When Trust Registries Rewrite Their Past: reproducibility deposit (EU trusted-list authorization histories)

Version 3 (scrubbed). Versions 1 and 2 shipped the archived trusted lists as captured; the X.509 certificates inside them identify natural persons (66 named individuals, national identification numbers, personal e-mail addresses) and both were placed under restricted access on 5 September 2026. In version 3 the content of every X509Certificate and X509SubjectName element is replaced by a deterministic SHA-256 token, so the service keys the analysis uses remain stable; a CERT-METADATA.tsv table carries validity dates and subject class per certificate without identity. Re-run with the identical command, every point quantity the headline model reports (973 of 973) is identical to the unscrubbed run, and the model's own reproduction gate passes with no mismatch. SCRUB-REPORT.json records a decoder-based leak check over every container, recognised by magic bytes rather than file extension: 0 decodable certificates, 0 identifiers, 0 e-mail addresses remain. See README.md for the exact boundary of the scrub.Reproducibility deposit for the article "When Trust Registries Rewrite Their Past: Authorization Half-Lives in EU Trusted Lists". Contains the complete harvesting and survival-analysis pipeline, all machine-readable results files, the archived snapshot corpus for seven EU member states (including truncated captures, retained because a truncation is itself data), and the frozen pre-eIDAS Dutch file held as evidence. 58 files with a SHA-256 manifest; every frozen number in the article is recomputable from these bytes with the released code. Version 2 (added 18 August 2026). This version adds README.md — the deposit shipped without one — and a verification/ directory holding an independent re-derivation of the published quantities on a disjoint software stack (R 4.5.3, survival 3.8.9 counting-process delayed-entry Kaplan–Meier, xml2), rebuilt from the deposit's archived registry XML snapshots with no deposited code executed: the R implementation and its drivers, a report in Markdown and JSON, a 14-row × 55-column author-vs-verification comparison matrix, and two vector figures. All 14 country × span-end-rule median verdicts reproduce; in the comparison matrix the only disagreements are two Monte-Carlo bootstrap interval endpoints (a Spanish lower bound and an Italian delta lower bound), each appearing under both span-end rules. This is a same-lab reproduction on a disjoint stack, not a third-party replication, and must not be cited as independent in the ReScience sense. Version 1 (DOI 10.5281/zenodo.21886352) is the version cited by the article and remains the version of record for its numbers: no version-1 data, code or result file was changed, added or removed.