Branch Eligibility Receipts / 分支资格回执机制

Branch Eligibility Receipts is the mechanism for material branches that become locked, suppressed, downgraded, hidden by claimant pressure, or recovery-only before selection.

It fills a specific gap in the current mesh. Existing content can preserve selected outcomes, declined visible offers, stopped routes, capacity service, counterreceipts, and management compression. What remains dangerous is quieter: a branch can fail to appear, and the game may treat that absence as natural instead of as a replay-visible state.

Mechanism promise

A material unavailable branch must leave an in-world receipt when any future reader can care about that absence.

The mechanism must answer:

What branch was tested, what live state blocked it, who benefited from the lock, who was harmed by not seeing it, and what future route consumes the lock?

It is not a hint system. It is route-state custody for unavailable choices.

Boundary with adjacent systems

• 未采纳报价回执线: records choices that were offered but not chosen.
• 路线停办登记线: records a route the producer stops pursuing after it still has residual play.
• 容量告知送达队列线: records notice service required before capacity can be reused.
• 被排除者反回执挑战线: records excluded constituencies challenging an overconsumed receipt.
• 经营压缩台机制: records executive over-counting after success.

This mechanism records the pre-selection surface where a branch is materially absent, locked, downgraded, or suppressed.

State-triggered entry

entry_state:
  trigger_kind: state_pressure
  source_option_set_present: true
  candidate_branch_present: true
  candidate_branch_material_to_future_play: true
  eligibility_state_any:
    - locked
    - suppressed
    - downgraded
    - hidden_by_claimant
    - recovery_only
    - explicit_absence
  blocking_surface_visible_or_explicit_absence: true
  missing_or_contested_requirement_visible_or_explicit_absence: true
  lock_beneficiary_visible_or_explicit_absence: true
  harmed_reader_if_silent_visible_or_explicit_absence: true
  future_reader_or_route_consumes_lock_state: true
  player_can_fulfill_assign_downgrade_bond_publish_accept_suppress_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_choice_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The mechanism fails if it opens from fixed chronology, chapter quota, raw option count, raw missing-choice count, generic tutorial state, dashboard state, or lens health.

Core objects

Object	Purpose	Required observation
branch_eligibility_receipt	concrete card for unavailable branch state	candidate branch, blocker, beneficiary, harmed reader, future reader
branch_eligibility_readback	rite that lets player act on the lock reason	selected posture, proof/carrier/bond/absence, future effect
silent_branch_suppression	default event when absence is hidden or generic	false-unavailable claim, default actor, harmed reader, future effect
future_lock_consumer	later surface that reads the lock	route, receipt, package, proof window, ending scar, or broadcast reality

Runtime contract

The runtime contract is deliberately smaller than the design vocabulary above. It consists of one nine-slot rite, eight exact outcomes, and one default-only event.

runtime_objects:
  card_catalog: game-content/storyteller/cards/branch-eligibility-receipt.json5
  rite: storyteller.rite.branch_eligibility_readback.v1
  event: storyteller.event.silent_branch_suppression.v1
  replay: lens/replays/branch-eligibility-receipts.replay.json
exact_slots:
  receipt: storyteller.card.branch_eligibility_receipt.v1
  source_option_set: storyteller.card.branch_eligibility_source_option_set.v1
  candidate_branch: storyteller.card.branch_eligibility_candidate_branch.v1
  blocker_row: storyteller.card.branch_eligibility_blocker_row.v1
  missing_requirement: storyteller.card.branch_eligibility_missing_requirement.v1
  lock_beneficiary: storyteller.card.branch_eligibility_lock_beneficiary.v1
  harmed_reader: storyteller.card.branch_eligibility_harmed_reader.v1
  proof_bridge: storyteller.card.branch_eligibility_proof_bridge.v1
  future_reader: storyteller.card.branch_eligibility_future_reader.v1
enforcement:
  exact_slot_accepts: true
  assigned_cards_in_hand: true
  selected_option_required: true
  selected_option_requirements_enforced: true

The runtime state namespace is branch_eligibility.state.<state>, the branch namespace is branch_eligibility.branch.<branch>, and future effects use future_route.<future>. A successful readback leaves exactly one branch flag, one matching state flag, and one matching future flag true.

