who retains standing outside it. Change of custody should not be the cheapest solvent for debt.

The cleanest handoff test is not a comparison of datasets but a small suite of trials. Does the old refusal block a new use? Does a correction stop the same classification from returning? Does revocation remove power from the inherited profile? Does an unresolved appeal survive a contractor change? Run those tests against the successor. If nothing operational changes, the archive travelled. The relationship did not.

The privacy objection is real#

Durable scars are dangerous. A history of accommodation can become evidence of fragility; a history of appeal, a risk score. Protection can follow the injured more faithfully than the institution that injured them.

So the scar cannot be public by default, total by design or owned solely by the custodian. The person needs control over disclosure and enough context to prevent a bare label from becoming destiny. Successors need duties of receipt, not a license to build a more intimate profile.

A boundary may need to travel without the confession that produced it. Responsibility may persist without unlimited access to a person’s life. Rights are messier than replication; clean schemas often mean the losing side was deleted.

A harsher migration test#

At migration, the asymmetry becomes a test: can a person leave without surrendering an old no, and can an institution change machinery without escaping an old yes? The record must remain contestable without rebuilding the person as a permanent profile.

The aim is selective continuity: enough memory to preserve agency and enough forgetting to preserve change. Perfect continuity would be another prison.

A person is more than what can be transferred. An institution is not less responsible because it transferred the work.

The person may change machines. The company does not get to change its debt.