# One run went bad. You withdrew all of them.

> The size of a withdrawal is set by what your record can tell apart — not by what actually went wrong. — Food CPG and QSR — whoever owns the recall desk.

**Verified 5 August 2026.** Three doors of the spine answer over HTTPS today — POST https://epcis.dev/translate, /validate and /hash — against sha256-pinned official GS1 artefacts, and 931/931 spine tests pass. Every open gap is a named entry in the open P0 ledger at /p0-ledger/.

## What it costs you

Your record knows the lot, or the production day, or the shipment that left the dock. It does not know the case. So the boundary of the withdrawal gets drawn where the record stops resolving, and everything inside that boundary comes back — including all of it that was fine. The difference between the two boundaries is the whole bill: the product, the freight both ways, the disposal, the weeks of supply, and the conversation with the retailer afterwards.

It is not a data-quality problem and it is not an integration problem. Both of those assume the information existed and something went wrong on the way to using it. Point a model at fourteen operational systems and it will read every row in them and still not answer which cases, because not one of those rows was ever about a case.

And the trace-back is worst exactly where you do not own the building. A co-manufacturer's record says a legal entity received a pallet; a franchisee's says the same. Both are true, both are useless the moment they are contested, and a company has no hands.

## What changes

visibility.cloud records the handoff at the grain you withdraw at — the case, the pallet, the unit — and puts an attested observer on every event, kept distinct from capturedBy, the account that stands behind the capture. The trace-back that ran for days across a co-manufacturer or a franchise boundary becomes a query, and the boundary of the withdrawal gets drawn where the goods actually went.

FSMA 204 is the return, never the urgency. The enforcement floor moved to July 2028 and FDA is actively soliciting further flexibilities, so the rule’s own record is softening rather than hardening. Anyone selling you that date as a gun to your head is one search away from being caught. Use FSMA 204 for operational return and GS1’s Sunrise 2027 for timing, never the reverse.

## Fork the scan.

The retail lane will read the whole symbol and keep a twelfth of it. The other eleven twelfths are yours for the asking, and asking costs nobody a behaviour change.

From the end of December 2027, under GS1’s Sunrise programme, retail point of sale is expected to scan and process 2D barcodes as well as the linear ones. A 2D symbol on a consumer pack can carry the GTIN, the serial, the batch or lot, and the expiry date, in one scan, at the same counter, on the same hardware. The register needs the GTIN. It has no field for the rest and no reason to keep it.

So the fork is the whole idea, and it is deliberately unambitious: the GTIN goes where it already goes, and the serial, the lot and the expiry go to your record instead of to the floor. Nobody scans differently. Nothing new is bought for the lane. The date is already on somebody’s plan in your company, because the artwork has to change anyway.

The lane-side split is a named entry in the open P0 ledger (P0-A10) and ships behind it. What is live today is the read underneath it: the interview at get started ends every business path with the Sunrise decision read for your situation — which symbology and which URI form is genuinely your decision as GTIN owner, and what the lane must extract versus what nothing obliges you to encode.

## What this read stands on

Evidence class: `public-record`. FSMA 204 and its dated enforcement record are public and citable. No adoption, customer or recovery figure is claimed.

Go check us. It takes ten minutes and doesn’t involve us.
EPCIS 2.0 §7.2.2 defines five event dimensions: what, when, where, why, how. No performer is among them. The party fields are organisation-grain — EPCIS §7.3.6.4, CBV §7.4.3, CBV §8.7.1 (PGLN). The conformant path to a performer today is a namespaced user-extension field (EPCIS §6.3 / §9.1 / §10.1.3). So the standard can say a company did a process — its Who is the company, a GLN. It cannot say which person or which device observed the event at 06:12: no field names the performer. The specs are public. Don’t take our word for it.

## The other three bills

There is no single company message on this surface, by design — one defect, four costs.

- **Authenticity** (https://visibility.cloud/for/authenticity/) — A convincing copy carries the same digits as the original. Jewelry, watches and luxury — brand protection, and whoever answers the client.
- **Shrink** (https://visibility.cloud/for/shrink/) — Every unit was scanned, and the investigation still ends at “seen here, then not.” Apparel and general-merchandise retail — loss prevention.
- **The discarded scan** (https://visibility.cloud/for/the-discarded-scan/) — The lane reads the serial, the lot and the expiry, and keeps none of them. Retailers and brands on the Sunrise 2027 timeline.

The typed index of all four, with each read's evidence class: https://visibility.cloud/variants.json