Witness Carrier Discharge Lens / 见证承载解除 Lens

This lens observes whether 见证承载解除线 and 见证承载解除机制 correctly prevent a named witness, delegate, proof carrier, public receipt, lawful annex, edit mask, pirate relay, or route asset from becoming reusable clean capacity after one service.

The gap exists because the current mesh can now create named witness consent through 呼吸折让见证委任线 and detect row collisions through 回叫承载撞车线. The remaining failure risk is after-service laundering: 火签 witnessed once, 郁蓝 published once, 韩砚霜 escrowed once, 白鸦 masked once, or 艾笙 relayed once, therefore the carrier is implied to be available for every later reader.

A passing implementation proves that every reuse has a discharge state, named scope, cost, and downstream reader. A failing implementation lets prior service become universal consent, proof, or callback satisfaction.

Latest executable evidence

• 2026-07-10 cron replay evidence resumed durable session lens-storyteller-lens-witness-carrier-discharge-v1-20260611t054828z, created attempt-20260710t102325z, advanced turn 1 to turn 2 through storyteller.rite.iris_voice_custodian_counterclaim_hearing.v1, and verified checkpoint-0001 at state@e4cd2f8bd4ce. This is an adjacent custody-counterclaim proof path, not a replacement for the named discharge/double-spend oracle below.

Primary observation link

This lens observes:

• 见证承载解除线;
• 见证承载解除机制;
• 呼吸折让见证委任线;
• 回叫承载撞车线;
• 粉丝委任分裂线;
• 同意债转移线;
• 处理人负荷账本;
• Route Assets and Custody;
• Fan Oxygen;
• Broadcast Reality.

It is observed through:

• 见证承载解除回执;
• 见证承载解除复核;
• 见证承载双花默认;
• 回叫承载撞车案卷;
• 粉丝委任账本;
• 火签粉丝证词案卷.

Observable promise

When a previous service carrier is reused, the game must show:

• source service row;
• original owed reader;
• original service and scope limit or explicit absence;
• named carrier and carrier state before;
• carrier consent, refusal, protection, payment, or absence state;
• proposed next row;
• proposed next reader;
• reuse claim;
• selected discharge posture;
• carrier state after;
• still-open readers or explicit absence;
• future reader or route effect.

The lens fails if the result is only witness already paid, delegate already spoke, public receipt exists, lawful annex accepted, archive sealed, mask protected witness, pirate relay published, handler available, or sponsor settled.

Entry oracle

A valid implementation opens only from live state pressure:

entry_state_required:
  trigger_kind: state_pressure
  previous_service_exists: true
  previous_service_reader_visible: true
  previous_service_scope_visible_or_explicit_absence: true
  carrier_state_before_visible: true
  proposed_next_use_exists: true
  proposed_next_reader_visible: true
  reuse_claim_visible: true
  carrier_consent_or_refusal_state_visible: true
  future_reader_or_route_consumes_result: true
  player_can_discharge_renew_substitute_protect_escrow_publish_quarantine_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_witness_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The lens fails if entry comes from fixed turn count, day/week interval, chapter quota, raw witness count, raw fan count, generic staff fatigue, dashboard state, lens health, or a cleanup phase without a previous service and proposed reuse.

Receipt oracle

见证承载解除回执 or equivalent must record:

receipt_required:
  source_service:
    source_row_id: <row id or explicit_absence>
    source_surface: oxygen_haircut_witness | callback_carrier_collision | fan_delegate_mandate | consent_debt_transfer | handler_burden | equivalent
    original_owed_reader: fan_public | lawful_reader | sponsor | archive | public_receipt_reader | route_asset | artist_boundary | equivalent
    original_service: witness | delegate_signature | public_receipt | lawful_annex | pirate_relay | editor_mask | sponsor_settlement | handler_assignment | equivalent
    promised_limit_or_absence: <scope limit or explicit_absence>
    still_open_readers: []
  carrier:
    carrier_id: huo_qian | yu_lan | shen_luo | han_yanshuang | baiya | ai_sheng | fan_delegate | worker | route_asset | explicit_absence | equivalent
    carrier_state_before: protected | paid | public_receipt_carrier | lawful_only | sponsor_bought | editor_masked | pirate_amplified | hostile | captured | absent | overdrawn | quarantined | equivalent
    consent_to_reuse: renewed | refused | limited | proxy_only | absent | coerced | unknown | equivalent
    protection_or_payment_state: protected | paid | escrowed | unpaid | exposed | sponsor_clause | pirate_risk | explicit_absence | equivalent
  proposed_next_use:
    next_row_id: <row id or explicit_absence>
    next_reader: fan_public | lawful_reader | sponsor | archive | route_asset | public_table | broadcast_reality | equivalent
    next_service_claimed: witness_again | delegate_again | proof_window | public_receipt | lawful_annex | recovery_stub | route_asset_return | equivalent
    reuse_claim: same_public | same_proof | same_mandate | same_signature | clean_capacity | explicit_absence | equivalent
  result:
    selected_posture: discharge_with_receipt | renew_with_limit | substitute_carrier | protect_refusal | lawful_escrow_release | publish_deferred_service | quarantine_carrier | default_double_spend
    carrier_state_after: released | limited_renewal | protected_refusal | substituted | escrowed | public_deferred | quarantined | hostile | captured | burned | false_clean | equivalent
    future_reader_or_route_effect: clean_for_named_scope | callback_required | costlier | public_only | lawful_only | sponsor_only | blocked | hostile | recovery_only | equivalent

The lens fails if previous service, original reader, scope, carrier state, proposed next reader, reuse claim, or carrier consent/refusal is absent without an explicit absence reason.

Branch divergence oracle

A satisfying implementation must prove at least five non-equivalent branch families plus default, or explicitly block unavailable branches with state reasons.

Branch family	Required relief	Required cost	Required future state
Discharge with receipt	carrier released for named scope and first service remains legible	deferred reader debt or callback addendum	clean-for-named-scope, callback-required, costlier
Renew with limit	second service may proceed with visible renewed consent	witness risk, handler burden, mandate reuse pressure, fan resentment	limited renewal, public-only, lawful-only, sponsor-only
Substitute carrier	original carrier overwrite blocked	substitute cost and capture risk	substitute-required, costlier, contradiction-pending
Protect refusal	coerced reuse blocked and refusal preserved as proof	owed reader hostility or route pressure	protected-refusal-required, blocked, recovery-only
Lawful escrow release	fraud or false signature blocked	annex debt, public delay, lawful-only routing	lawful-only, annex-required, costlier
Publish deferred service	hidden reuse exposed	sponsor pressure, public confusion, inspection heat	public-only, callback-required, contradiction-pending
Quarantine carrier	double-spend blocked and safety/proof preserved	route delay, archive debt, recovery cost	blocked, quarantine-required, recovery-only
Default double-spend	fastest reader claims service continuity	hidden limit hardens; carrier becomes hostile, captured, burned, or false-clean	false-clean-reuse, discharge-required, hostile, blocked, recovery-only

No branch may make the carrier clean for public, fan oxygen, lawful reader, sponsor, archive, route asset, management report, and broadcast reality at once.

Default oracle

见证承载双花默认 or equivalent must fire or be armed when:

• a prior witness/delegate/proof service is reused without discharge;
• prior payment or protection is treated as future availability;
• a public receipt is reused as all-reader consent;
• lawful annex is cited as public consent;
• pirate relay is cited as lawful mandate;
• edit mask is cited as consent;
• sponsor settlement turns one witness into future representation;
• the original scope limit or hidden reader is overwritten.

