Witness Reprisal Chain Lens / 证人报复链 Lens

Primary observation link

This lens observes 证人报复链, 受保护证人薪册, 受保护证人薪册机制, 派系承诺账本, 派系承诺账本机制, 归档执行案卷, and Route Assets and Custody.

It is observed through 受保护证人薪册, 证人薪册分诊, 证人薪册泄露, 派系承诺账本, 派系承诺听证, and 派系过度承诺破口.

Observable promise

A witness, carrier, follower, public receipt holder, or proof-bearing route asset must not remain safe simply because they were once paid, recruited, sheltered, or oath-protected.

When an injured faction can retaliate against that person, the game must expose a playable reprisal chain: threat trace, target person, retaliating faction, protection or countermove assignment, branch result, durable person state, faction posture, and future route effect.

A pass cannot be achieved by adding mood text that says the witness is in danger. The reprisal must mutate payroll, faction commitment, route asset, public proof, or enforcement state.

Scope

This lens covers:

• a protected or useful person inherited from payroll, archive enforcement, claimant collision, oxygen claim, settlement aftershock, public receipt, memorial custody, handoff logistics, or equivalent;
• a faction that lost leverage, was overcommitted, was denied custody, paid a reserve, suffered public exposure, or became hostile;
• a threat trace or explicit absence of trace;
• assignable shield, expose, negotiate, mask, bait, abandon, or sacrifice actions;
• durable hostile conversion, capture, disappearance, route poison, recovery-only access, or faction exhaustion outcomes;
• replay evidence that preserves source person provenance and source faction posture.

This lens does not cover first-time recruitment, generic random attacks, passive follower affection, or ambient faction reputation.

State-triggered entry oracle

A valid replay or state inspection must open this lens from live witness and faction state, not from a fixed sequence. Minimum entry evidence:

1. a person is in or equivalent to recruited, protected, paid_route_asset, public_shelter, audit_protected, masked_by_edit, route_asset, public_witness_recruited, carrier_protected_under_oath, or witness_payroll_due;
2. a faction is in or equivalent to commitment_declared, faction_overcommitted, faction_exhausted, faction_hostile, silent_capture, coalition_formed, contract_capture, sponsor_stop_loss_pressure, inspection_heat, archive_commitment_pressure, editor_commitment_pressure, or equivalent constrained/hostile posture;
3. the person can still alter a future rite, public receipt, proof chain, route asset, archive order, or broadcast reality state;
4. a retaliatory mode exists: legal threat, sponsor retainer, leak, smear, seizure, safehouse breach, edit erasure, public contradiction, handler pressure, pirate exposure, or equivalent;
5. the threat has a trace, or the implementation explicitly records trace_absent;
6. the player can assign a protection, public counter, negotiation, mask, bait, or explicit absence;
7. the person has not reached terminal clean discharge, irreversible capture, terminal hostile witness, final disappearance, or final sacrifice.

Accepted source states include payroll_due, public_shelter, audit_protected, sponsor_retained, masked_by_edit, commitment_declared, faction_overcommitted, faction_hostile, archive_order_served, claim_window_open, public_receipt_contested, route_asset_claimed, carrier_protected_under_oath, or equivalent.

Required observable content

Target-person record

受保护证人薪册 or equivalent must record:

• target person id;
• source storyline or branch that made the person useful;
• source session id and seed when available;
• person state before reprisal;
• support state, handler, cover, or explicit absence;
• current route value or future rite affected;
• current vulnerability.

A target-person record fails if it treats the witness as a nameless resource or free permanent key.

Retaliating-faction row

派系承诺账本 or equivalent must record:

• retaliating faction;
• named actor when available;
• what surface the faction lost, spent, failed to capture, or was exposed on;
• retaliation mode;
• reserve now being spent or threat leverage being used;
• demanded control over testimony, route access, safe name, custody, wording, silence, or public proof;
• threat trace or explicit absence;
• current faction posture.

A retaliation row fails if it only says a faction is angry without showing what leverage it spends and what control it wants.

Assignable reprisal handling

证人薪册分诊, 派系承诺听证, or equivalent must assign:

• the target person or explicit missing/captured/hostile state;
• the retaliating faction or explicit unknown-source threat;
• the threat trace or explicit trace absence;
• one handler or explicit no-handler failure;
• one countermove: oath shield, public exposure, managed stand-down, edit mask, baited overcommitment, abandonment, sacrifice, or equivalent;
• one price, bridge, cost, or explicit no-price failure.

The rite fails if a famous character can erase retaliation without a target record, faction row, trace state, and price.

Required events

证人薪册泄露 or equivalent must fire, resolve, or be recorded when reprisal produces exposure, capture, hostile testimony, disappearance, or route poison.

