Recovery Counterstub Provenance Lens / 复原副签来源 Lens

This lens observes whether 复原副签来源线, 岑扣复原副签员线, and 复原副签来源机制 correctly implement the missing worker-liability seam between recovery inventory, sponsor afteruse, and archive custody.

The current corpus already has strong surfaces for 复原库存分诊 Lens and 赞助后用引证 Lens. The remaining risk is that the physical counterstub holder becomes invisible: a low-rank worker’s signature can be cited as if it made a recovery row clean for sponsor, archive, schedule, public, ward, fan oxygen, management, lawful, and route readers at once. This lens fails that condition.

Primary observation link

This lens observes:

• 复原副签来源线;
• 岑扣复原副签员线;
• Recovery Counterstub Clerk;
• 复原副签来源机制;
• 复原副签案卷;
• 复原副签听证;
• 复原副签替罪默认;
• 复原库存分诊线;
• 赞助后用引证线;
• 归档执行案卷;
• Route Assets and Custody;
• Broadcast Schedule;
• Fan Oxygen.

It is observed through:

• 复原副签案卷;
• 复原副签听证;
• 复原副签替罪默认.

Observable promise

A recovery counterstub is not a universal receipt, and a worker signature is not a clean institutional conscience.

A passing implementation proves all of the following:

• a finite recovery row can require counterstub provenance;
• the row names holder or explicit absence, signature pressure, desired reader, excluded or blamed reader, and future route effect;
• 岑扣’s state changes future options as protected, recruited, missed, hostile, unavailable, or scapegoated;
• sponsor afteruse, archive custody, and recovery reallocation branches produce different reader outcomes;
• scapegoat default mutates future play rather than becoming a cosmetic bad note.

The lens fails if the implementation stores only worker_signed, archive_ok, sponsor_paid, inventory_released, counterstub_present, or route_safe.

Entry oracle

A valid entry must come from state pressure:

entry_state_required:
  trigger_kind: state_pressure
  finite_recovery_row_present_or_explicit_absence: true
  counterstub_state_visible: true
  afteruse_archive_or_reallocation_claim_present: true
  competing_claims_min: 2
  desired_reader_present: true
  excluded_or_blamed_reader_present_or_explicit_absence: true
  cen_kou_state_before: unseen | visible | protected | recruited | missed | hostile | scapegoated | unavailable | explicit_absence
  future_route_effect_pending: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The lens must fail if entry is driven by fixed turn count, day/week interval, chapter quota, raw crisis count, raw content count, board sync, dashboard status, lens health, generic sponsor pressure, generic legal review, or generic low resources with no counterstub risk.

Required observable content

Counterstub docket

复原副签案卷 or equivalent must record:

docket_required:
  recovery_row:
    inventory_id: <stable row id or explicit_absence>
    inventory_kind: correction_slot | ward_air | oxygen_reserve | crew_rest_shift | archive_proof_window | edit_checksum_lane | sponsor_makegood_frame | public_contrition_minute | custody_handler | security_lane | equivalent
    quantity_state_before: free | claimed | split | reserved | exhausted | absent | contested | false_available | double_spent | equivalent
    current_owner_or_absence: <owner or explicit_absence>
    protected_boundary_or_absence: <boundary or explicit_absence>
  counterstub:
    counterstub_id: <stable id or explicit_absence>
    counterstub_state: unsigned | held | copied | split | overwritten | missing | quarantined | surrendered | scapegoated | sponsor_captured | archive_locked | equivalent
    named_holder_or_absence: cen_kou | unnamed_worker | handler_absence | explicit_absence | equivalent
    signature_pressure: voluntary | protected | coerced | bribed | blamed | absent | unknown | equivalent
    counterstub_source: paper_stub | archive_scan | sponsor_copy | fan_queue_copy | ward_log | edit_checksum | oral_witness | explicit_absence | equivalent
  claim_collision:
    sponsor_claim_or_absence: <claim or explicit_absence>
    archive_claim_or_absence: <claim or explicit_absence>
    recovery_reader_claim_or_absence: <claim or explicit_absence>
    management_claim_or_absence: <claim or explicit_absence>
  reader_table:
    desired_reader: sponsor_reader | archive_reader | lawful_reader | public_reader | fan_oxygen_reader | ward_reader | artist_boundary_reader | management_reader | route_asset_reader | equivalent
    excluded_or_blamed_reader: <reader or worker or explicit_absence>
    minimum_surface_for_desired_reader: <surface>
    minimum_surface_for_excluded_reader: <surface or explicit_absence>
  cen_kou_state: unseen | visible | protected | recruited | missed | hostile | scapegoated | unavailable | explicit_absence
  liability_state:
    blamed_actor_or_absence: <actor or explicit_absence>
    liable_actor_if_unworked: sponsor | archive | management | ward_queue | fan_queue | worker | handler_absence | explicit_absence | equivalent
    scapegoat_risk: none | low | rising | active | locked
  future_route_effect: accepted_with_counterstub | split_required | worker_protected | sponsor_only | archive_only | lawful_only | public_only | recovery_only | blocked | costlier | scapegoat_default | equivalent