Branch	State	Future
fulfill_requirement	eligibility_restored_with_cost	branch_eligible_with_named_cost
assign_carrier	carrier_assigned	eligibility_carrier_required
downgrade_branch	branch_downgraded	downgraded_branch_only
pay_bond	bond_posted	eligibility_bond_required
publish_absence	absence_published	public_absence_receipt_required
accept_recovery_only	recovery_only_accepted	branch_recovery_only
suppress_lock	lock_suppressed	suppressed_branch_challenge_armed
default_silent	silent_default_pending	silent_branch_suppression_pending

default_silent alone sets the four pending flags named in the event contract. The other seven branches must clear them. This is the machine-readable distinction between a locally receipted eligibility posture and a branch that broadcast reality is beginning to file as never having existed.

Eligibility states

eligibility_states:
  eligible:
    branch_selectable: true
    cost_visible: true
  locked:
    branch_selectable: false
    requirement_missing_or_contested: true
  suppressed:
    branch_selectable: false
    beneficiary_from_absence_visible: true
  downgraded:
    full_branch_unavailable: true
    lesser_branch_available_with_cost: true
  hidden_by_claimant:
    claimant_filing_changes_option_surface: true
  recovery_only:
    clean_branch_unavailable: true
    scar_preserving_route_remains: true
  false_unavailable:
    silent_suppression_default_armed_or_seen: true
  explicit_absence:
    absence_named_and_consumable: true

Blocking surfaces

Valid blockers include equivalent local names for:

• capacity row unavailable;
• callback not settled;
• notice unserved;
• proof missing, spoiled, quarantined, or pawned;
• carrier absent, captured, overburdened, or conflicted;
• handler unavailable or unsafe;
• witness protection missing;
• sponsor veto, stop-loss, or capture;
• public receipt missing;
• lawful annex missing;
• archive seal or custody missing;
• route asset unavailable or in disputed custody;
• producer license encumbered;
• management compression over-counting;
• broadcast reality already hardened a contradiction.

A generic resource shortage is not enough. The blocker must name what future reader can read.

Readback branches

A satisfying implementation exposes at least six non-equivalent branch families plus default or suppression:

1. fulfill_requirement — spend or create the missing state; emit branch_eligible_with_named_cost.
2. assign_carrier — name a carrier who can later carry eligibility; emit eligibility_carrier_required.
3. downgrade_branch — offer a lesser route; emit downgraded_branch_only.
4. pay_bond — open temporary eligibility through a named bond; emit eligibility_bond_required.
5. publish_absence — make the lock reason visible; emit public_absence_receipt_required.
6. accept_recovery_only — block false-clean eligibility; emit branch_recovery_only.
7. suppress_lock — record suppression and arm suppressed_branch_challenge_armed without opening the default event.
8. default_silent — receipt the prior silent absence, emit silent_branch_suppression_pending, and arm 静默分支压下.

Every branch must mutate relief, cost, and future route state.

Receipt card contract

分支资格回执 or equivalent must include:

receipt_required:
  source_option_set_id: <choice set, rite, docket, or route surface>
  candidate_branch_id: <branch or branch family>
  candidate_branch_label: <player-facing branch name>
  eligibility_state_before: locked | suppressed | downgraded | hidden_by_claimant | recovery_only | explicit_absence
  blocking_surface: <surface or explicit_absence>
  blocking_row_id_or_absence: <row id or explicit_absence>
  missing_requirement_or_absence: <requirement or explicit_absence>
  contested_requirement_or_absence: <requirement or explicit_absence>
  exhausted_capacity_or_absence: <capacity or explicit_absence>
  lock_beneficiary: <reader actor or explicit_absence>
  harmed_reader_if_silent: <reader actor or explicit_absence>
  reason_text: <short in-world explanation>
  proof_bridge_or_absence: <proof or explicit_absence>
  recovery_posture: fulfill_requirement | assign_carrier | downgrade_branch | pay_bond | publish_absence | accept_recovery_only | suppress_lock | default_silent
  future_reader: <reader route package proof window ending scar or explicit_absence>
  future_route_effect: <effect>

The mechanism fails if the receipt lacks branch identity, blocker, harmed reader, beneficiary, recovery posture, or future effect.

Default event contract

静默分支压下 fires or arms when a material unavailable branch has no receipt, only generic lock text, a hidden blocker, hidden harmed reader, hidden beneficiary, wrong blocker, or false recovery-only posture.