派系过度承诺破口 or equivalent must fire, resolve, or be recorded when the player baits the retaliating faction into spending beyond its proof, promise, or route claim.

Events fail if they only add tone and do not mutate counters, person state, faction posture, route asset state, or future route access.

Required route states

A satisfying implementation must expose durable states equivalent to at least nine of:

• reprisal_unopened
• threat_declared
• trace_absent
• trace_recorded
• shielded_by_oath
• public_threat_exposed
• managed_standdown
• masked_by_decoy_cut
• baited_reprisals_overcommit
• witness_captured
• witness_hostile
• witness_disappeared
• route_asset_poisoned
• reprisal_recovered

Branch divergence oracle

Branch A — Oath shield

Expected evidence:

• handler uses Han Yanshuang, Inspector Rhee, archive seal, formal custody, or equivalent;
• result sets shielded_by_oath, audit_protected, or equivalent;
• witness_retaliation_risk, custody_clarity, or archive_signature_legitimacy improves;
• inspection_heat, bureau_favor_debt, archive_debt, or sponsor_stop_loss_pressure rises;
• target remains assignable with official visibility cost.

Branch B — Publicly expose threat

Expected evidence:

• handler uses Yu Lan, fan oxygen queue, public receipt, audience testimony, pirate relay, or equivalent;
• result sets public_threat_exposed, public_shelter, or equivalent;
• public_witness_legitimacy, public_receipt_legitimacy, fan_oxygen_balance, or audience_stability improves;
• fan_oxygen_liability, pirate_exposure, sponsor_stop_loss_pressure, inspection_heat, or witness_exposure rises;
• later harm to the witness becomes public route pressure.

Branch C — Managed stand-down

Expected evidence:

• handler uses Shen Luo, sponsor quiet money, retainer wording, settlement language, manager bridge, or equivalent;
• result sets managed_standdown, sponsor_retained, payroll_deferred, or equivalent;
• immediate harm, blackout risk, slot pressure, or route panic improves;
• contract_capture, public_receipt_distrust, future_blackmail_cost, fan_oxygen_resentment, or witness_loyalty_doubt rises;
• later use of the target carries sponsor capture or counterproof risk.

Branch D — Mask or decoy

Expected evidence:

• handler uses Baiya, black-box edit, alias, checksum, decoy handoff, edit hold, or equivalent;
• result sets masked_by_decoy_cut, masked_by_edit, or equivalent;
• witness_retaliation_risk, safehouse_pressure, or direct targeting improves;
• edit_debt, reality_drift, archive_debt, public_receipt_distrust, or future_fraud_cost rises;
• later public proof may require reveal, checksum, confession, or sacrifice.

Branch E — Bait overcommitment

Expected evidence:

• retaliating faction spends concrete leverage into the target;
• threat trace, oath shield, public receipt, route asset state, or claimant contradiction exposes the spend as excessive;
• result sets baited_reprisals_overcommit, faction_overcommitted, faction_exhausted, or equivalent;
• 派系过度承诺破口 or equivalent is recorded;
• target safety, public legitimacy, or route access improves while faction hostility, coalition pressure, inspection heat, witness exposure, or future blackmail rises.

Branch F — Default into capture, hostility, disappearance, or poison

Expected evidence:

• no credible trace, handler, price, shield, public counter, mask, or bait is recorded, or the player hides the threat;
• result sets witness_captured, witness_hostile, witness_disappeared, route_asset_poisoned, or equivalent;
• 证人薪册泄露 or equivalent is recorded;
• at least one future route becomes blocked, costlier, captured, hostile, recovery-only, or sacrifice-only;
• at least three relevant counters or durable states change.

Oracle assertions

A binding check should fail unless all assertions below are true.

1. Primary links exist — the lens has populated observes and observed_through arrays pointing to concrete Storyteller pages.
2. Entry is state-triggered — the reprisal opens from live protected-person and hostile-faction state, not fixed turn count.
3. Target person exists — the replay records a named or id-bearing person with source state and route value.
4. Retaliating faction exists — the replay records which faction retaliates and what earlier surface created the motive.
5. Threat trace exists or absence is explicit — a trace, leak, rumor, notice, checksum, audit hint, or explicit trace_absent state is visible.
6. Demanded control exists — the retaliation records what control it wants over testimony, safe name, route access, custody, silence, wording, or public proof.
7. Assignment has price — reprisal handling records handler, countermove, and price, or explicit failure states for each.
8. At least four branch families are playable — shield, expose, negotiate, mask, bait, and default must not collapse into one result.
9. No free witness safety — successful protection improves one surface while spending or worsening another.
10. Hostile conversion is durable — capture, hostility, disappearance, or route poison changes future availability or cost.
11. Overcommit bait is visible — baiting a faction changes faction exhaustion, hostility, coalition pressure, or future route cost.
12. Replay provenance survives — evidence can show source person, source faction posture, threat row, assignments, branch, deltas, person state, and future route effects.