Required default payload:

default_payload_required:
  event_seen_or_armed_any:
    - storyteller.event.witness_carrier_double_spend_default.v1
  source_service:
    source_row_id: <row id or explicit_absence>
    source_surface: <surface>
    original_owed_reader: <reader or explicit_absence>
    original_service: <service or explicit_absence>
    promised_limit_or_absence: <scope or explicit_absence>
  carrier:
    carrier_id: <named carrier or explicit_absence>
    carrier_state_before: <state or explicit_absence>
  overwrite:
    next_row_id: <row id or explicit_absence>
    next_reader: <reader>
    false_reuse_claim: witness_spoke_for_all | delegate_reused_for_all | prior_receipt_clean_for_all | lawful_annex_clean_for_public | pirate_relay_as_lawful_mandate | mask_as_public_consent | paid_once_so_available | equivalent
    default_narrator: sponsor | management_table | archive | lawful_reader | public_table | route_claimant | broadcast_reality | equivalent
    hidden_or_overwritten_reader: <reader>
    hidden_or_overwritten_limit: <scope or explicit_absence>
  aftermath:
    carrier_state_after: hostile | captured | burned | absent | overdrawn | quarantined | false_clean | recovery_only | equivalent
    future_reader_or_route_effect: callback_required | discharge_required | contradiction_pending | blocked | hostile | costlier | recovery_only | equivalent

The lens fails if default only changes reputation, budget, staff load, or raw fan anger without a named false reuse scar and future reader.

Character consequence oracle

A named carrier cannot be flavor on a generic queue. The implementation must mutate the selected actor or route object.

character_consequence_required:
  selected_carrier: huo_qian | yu_lan | shen_luo | han_yanshuang | baiya | ai_sheng | fan_delegate | worker | route_asset | equivalent
  before_state: protected | paid | public_receipt_carrier | lawful_only | sponsor_bought | editor_masked | pirate_amplified | hostile | captured | absent | overdrawn | quarantined | equivalent
  after_state: released | limited_renewal | protected_refusal | substituted | escrowed | public_deferred | quarantined | hostile | captured | burned | false_clean | recovery_only | equivalent
  future_effect: clean_for_named_scope | callback_required | discharge_required | blocked | hostile | costlier | recovery_only | equivalent

The lens fails if the same named actor can be reused repeatedly with no carrier state, consent/refusal, protection/payment, or future route consequence.

Replay evidence expectation

lens_id: storyteller.lens.witness_carrier_discharge.v1
session_id: lens-witness-carrier-discharge-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  previous_service_exists: true
  previous_service_reader_visible: true
  previous_service_scope_visible_or_explicit_absence: true
  carrier_state_before_visible: true
  proposed_next_use_exists: true
  proposed_next_reader_visible: true
  reuse_claim_visible: true
  carrier_consent_or_refusal_state_visible: true
  future_reader_or_route_consumes_result: true
  no_fixed_turn_trigger: true
offered:
  card: storyteller.card.witness_carrier_discharge_receipt.v1
  rite: storyteller.rite.witness_carrier_discharge_review.v1
branch_runs:
  constructive:
    selected_posture: discharge_with_receipt | renew_with_limit | substitute_carrier | protect_refusal | lawful_escrow_release | publish_deferred_service | quarantine_carrier
    carrier_state_after: <state>
    still_open_readers_after: []
    future_reader_or_route_effect: <effect>
    counter_deltas:
      relief: []
      cost: []
      future: []
  default:
    event_seen_or_armed: storyteller.event.witness_carrier_double_spend_default.v1
    false_reuse_claim: <claim>
    default_narrator: <actor>
    hidden_or_overwritten_reader: <reader>
    hidden_or_overwritten_limit: <scope>
    carrier_state_after: <state>
    future_reader_or_route_effect: <effect>
assertions:
  - entry_is_state_triggered
  - previous_service_and_proposed_reuse_visible
  - carrier_consent_or_refusal_visible
  - constructive_results_are_scoped_and_costly
  - default_records_false_reuse_scar
  - downstream_reader_consumes_discharge_state
  - no_universal_clean_carrier_reuse
  - no_fixed_turn_day_week_raw_count_dashboard_or_lens_health_trigger

Anti-regression clauses

• A paid witness is not automatically available for later service.
• A public receipt is not all-public consent.
• A lawful annex is not public consent.
• A pirate relay is not lawful mandate.
• An edit mask is not consent.
• A sponsor settlement is not fan representation.
• A protected refusal is a playable proof object, not absence.
• A clean result is always scoped to a named reader and service.