The default must record:

default_required:
  source_option_set_id: <id>
  candidate_branch_id_or_absence: <branch id or hidden>
  missing_receipt_reason: missing | underfilled | generic_reason_only | hidden_blocker | hidden_harmed_reader | hidden_beneficiary | wrong_blocker | false_recovery_only | equivalent
  false_unavailable_claim: <claim>
  default_actor: sponsor | archive | inspector | management | route_asset | public_table | lawful_reader | artist | fan_public | handler | broadcast_reality | equivalent
  harmed_reader_state_after: hostile | excluded | silenced | public_counter | lawful_challenge | sponsor_capture | recovery_only | explicit_absence
  pending_future_route_effect: silent_branch_suppression_pending
  terminal_future_route_effect: future_routes_require_eligibility_receipt | public_or_lawful_challenge_required | recovery_only_until_blocker_served
  counter_deltas_min: 3

Default may be playable. It must not be clean.

The runtime event is gated only by the resolved default_silent branch and all four pending flags:

1. branch_eligibility.silent_default_pending
2. event.silent_branch_suppression.armed
3. future_route.silent_branch_suppression_pending
4. broadcast_reality.branch_falsely_absent

It exposes exactly three stable terminal IDs:

Terminal	Terminal state	Future effect
reconstruct_eligibility_receipt	eligibility_receipt_reconstruction_required	future_routes_require_eligibility_receipt
publish_hidden_beneficiary	hidden_lock_beneficiary_exposed	public_or_lawful_challenge_required
freeze_false_unavailable_route	false_unavailable_route_frozen	recovery_only_until_blocker_served

Every terminal clears all four pending flags and the silent_default_pending state, sets branch_eligibility.default_resolved plus branch_eligibility.silent_suppression_scar, and writes one exclusive terminal state/future pair. Constructive or suppress_lock results may never open this event.

Authority boundary

The mechanism tracks pre-selection branch eligibility and the local custody of its blocker only. It can expose a missing requirement, carry it, price it, publish its absence, narrow the branch, or preserve a challenge. It cannot make the candidate branch true or lawful, satisfy requirements merely by naming them, override a source option set, or grant consent, waiver, settlement, route clearance, archive release, proof truth, sponsor authority, fan authority, inspector authority, editor authority, or universal broadcast authority.

Future-reader consumption

The mechanism is incomplete unless at least one later surface consumes the receipt or default state. Valid consumers include:

• route-asset custody;
• declined-offer afterbid;
• capacity notice service;
• route discontinuance;
• management compression;
• public receipt;
• lawful annex;
• sponsor unwind;
• archive seal;
• ending scar;
• broadcast reality.

Replay evidence contract

mechanic: storyteller.mechanic.branch_eligibility_receipts.v1
session_id: lens-branch-eligibility-receipts-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  source_option_set_present: true
  candidate_branch_present: true
  candidate_branch_material_to_future_play: true
  eligibility_state_before: locked | suppressed | downgraded | hidden_by_claimant | recovery_only | explicit_absence
  blocking_surface_visible_or_explicit_absence: true
  harmed_reader_if_silent_visible_or_explicit_absence: true
  future_reader_or_route_consumes_lock_state: true
  no_fixed_turn_trigger: true
receipt:
  card: storyteller.card.branch_eligibility_receipt.v1
  candidate_branch_id: <id>
  blocking_surface: <surface>
  lock_beneficiary: <reader>
  harmed_reader_if_silent: <reader>
readback:
  rite: storyteller.rite.branch_eligibility_readback.v1
  selected_posture: fulfill_requirement | assign_carrier | downgrade_branch | pay_bond | publish_absence | accept_recovery_only | suppress_lock | default_silent
result:
  eligibility_state_after: <state>
  event_seen_or_armed: storyteller.event.silent_branch_suppression.v1 | explicit_absence
  future_route_effect: <effect>
  counter_deltas:
    relief: []
    cost: []
    future: []
assertions:
  - branch_absence_is_receipted_or_defaulted
  - blocker_is_concrete_or_explicit_absence
  - harmed_reader_and_beneficiary_visible_or_explicit_absence
  - readback_branches_diverge
  - future_reader_consumes_lock_state
  - no_clean_silent_branch_disappearance
  - no_fixed_turn_day_week_raw_count_dashboard_or_lens_health_trigger

Non-goals

• Not a tutorial, hint system, UI debug layer, or governance page.
• Not a fixed unlock schedule.
• Not a raw choice-count requirement.
• Not a duplicate of declined offers, route discontinuance, capacity service, or counterreceipts.
• Not valid unless unavailable branch state changes future play.