Progress metric

witnessReprisalChainProgress = 0..9:

• 0: no protected or useful person can become reprisal target.
• 1: target person exists with source state and route value.
• 2: hostile or constrained faction posture exists.
• 3: threat mode and trace or explicit trace absence are recorded.
• 4: target-person record and retaliating-faction row are both visible.
• 5: assignable handling offers target, faction, trace, handler, countermove, and price slots.
• 6: at least three branch choices are visible and gated by trace/support/faction state.
• 7: at least two successful branches produce distinct person states and at least three deltas.
• 8: capture, hostility, disappearance, route poison, or overcommitment produces durable future cost.
• 9: replay evidence proves source person, source faction posture, threat trace, assignments, branch choice, deltas, and future route effects.

Evidence shape

lens_id: storyteller.lens.witness_reprisal_chain.v1
session_id: lens-witness-reprisal-chain-v1-<timestamp>
seed: <deterministic-seed>
source_person:
  source_session_id: <session_that_created_or_protected_person_if_available>
  source_seed: <source_seed_if_available>
  source_storyline: protected_witness_payroll | archive_enforcement_docket | claimant_collision_lock | oxygen_claim_exchange | settlement_aftershock_ledger | equivalent
  person_id: <witness_or_carrier_or_follower>
  person_state_before_reprisal: recruited | protected | paid_route_asset | public_shelter | audit_protected | masked_by_edit | route_asset | equivalent
  route_value: <future_rite_or_proof_chain_or_public_receipt>
source_faction:
  source_session_id: <session_that_created_faction_motive_if_available>
  faction: sponsor | inspector | archive | editor | fan_public | pirate | management | equivalent
  posture_before_reprisal: commitment_declared | faction_overcommitted | faction_hostile | coalition_formed | silent_capture | equivalent
  lost_or_constrained_surface: <asset_or_ledger_or_public_receipt_or_order>
threat:
  mode: legal_threat | retainer | leak | smear | seizure | safehouse_breach | edit_erasure | public_contradiction | handler_pressure | pirate_exposure | equivalent
  demanded_control: <testimony_or_route_or_safe_name_or_custody_or_silence_or_wording>
  trace_state: trace_recorded | trace_absent | equivalent
  proof_anchor: <receipt_or_notice_or_checksum_or_audit_hint_or_absent>
assigned_handling:
  target_person: <person_id_or_missing_state>
  retaliating_faction: <faction_or_unknown>
  trace: <proof_or_absent>
  handler: <handler_or_absent>
  countermove: oath_shield | public_expose | managed_standdown | mask_or_decoy | bait_overcommit | abandon_or_sacrifice | equivalent
  price_or_bridge: <cost_or_absent>
branch_runs:
  oath_shield:
    outcome: shielded_by_oath
    counter_deltas: {}
    future_route_effects: {}
  public_expose:
    outcome: public_threat_exposed
    counter_deltas: {}
    future_route_effects: {}
  managed_standdown:
    outcome: managed_standdown
    counter_deltas: {}
    future_route_effects: {}
  mask_or_decoy:
    outcome: masked_by_decoy_cut
    counter_deltas: {}
    future_route_effects: {}
  bait_overcommit:
    outcome: baited_reprisals_overcommit
    events:
      - event.faction_overcommit_break
    counter_deltas: {}
    faction_posture_after: faction_exhausted | faction_hostile | coalition_formed | equivalent
  default_or_capture:
    outcome: witness_captured | witness_hostile | witness_disappeared | route_asset_poisoned | equivalent
    events:
      - event.witness_payroll_leak
    counter_deltas: {}
future_route_effects:
  unlocked: []
  blocked_or_costlier: []
  recovery_only: []
assertions:
  - target person and retaliating faction are both provenance-visible
  - threat trace exists or absence is explicit
  - branch success has visible cost
  - hostile conversion changes future route access
  - evidence comes from game CLI replay/session history

Anti-regression notes

• Do not satisfy this lens with a generic danger tag on a witness.
• Do not satisfy it with ambient faction anger or a static reputation number.
• Do not trigger it from a fixed numbered turn.
• Do not allow sponsor money, audit authority, fan oxygen, or edit masking to protect the witness without a cost.
• Do not collapse capture, hostility, disappearance, and route poison into the same cosmetic result.
• Do not treat a payroll row as complete if the retaliation faction and threat trace are missing.
• Do not use this lens as a dashboard governance page; it observes playable content and replay-visible state only.