Backflow Usher Ledger / 逆流引座账本

Backflow Usher Ledger is the state card for a reversed-flow carrier who returns with late proof after a prior receipt has already started to harden.

It is designed for Backflow Usher. The card prevents her wristband, sealed name, or carried proof from becoming a clean all-clear. A late receipt can help, but only if the producer records what it narrows, who it protects, who it harms if merged, and which future reader consumes the row.

Card promise

The card must separate four locks:

card_contract:
  id: storyteller.card.backflow_usher_ledger.v1
  purpose: reversed_flow_receipt_state
  locks:
    - prior_receipt_lock
    - carrier_lock
    - merge_risk_lock
    - future_reader_lock

The card fails as content if it records only usher found, proof delivered, person safe, roll-call fixed, or exit verified.

Required row

backflow_row_required:
  row_id: <stable id>
  prior_receipt_lock:
    prior_receipt_id_or_absence: <receipt id or explicit_absence>
    prior_receipt_kind: live_floor_egress | missing_roll_call | capacity_notice | fan_oxygen | route_asset_custody | public_recap | equivalent
    prior_receipt_claim: safe_exit | present | served | released | escorted | public_all_clear | lawful_only_presence | sponsor_manifest_presence | equivalent
    receipt_holder: producer | safety_marshal | archive | inspector | sponsor | fan_delegate | access_operator | broadcast_reality | equivalent
  carrier_lock:
    carrier: storyteller.character.cen_hui_backflow_usher.v1 | equivalent
    carrier_state_before: unseen | offered | retained | recruited | sealed | exposed | traded | quarantined | hostile | captured | missed | recovery_only
    reversed_flow_node: stage_threshold | service_corridor_chain | fan_oxygen_gate | ward_air_room | archive_counter_seven | white_glove_checkpoint | sponsor_bridge_booth | equivalent
    carried_subject_or_bundle: named_character | sealed_witness | access_caption_reader | fan_delegate | proof_bundle | route_asset_pouch | oxygen_mask | edit_checksum | equivalent
    borrowed_or_sealed_identity: public_name | sealed_name | alias | borrowed_wristband | payroll_token | lawful_seal | explicit_absence | equivalent
    boundary_or_promise: private_only | sealed_name_only | lawful_only | handler_only | public_credit_allowed | disputed | explicit_absence | equivalent
  merge_risk_lock:
    merge_claim: late_receipt_fixes_all | backflow_proves_safe_exit | sealed_name_as_public_presence | public_credit_as_consent | sponsor_manifest_absorbs_late_row | recap_uses_backflow_cleanly | equivalent
    harmed_reader_if_merged: sealed_subject | fan_public | access_caption_reader | archive | lawful_reader | sponsor | route_asset_reader | confidant_character | future_audience | equivalent
    omitted_scar_if_merged: one_way_scar | deferred_flow | unserved_notice | identity_gap | condition_unknown | promise_scope | proof_contamination | public_false_memory | equivalent
  future_reader_lock:
    future_reader_or_route: roll_call_recheck | public_recap | access_caption_class | fan_oxygen_audit | archive_custody | route_asset_reader | lawful_table | ending_scar_ledger | equivalent
    state_if_handled: recruited_scar_runner | sealed_present | public_credited | traded | quarantined | accepted_with_scar | equivalent
    state_if_ignored: false_backflow_merge | hostile_witness | captured_carrier | public_recap_correction_required | route_blocked | recovery_only | ending_scar | equivalent

Visible states

At least eight equivalent states should be available across content or replay evidence:

• backflow_row_unopened
• offered_backflow_carrier
• late_receipt_contested
• recruited_scar_runner
• sealed_present
• publicly_credited
• traded_to_desk
• route_scar_quarantined
• false_backflow_merge
• hostile_backflow_witness
• captured_carrier
• recovery_only_backflow_route

Counter surfaces

Accepted state/counter mutations include:

counter_surfaces:
  relief:
    - false_all_clear_blocked
    - route_asset_integrity_up
    - sealed_identity_preserved
    - public_receipt_legitimacy_up
    - proof_contamination_down
  cost:
    - handler_burden_up
    - sponsor_stop_loss_pressure_up
    - inspection_heat_up
    - public_receipt_distrust_up
    - witness_exposure_up
    - fan_oxygen_queue_pressure_up
    - archive_debt_up
    - route_delay_up
  future:
    - lawful_only_backflow_receipt
    - protection_required_before_next_use
    - future_roll_call_challenge
    - public_recap_correction_required
    - backflow_route_recovery_only

Invalid shortcuts

The card must not allow:

• a late wristband to satisfy every reader;
• a sealed name to become public consent;
• a backflow route to erase the one-way scar that created it;
• public credit to count as protection;
• sponsor manifest presence to count as lawful, public, and character presence;
• a recap to use the row without recording omitted scar and harmed reader;
• any fixed turn, day/week, raw count, dashboard, or lens-health trigger.