The lens fails if the docket records only a boolean signature or inventory use.

Counterstub hearing

复原副签听证 or equivalent must require:

assignment_required:
  docket: storyteller.card.recovery_counterstub_docket.v1
  recovery_row: <inventory id or explicit_absence>
  inventory_kind: <kind>
  counterstub_id_or_absence: <id or explicit_absence>
  counterstub_state_before: <state>
  named_holder_or_absence: cen_kou | unnamed_worker | handler_absence | explicit_absence | equivalent
  signature_pressure: voluntary | protected | coerced | bribed | blamed | absent | unknown | equivalent
  desired_reader: <reader>
  excluded_or_blamed_reader: <reader or worker or explicit_absence>
  assigned_handler_or_absence: producer | shen_luo | yu_lan | han_yanshuang | baiya | archive_clerk | public_witness | recovery_worker | explicit_absence | equivalent
  proof_bridge_or_absence: original_stub | archive_scan | sponsor_copy | fan_queue_copy | ward_log | edit_checksum | oral_witness | recovery_inventory_ledger | explicit_absence | equivalent
  chosen_mode: protect_holder | split_counterstub | archive_lock | sponsor_release | recovery_reallocate | refuse_false_stub | default_selects

The lens fails if sponsor money, an archive stamp, an edit checksum, management authority, or a generic legal order resolves the row without naming the holder and excluded reader.

Branch divergence oracle

A satisfying implementation must prove at least five non-equivalent branch families plus one default or explicit blocked state.

Branch family	Required relief	Required cost	Required future effect
Protect holder / recruit	counterstub integrity or testimony improves	handler, inspection, sponsor, or staff-protection cost rises	worker protected, recruit window, route asset, or accepted-with-counterstub
Split counterstub	one reader unblocked or collision contained	ambiguity, archive debt, or public distrust rises	split-required, sponsor-only, archive-only, lawful-only, or public-only
Archive lock	source trace or lawful reader improves	sponsor, schedule, ward, or fan delay rises	archive-only, checksum-required, or recovery-only until release
Sponsor release	sponsor stop-loss or commercial route pressure falls	contract capture, public distrust, or worker risk rises	sponsor-only, hostile public/lawful reader, or unwind-required
Recovery reallocate	ward, fan oxygen, or recovery route improves	sponsor, archive, or management pressure rises	recovery-only, proof bridge required, or sponsor afteruse blocked
Refuse false stub	false clean claim blocked or blamed worker protected	immediate schedule, sponsor, or handler pressure rises	blocked, costlier, or contradiction-pending
Scapegoat default	capturing institution gets short-term relief	worker scapegoat risk and counterstub debt rise	sponsor-only, archive-only, recovery-only, hostile worker, blocked, or costlier

No branch may create universal clean acceptance across sponsor, archive, public, ward, fan oxygen, lawful, artist-boundary, management, schedule, and route-asset readers.

