Ledger Custodian Audit Witness Lens / 账簿保管员审计见证 Lens

Observable promise

This lens ensures the Ledger Custodian is a genuinely recruitable and missable audit witness, not a flavor label or a passive integrity modifier.

A pass proves that the player can assign the character to the public audit, deliberately continue with documentary evidence after missing them, or fail without either witness or ledger. Those states must change archive custody, audit integrity, debt, pressure, rights obligations, and future eligibility differently.

Entry oracle

entry_state:
  trigger_kind: state_pressure
  pressure_rite: rite.expose_fan_oxygen_audit_pressure
  pressure_flag: ledger_custodian.fan_oxygen_audit_pressure_visible
  fan_oxygen_debt_at_least: 2
  event: event.oxygen_audit_notice
  event_options:
    public: open_public_custodian_witness_window
    substitute: open_documentary_substitute_window
    blackout: open_blackout_absence_window
  active_relief_broadcast: true
  community_archive_present: true
  public_oxygen_audit_unresolved: true
  ledger_custodian_state: living | documentary_substitute | explicit_absence
  no_fixed_turn_trigger: true

The pressure prelude must use the exact broadcast, oxygen, archive, and future-reader rows. The lens fails if the notice appears just because starter cards exist, if the character appears only at a fixed turn or after the audit has resolved, or if there is no live ledger slot and archive-custody decision.

Recruitment oracle

The recruited branch must show:

recruited_branch:
  branch: public_custody_pass
  ledger_slot: npc.ledger_custodian
  pressure_actor: faction.city_inspectorate
  rights_posture: storyteller.card.oxygen_audit_no_rights_transfer_receipt.v1
  future_reader: storyteller.card.ledger_custodian_named_future_reader.v1
  archive_slot: asset.community_archive
  archive_custody_after: public
  fan_oxygen_debt_decreases: true
  rights_transfer_count: 0
  character_state_after: assigned_public_witness
  recruited_flag: ledger_custodian.recruited
  route_asset: route_asset.ledger_custodian_audit_witness
  terminal_flag: ledger_custodian.audit_disposition_recorded

The public CLI replay must prove the relevant pressure prelude followed by the exact seven-slot assignment and show that this is the only branch with recruitment and the custodian route asset. Runtime must reject an omitted option, a choice with the wrong event branch flag, and a choice whose required slot cards do not match.

The player may continue after missing the character, but only with explicit documentary proof and an explicit scar.

substitute_branch:
  branch: sponsor_custody_compromise
  ledger_slot: card.evidence.fan_oxygen_ledger
  pressure_actor: faction.corporate_sponsors
  rights_posture: card.rights.temporary_voice_release
  future_reader: storyteller.card.ledger_custodian_named_future_reader.v1
  ledger_custodian_assigned: false
  archive_custody_after: contested
  temporary_rights_release_required: true
  character_state_after: substituted_by_ledger_card
  miss_flag: ledger_custodian.missed_for_current_audit
  terminal_flag: ledger_custodian.audit_disposition_recorded

This branch proves that missability does not make the rite unreachable. card.evidence.fan_oxygen_ledger cites card-storyteller-fan-oxygen-ledger with grantsSourceCard: false; the documentary row is not living testimony or a second source ledger.

Failure and hard-miss oracle

failure_branch:
  branch: failure_blackout_audit
  ledger_slot: storyteller.card.ledger_custodian_explicit_absence.v1
  pressure_actor: storyteller.card.oxygen_audit_pressure_absence.v1
  rights_posture: storyteller.card.oxygen_audit_rights_absence.v1
  future_reader: storyteller.card.ledger_custodian_named_future_reader.v1
  ledger_custodian_assigned: false
  ledger_card_assigned: false
  fan_oxygen_debt_decreases: false
  outcome: event.blackout_unverified_relief
  archive_custody_after: contested
  character_state_after: missed_for_current_audit
  miss_flag: ledger_custodian.missed_for_current_audit
  terminal_flag: ledger_custodian.audit_disposition_recorded

The lens fails if the blackout branch quietly grants witness credit, reduces debt off-screen, or allows the same resolved audit to recruit the custodian afterward.

Reachability and irreversibility

All three branches must be present in focused Storyteller Game CLI evidence:

  • ledger-custodian-audit-witness.public.replay.json with npc.ledger_custodian, inspector pressure, and the no-transfer receipt;
  • ledger-custodian-audit-witness.substitute.replay.json with the documentary ledger, sponsor pressure, temporary rights, and no custodian recruitment;
  • ledger-custodian-audit-witness.blackout.replay.json with exact ledger/pressure/rights absence cards, no debt reduction, and no custodian recruitment.
hard_fail_rejections:
  recruited_after_missed_ledger_custodian: true
  debt_decrease_without_evidence: true
  duplicate_archive_custody: true
  orphan_rights_transfer: true

Progress metric

ledgerCustodianAuditWitnessProgress = 0..3 in runtime:

  • 0: the Ledger Custodian is only a wiki name.
  • 1: the audit notice preselects one exact branch tuple.
  • 2: the blackout branch records its lower-cost hard miss after the notice.
  • 3: public or substitute resolves its full branch after the notice.

Lens completion additionally requires all three terminal replays, sole public recruitment/route creation, and irreversible substitute/blackout misses.

CLI evidence contract

  • lens/replays/ledger-custodian-audit-witness.public.replay.json
  • lens/replays/ledger-custodian-audit-witness.substitute.replay.json
  • lens/replays/ledger-custodian-audit-witness.blackout.replay.json

Each artifact must use source: storyteller, carry the non-null lens slug storyteller-lens-ledger-custodian-audit-witness-v1, show the event choice before the matching rite choice, preserve all seven exact assignments, and end with the correct disposition. The older fan-oxygen-archive-audit.replay.json remains historical semantic design evidence for the parent lens; it is not sufficient for this character lens.

Non-goals

  • Not a new fan-oxygen subsystem.
  • Not an automatic recruitment reward.
  • Not a claim that documentary evidence equals living testimony.
  • Not a clean sponsor-custody route.
  • Not satisfied by page existence without branch reachability and durable missability evidence.