k-anonymity 1 Redact, Then Prove It: Per-Type Recall, Offset Damage and the Reversible Pseudonym Oct 10, 2026