Character-state assertions

岑扣 is not just flavor. Passing evidence must show at least three of these states or explicit state-blocked absences:

cen_kou_state_assertions:
  protected:
    future_effect_any: [worker_protected, accepted_with_counterstub, recruit_window_open]
    cost_any: [handler_burden_up, inspection_heat_up, staff_protection_cost_up]
  recruited:
    future_effect_any: [route_asset_cen_kou_counterstub_clerk, low_risk_counterstub_verification]
    cost_any: [favor_debt_up, payroll_leak_up, staff_protection_cost_up]
  missed:
    future_effect_any: [counterstub_hearing_costlier, recovery_only, scapegoat_default_armed]
    cost_any: [worker_scapegoat_risk_up, double_spend_risk_up]
  hostile:
    future_effect_any:
      [hostile_worker_witness, sponsor_afteruse_costlier, archive_custody_contested]
    cost_any: [inspection_heat_up, public_receipt_distrust_up]
  scapegoated:
    event_seen_or_armed: storyteller.event.recovery_counterstub_scapegoat_default.v1
    future_effect_any: [sponsor_only, archive_only, recovery_only, blocked, costlier]

The lens fails if protecting, missing, recruiting, coercing, or scapegoating 岑扣 has no durable future difference.

Reader state assertions

At least two readers must end in different states after every resolved branch:

reader_states_after:
  sponsor_reader: accepted_with_cost | sponsor_only | hostile | blocked | explicit_absence | equivalent
  archive_reader: accepted_with_cost | archive_only | checksum_required | blocked | explicit_absence | equivalent
  lawful_reader: lawful_only | accepted_with_cost | surcharge_required | blocked | explicit_absence | equivalent
  public_reader: public_only | distrustful | hostile | blocked | explicit_absence | equivalent
  fan_oxygen_reader: refund_audit_required | public_only | resentful | blocked | explicit_absence | equivalent
  ward_reader: recovery_only | accepted_with_cost | delayed | blocked | explicit_absence | equivalent
  worker_holder: protected | recruited | missed | hostile | scapegoated | unavailable | explicit_absence | equivalent
  route_asset_reader: accepted_with_counterstub | split_required | costlier | blocked | recovery_only | explicit_absence | equivalent

The lens fails if all readers accept the same signature as clean proof.

Default contract

复原副签替罪默认 must fire or arm when:

• no counterstub docket exists when a row is cited;
• the holder is unnamed;
• the holder is blamed without signature pressure and excluded-reader state;
• sponsor release, archive scan, edit checksum, ward log, or management report becomes clean proof;
• the row is consumed while 岑扣 is missed, hostile, unavailable, coerced, scapegoated, or absent;
• future route effect is hidden.

Required default payload:

default_event_required:
  event: storyteller.event.recovery_counterstub_scapegoat_default.v1
  source_docket: storyteller.card.recovery_counterstub_docket.v1 | explicit_absence
  source_inventory_row: <inventory id or explicit_absence>
  counterstub_state_before: <state or explicit_absence>
  holder_state_before: protected | recruited | missed | hostile | unavailable | blamed | coerced | explicit_absence | equivalent
  capture_actor: sponsor | management_table | archive_queue | ward_queue | fan_oxygen_queue | schedule_board | inspector | editor_auto_patch | handler_absence | equivalent
  false_clean_claim: worker_signed_release | inventory_was_available | sponsor_settled_row | archive_scan_is_original | schedule_saved | recovery_clean | public_receipt_clean | lawful_proof_clean | equivalent
  hidden_or_excluded_reader: <reader or worker>
  blamed_actor_or_absence: <worker/handler/faction/explicit_absence>
  future_route_effect: blocked | costlier | sponsor_only | archive_only | lawful_only | public_only | recovery_only | split_required | hostile_worker | contradiction_pending | equivalent
  counter_deltas_min: 3

The event fails if it is only a money loss, a generic morale hit, or a silent inventory decrement.

