Missing Roll-Call Ledger / 漏点名账本

Missing Roll-Call Ledger records the moment when an earlier desk says a person, witness, body, proof bundle, or route asset has moved safely, but another live reader cannot find the same identity in the expected place.

The card exists because 直播现场通行瓶颈线 can validly move a flow without proving that every named person in that flow arrived as the same protected identity, with the same custody state, under the same promise scope. A clean evacuation receipt is not a roll-call.

Card promise

A valid row must separate four questions:

1. presence — is the person, witness, body, or asset physically accounted for;
2. identity — is the accounted-for presence the same named or sealed identity expected by the route;
3. custody — who can lawfully or publicly vouch for the arrival;
4. condition — did the subject arrive safe, exposed, substituted, injured, hostile, sealed, or recovery-only.

The card is invalid if it records only safe, missing, evacuated, dead, rescued, hostile, in custody, or route asset moved without showing which prior receipt is being challenged.

Row shape

missing_roll_call_row:
  row_id: <stable id>
  source_receipt:
    source_surface: live_floor_egress | capacity_notice_service | caption_witness_custody | protected_witness_payroll | confidant_promise | fan_oxygen | route_asset_custody | broadcast_reality | equivalent
    receipt_id_or_absence: <receipt id or explicit_absence>
    receipt_claim: safe_exit | served_notice | payroll_checked_in | witness_delivered | source_anonymized | route_asset_escorted | oxygen_queue_released | performer_withdrawn | equivalent
    receipt_holder: producer | safety_marshal | access_operator | archive | inspector | fan_delegate | handler | sponsor | editor | equivalent
  expected_subject:
    subject_kind: named_character | sealed_witness | performer_body | fan_delegate | access_caption_reader | child_voice_source | proof_bundle | route_asset | crew_member | equivalent
    expected_identity_or_seal: <name seal alias or explicit_absence>
    expected_location_or_state: ward_air_room | fan_oxygen_gate | archive_counter | caption_table | cutroom_blackbox | stage_threshold | public_table | protected_payroll | route_asset_slot | equivalent
    protection_scope_or_absence: public_name_allowed | sealed_name_only | anonymous_public | lawful_only | private_only | handler_only | route_asset_only | explicit_absence | equivalent
  conflict_reader:
    reader: fan_public | access_caption_class | archive | inspector | sponsor | handler | protected_witness_payroll | route_asset_reader | broadcast_reality | lawful_table | equivalent
    contradiction: receipt_says_present_reader_says_absent | receipt_says_safe_condition_unsafe | identity_alias_unrecognized | duplicate_presence | false_missing | substituted_body | custody_gap | protection_scope_conflict | equivalent
    consequence_if_unreconciled: witness_exposed | fan_panic | access_class_escalation | archive_fraud | sponsor_capture | route_blocked | proof_contaminated | character_missed | recovery_only | equivalent
  reconciliation_state:
    selected_posture: physical_search | sealed_identity_match | public_roll_call | lawful_quiet_check | substitute_receipt | route_asset_quarantine | accept_absence_scar | false_all_clear_default | equivalent
    handler_or_absence: producer | shen_luo | yu_lan | han_yanshuang | baiya | ai_sheng | fan_delegate | safety_marshal | access_operator | archive_clerk | explicit_absence | equivalent
    support_or_absence: corridor_light | oxygen_reserve | caption_notice | payroll_token | checksum_bag | lawful_counter | anonymity_shell | witness_guard | explicit_absence | equivalent
    receipt_after_or_absence: <new receipt or explicit_absence>
    condition_after: found_safe | found_exposed | sealed_present | public_present | lawful_only | substituted | hostile | blocked | missed | recovery_only | contradiction_pending | equivalent
    future_reader_or_route: <future consumer>

Common rows

Row	Earlier receipt	Later contradiction	Possible scar
Sealed witness not at payroll	egress says witness escorted	protected payroll has no sealed token	lawful-only check, witness reprisal risk
Accessible exit says clear	access-caption path receipt exists	caption witness ledger names an unserved reader	class escalation, public correction cost
Performer withdrawn	stage threshold receipt says body left camera	broadcast reality still airs the performer as present	body duplicate, selfhood or route scar
Fan oxygen queue released	safety marshal log says gate cleared	fan delegate roll-call reports missing inhaler group	oxygen resentment, public table required
Route asset escorted	archive bag arrives	route asset reader rejects custody condition	quarantine, proof contamination, recovery-only
Private source anonymized	promise ledger says source protected	public roll-call requires a name	promise breach, hostile witness, lawful-only substitute

Required deltas

Every resolved row must create at least one relief, one cost, and one future reader mutation.

counter_deltas_required:
  relief_any:
    - missing_subject_located
    - false_missing_cleared
    - sealed_identity_preserved
    - public_panic_down
    - route_asset_condition_clarified
    - access_roll_call_legitimacy_up
  cost_any:
    - search_delay_up
    - witness_exposure_risk_up
    - fan_oxygen_resentment_up
    - access_caption_pressure_up
    - archive_fraud_risk_up
    - sponsor_stop_loss_pressure_up
    - handler_burden_up
    - route_asset_pressure_up
  future_state_any:
    - lawful_only_presence
    - public_roll_call_receipt_required
    - sealed_identity_costlier
    - contradiction_pending
    - substitute_receipt_contested
    - route_asset_quarantined
    - character_unavailable
    - recovery_only

Failure cases

The card fails if it treats a prior movement receipt as universal safety, uses a generic crowd counter as proof of presence, hides the challenged identity, hides the reader who discovered the mismatch, or lets all accounted for clear every future route without cost.