Record-Edit Robustness under Shared Corruption Budgets

Damaged audit records can make a report ambiguous, reverse it, or leave it without a compatible explanation. When missing and incorrect fields share a damage budget, resolving ambiguity requires excluding a label while retaining a feasible world. We characterize this coupled optimization for fixed finite worlds and binary labels. Our key insight is to choose one world compatible with the final record. Any edit reaching a singleton report can be replaced by writes that agree with this survivor and by deletions, without increasing cost or introducing any edited field outside the original edit set. This survivor-aligned normal form preserves both the minimum cost of reaching a singleton target and whether a protected field set blocks that target within the edit budget. We establish its charging boundary and show when a cumulative damage guarantee permits pure deletion. On the same distance-two tables, ordinary anchoring is fixed-parameter tractable in anchor size, whereas shared-budget resolution is W[1]-hard in budget. A supplied narrow joint program provides a tractable route to exact computation. Independently checked computations examine the structure and its costs. A measured recovery case exhausts all six equal-cost field protections: delaying the first nonempty report change and blocking an opposite definite report have no common optimum. Thus the reporting contract determines both edit structure and protection requirements.