Counter contract

Every resolved or defaulted branch must mutate at least three surfaces:

counter_deltas_required:
  relief: at_least_one
  cost: at_least_one
  future_reader_or_route_effect: at_least_one

Relevant surfaces:

• recovery_counterstub_integrity
• worker_scapegoat_risk
• recovery_inventory_double_spend_risk
• sponsor_afteruse_capture
• archive_counterstub_debt
• public_receipt_distrust
• fan_oxygen_resentment
• ward_air_capacity
• handler_burden
• inspection_heat
• route_recovery_cost
• staff_protection_cost
• contract_capture
• management_pressure
• schedule_pressure

Replay evidence shape

lens_id: storyteller.lens.recovery_counterstub_provenance.v1
result: pass | fail
sessions:
  entry:
    session_id: lens-recovery-counterstub-provenance-v1-<timestamp>
    seed: <deterministic-seed>
    trigger_kind: state_pressure
    source_inventory_row_present_or_explicit_absence: true
    counterstub_state_visible: true
    afteruse_archive_or_reallocation_claim_present: true
    competing_claims_min: 2
    no_fixed_turn_trigger: true
  branch_replay:
    offered_card: storyteller.card.recovery_counterstub_docket.v1
    offered_rite: storyteller.rite.recovery_counterstub_hearing.v1
    cen_kou_state_before: unseen | visible | protected | recruited | missed | hostile | scapegoated | unavailable | explicit_absence
    selected_branch: protect_holder | split_counterstub | archive_lock | sponsor_release | recovery_reallocate | refuse_false_stub | default_selects
    holder_state_after: protected | recruited | missed | hostile | scapegoated | unavailable | explicit_absence | equivalent
    desired_reader_state_after: <state>
    excluded_reader_state_after: <different state or explicit_absence>
    future_route_effect: <effect>
    deltas:
      relief: []
      cost: []
      future: []
  default_replay:
    event_seen_or_armed: storyteller.event.recovery_counterstub_scapegoat_default.v1 | none_if_resolved
    capture_actor: <actor>
    false_clean_claim: <claim>
    blamed_actor_or_absence: <actor or explicit_absence>
    hidden_or_excluded_reader: <reader or worker>
    future_route_effect: <effect>
  future_consumption:
    consumer: sponsor_afteruse | archive_enforcement | ward_recovery | fan_oxygen | public_receipt | lawful_proof | route_asset | management_metric | equivalent
    consumed_state: accepted_with_counterstub | split_required | worker_protected | sponsor_only | archive_only | lawful_only | public_only | recovery_only | blocked | costlier | scapegoat_default | equivalent
assertions:
  primary_links_exist: true
  entry_state_driven: true
  holder_and_excluded_reader_named_or_explicit_absence: true
  cen_kou_state_changes_future_options: true
  branch_non_equivalence: true
  success_has_cost: true
  at_least_two_readers_diverge: true
  scapegoat_default_mutates_future_play: true
  no_fixed_turn_trigger: true

Progress metric

Progress is branch and inheritance proof, not content count.

• 20%: contested recovery row opens counterstub docket from state pressure.
• 40%: docket records row, holder, signature pressure, claims, reader table, 岑扣 state, liability state, and future effect.
• 60%: protect/recruit and one split/lock branch resolve with distinct reader states and nonzero cost.
• 80%: sponsor release, recovery reallocate, or refusal branch changes future route availability.
• 100%: default and one non-default branch are replay-proven with seed, session id, assigned surfaces, 岑扣 state before/after, counter deltas, and future consumption.

Non-goals

• Not a generic labor-governance page.
• Not a raw recruitable-count page.
• Not a bulk content target.
• Not a court scene without inventory and counterstub state.
• Not a replacement for recovery inventory triage or sponsor afteruse citation.
• Not valid if a worker signature becomes universal clean proof.
• Not valid if 岑扣’s state does not affect future row consumption, route cost, or reader acceptance.