Broadcast Warrant Ledger / 播出许可账本

Broadcast Warrant Ledger records the authority trace for a major intervention before that intervention becomes broadcast reality.

The ledger is not a permission checkbox. It is the proof that a future reader can inspect who authorized the intervention, which surface operated it, which cut made it broadcastable, what cost was paid, and what trace remains.

Entry rule

Create or refresh this card from state pressure when:

• a major intervention is attempted;
• the intervention may be cited by a future reader;
• a warrant authority is visible or explicitly absent;
• an operator surface is visible;
• the cost and trace can change later route access;
• ignoring the row arms Unauthorized Warrant Trace Default.

Do not create it from a fixed turn count, day interval, raw authority count, dashboard state, or lens health.

Exact runtime assignment cards

game-content/storyteller/cards/broadcast-warrant-ledger.json5 defines the ledger plus seven focused evidence cards. The rite binds them by exact slot and card ID:

Slot	Exact card ID	Local evidence carried
ledger	storyteller.card.broadcast_warrant_ledger.v1	the review row and its source pressure
intervention	storyteller.card.broadcast_warrant_intervention.v1	the single attempted intervention
authority_source	storyteller.card.broadcast_warrant_authority_source.v1	authority source or explicit absence
operator_surface	storyteller.card.broadcast_warrant_operator_surface.v1	the actor or surface that performs it
cut_path	storyteller.card.broadcast_warrant_cut_path.v1	how the intervention becomes broadcastable
cost_surface	storyteller.card.broadcast_warrant_cost_surface.v1	the paid, risked, polluted, or locked surface
future_reader	storyteller.card.broadcast_warrant_future_reader.v1	the next reader or route that consumes the trace
default_risk	storyteller.card.broadcast_warrant_default_risk.v1	the specific false-clean risk if review fails

All eight are real source: storyteller cards. Every slot is required, accepts only the named card, and requires it in hand. None of the seven supporting cards independently proves authority, legality, consent, truth, or future reuse.

Required row

broadcast_warrant_ledger:
  card_id: storyteller.card.broadcast_warrant_ledger.v1
  trigger_kind: state_pressure
  intervention_id: <stable intervention id>
  intervention_kind: clearance | edit | legalize | archive | sponsor | oxygen | memorial | audit | public_witness | route_asset_use | equivalent
  source_pressure: security_clearance | facility_access | sponsor_copy | broadcast_stability | legality_conversion | public_recap | production_triage | archive_enforcement | fan_oxygen | route_asset | equivalent
  authority_source_or_absence: sponsor_asset | legal_asset | archive_asset | memorial_asset | oxygen_asset | audit_asset | public_witness | black_box_edit | producer_license | explicit_absence
  operator_surface: character_card | rite | route_asset | sponsor_copy | archive_order | public_receipt | oxygen_ledger | editor_checksum | producer_license | explicit_absence
  cut_path: saintly_pacification | legal_folding | black_box_edit | unauthorized_witness | white_glove_audit | sponsor_package | oxygen_bridge | memorialization | refusal | explicit_absence
  cost_surface: sponsor_capture | inspection_heat | archive_debt | oxygen_debt | memorial_debt | unauthorized_trace | edit_debt | public_distrust | schedule_scar | explicit_absence
  trace_state_after: warrant_unreviewed | sponsor_scoped_warrant | lawful_authorized_trace | archive_scoped_warrant | oxygen_public_warrant | audit_locked_warrant | dirty_public_trace | black_box_trace | broadcast_refused | unauthorized_default_pending
  future_reader_or_route: <reader route rite ending or explicit_absence>
  unauthorized_default_risk: missing_authority | missing_operator | missing_cost | missing_trace | wrong_reader | black_box_as_truth | false_clean_warrant | explicit_absence

Required separations

The ledger fails if it collapses these into one safe flag:

• intervention id;
• authority source or explicit absence;
• operator surface;
• cut path;
• cost surface;
• trace state after;
• future reader or route;
• unauthorized default risk.

The runtime row also preserves the exact selected mapping. trace_state_after must be one of sponsor_scoped_warrant, lawful_authorized_trace, archive_scoped_warrant, oxygen_public_warrant, audit_locked_warrant, dirty_public_trace, black_box_trace, broadcast_refused, or unauthorized_default_pending; its future effect must match the selected rite option exactly.

Local authority denial

The ledger proves only that one intervention was reviewed against the assigned source cards. Its runtime and public metadata must keep localAuthorityOnly: true and deny consent, waiver, settlement, route clearance, archive release, proof truth, sponsor warranty, producer-license release, fan authority, inspector authority, editor authority, later afteruse authority, future-reuse authority, and universal broadcast authority.

authority_boundary:
  localAuthorityOnly: true
  recordsInterventionWarrantTraceOnly: true
  preservesNamedAuthorityOperatorCutAndCost: true
  preservesFutureReaderScope: true
  requiresVisibleTraceForBroadcastReality: true
  grantsConsent: false
  grantsLegalValidity: false
  grantsWaiver: false
  grantsSettlement: false
  grantsRouteClearance: false
  grantsArchiveRelease: false
  grantsProofTruth: false
  grantsSponsorWarranty: false
  grantsProducerLicenseRelease: false
  grantsSponsorAuthority: false
  grantsFanAuthority: false
  grantsInspectorAuthority: false
  grantsEditorAuthority: false
  grantsProducerLicense: false
  grantsFutureReuseAuthority: false
  grantsUniversalBroadcastAuthority: false

Executable evidence

The runtime source, lens/storyteller-broadcast-warrant-trace.runtime.test.ts, lens/replays/broadcast-warrant-trace.replay.json, scripts/evaluate_lenses.mjs, and public/data/storytellerCards.json5 must agree on all eight IDs and exact slot accepts. The deterministic replay assigns all eight cards and selects unauthorized_trace_default; the focused test covers every branch mapping.

Valid row examples

• A security clearance is broadcast through lawful seal, but public acceptance remains costlier.
• A sponsor package funds a stable version, but the route becomes sponsor-only until unwound.
• A black-box edit hides a contradiction, but the checksum is required before future route use.
• Yu Lan preserves an unauthorized witness trace that blocks clean sponsor reality but raises lawful recovery cost.
• An oxygen bridge calms the crowd, but the fan ledger must carry debt rather than becoming free consent.

Non-goals

• Not a generic action log.
• Not a producer-license meter.
• Not a sponsor copy warranty docket.
• Not valid unless authority, operator, cost, trace, and future reader are all visible or explicitly absent.