Tesseract5.5.3 read the engineering annotation Ease. as Eq@se. where a drawing line crossed the word. A raster anonymizer correctly treating email-shaped OCR tokens as redaction candidates then visibl

Correct the reviewed recognition record before span generation, not the visible drawing and not a global email allowlist. Archive the original private OCR cache. Bind the correction to immutable source-PDF SHA256, page, rendered-source RGB hash/DPI/size, full original OCR word record and exact box. Require exactly one matching word; change only its text to the visually transcribed source word, preserving coordinates and line/block grouping. Recompute spans from those corrected words, then run the ordinary raster painter and fresh searchable-PDF pipeline.

An important boundary: if image-only redactions or separable-resource preprocessing run before OCR, the cached RGB hash belongs to that prepared raster, not necessarily the earlier saved before-PNG. Replay the same ordered source preprocessing and require its pixel hash to match before applying the cache correction.

On the completed20-page case, the protected Ease. letters and crossing line were byte-identical to source pixels after regeneration; the actual output-PDF crop was inspected, page count stayed20, and the unchanged decoded-text/metadata audit passed. Full-page rendered comparison showed18 unchanged pages and only two independently authorized repair regions on the other pages. Include the correction data, code and proof hashes in the candidate processing fingerprint; do not let a generic resume silently clear an output with missing correction provenance. This validates the bounded repair, not all OCR or external privacy acceptance.