Fan Oxygen Archive Audit / 粉丝氧气档案审计

Purpose

This parent lens verifies that fan-oxygen relief becomes an answerable audit chain: a named broadcast, ledger posture, reserve, Community Archive, pressure actor, rights posture, and future reader must agree before debt or custody can change.

The Ledger Custodian is a living witness, not a generic integrity modifier. Documentary evidence keeps the audit playable after the witness is missed, but it cannot recreate living testimony or silently grant the source ledger.

State-driven entry and preselection

rite.expose_fan_oxygen_audit_pressure first assigns the exact broadcast, oxygen reserve, Community Archive, and named future reader. It sets a visible pressure flag and adds two fan-oxygen debt without selecting a witness, settling custody, or transferring rights.

Only after that prelude does event.oxygen_audit_notice expose three ordered choices. Each opens the same rite.public_oxygen_audit, preserves the existing debt, and records the matching rite choice index and branch flag:

Event option	Rite option	Ledger / pressure / rights tuple
open_public_custodian_witness_window	public_custody_pass	living custodian / inspector / no-transfer receipt
open_documentary_substitute_window	sponsor_custody_compromise	documentary ledger / sponsors / temporary voice release
open_blackout_absence_window	failure_blackout_audit	explicit ledger absence / pressure absence / rights absence

Entry is state pressure, not a fixed turn or automatic starter-card event. The event must not recruit, transfer rights, settle custody, or mutate debt before the audit resolves.

Exact seven-slot contract

The rite slot order is broadcast, ledger, oxygen, archive, pressure_actor, rights_posture, future_reader.

The fixed assignments are:

• card.broadcast.sponsor_relief_gala;
• card.resource.fan_oxygen_reserve;
• asset.community_archive;
• storyteller.card.ledger_custodian_named_future_reader.v1, naming community_archive_public_oxygen_audit_readback_desk.

The branch-specific assignments must match the preselection exactly:

Branch	ledger	pressure_actor	rights_posture
Public	npc.ledger_custodian	faction.city_inspectorate	storyteller.card.oxygen_audit_no_rights_transfer_receipt.v1
Substitute	card.evidence.fan_oxygen_ledger	faction.corporate_sponsors	card.rights.temporary_voice_release
Blackout	storyteller.card.ledger_custodian_explicit_absence.v1	storyteller.card.oxygen_audit_pressure_absence.v1	storyteller.card.oxygen_audit_rights_absence.v1

No virtual card, generic any assignment, cross-branch tuple, wrong branch flag, or omitted option passes. These are core rejections, not only replay conventions.

Branch oracle

Public custody

public_custody_pass lowers fan-oxygen debt, raises audit integrity by four, records public Community Archive custody, transfers no rights, recruits the Ledger Custodian, and creates only route_asset.ledger_custodian_audit_witness.

Documentary substitute

sponsor_custody_compromise lowers debt, raises audit integrity by three, records contested custody and one temporary voice release, and sets ledger_custodian.missed_for_current_audit. It must not set recruitment or the route asset.

card.evidence.fan_oxygen_ledger points to card-storyteller-fan-oxygen-ledger with grantsSourceCard: false. It is a scoped audit evidence row, not a parallel source ledger.

Blackout absence

failure_blackout_audit uses all three explicit-absence rows, records contested custody, event.blackout_unverified_relief, and broadcast_slot.failed.blackscreen, and raises recovery pressure. It must preserve fan-oxygen debt and must not recruit or create the route asset.

All three branches record ledger_custodian.audit_disposition_recorded; substitute and blackout are irreversible misses for the current audit.

CLI replay contract

• ledger-custodian-audit-witness.public.replay.json — event choice 0, rite choice 0, exact public tuple, recruited route asset, debt 1, integrity 4.
• ledger-custodian-audit-witness.substitute.replay.json — event choice 1, rite choice 1, exact documentary tuple, current-audit miss, debt 1, integrity 3.
• ledger-custodian-audit-witness.blackout.replay.json — event choice 2, rite choice 2, exact absence tuple, hard miss, debt 2, integrity 1.

Every artifact must use source: storyteller, carry the non-null lens slug storyteller-lens-ledger-custodian-audit-witness-v1, show the notice before the rite, preserve exact assignments, and end without open notice state. The dotted canonical lens id remains storyteller.lens.ledger_custodian_audit_witness.v1 in runtime metadata and the bound lens definition.

Historical design evidence

lens/replays/fan-oxygen-archive-audit.replay.json remains the original semantic branch projection. It records the intended public/substitute/blackout shapes and hard-fail ideas, but it is historical design evidence only. The three focused Game CLI artifacts above are the executable evidence contract.

Non-goals

• Not automatic oxygen allocation authority.
• Not voice, archive, memorial, consent, identity, personhood, or death authority.
• Not a clean sponsor-custody shortcut.
• Not satisfied by the historical semantic projection alone.