Caption Proof Carrier Handoff / 字幕证明承载交接机制

Caption Proof Carrier Handoff prevents an accepted caption proof row from becoming clean universal carrier state when it is moved to another surface.

It sits after caption correctness and reliance decisions. The mechanic starts only when a later reader or route tries to consume a caption proof row through a new public, lawful, archive, sponsor, edit, operator, or route-asset carrier.

Core contract

Any implementation using this mechanic must preserve:

1. source caption proof row;
2. source caption state;
3. handoff surface;
4. carrier or explicit absence;
5. reader scope;
6. proof bridge or explicit absence;
7. attempted future use;
8. selected handoff posture;
9. carrier state after;
10. future reader or route effect.

The mechanic fails if caption proof accepted lets all later readers cite the proof without checking carrier scope.

State-triggered entry

caption_proof_carrier_handoff_entry:
  trigger_kind: state_pressure
  source_caption_proof_row_present: true
  handoff_surface_visible: true
  carrier_or_explicit_absence_visible: true
  reader_scope_visible: true
  proof_bridge_or_explicit_absence_visible: true
  attempted_future_use_visible: true
  future_reader_consumes_carrier_state: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_caption_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Handoff row state

caption_proof_handoff_row:
  source_caption_proof:
    source_row_id: <stable id>
    source_surface: caption_witness | access_caption_reliance | caption_latency_debt | translation_waiver | lawful_transcript | public_recap | operator_relay | equivalent
    source_caption_state: certified_access | certified_raw | late_repaired | translated_scoped | lawful_only | sponsor_safe | split_language | disputed | equivalent
  handoff:
    handoff_surface: public_bulletin | access_notice | lawful_annex | archive_checksum | sponsor_report | edit_lane | route_asset_packet | fan_relay | inspector_memo | operator_witness | equivalent
    carrier_or_absence: caption_operator | public_reader | lawful_annex | archive_checksum | sponsor_sideletter | edit_checksum | fan_relay | route_asset | explicit_absence | equivalent
    reader_scope: public | access_public | lawful | sponsor | archive | fan_public | operator | route_asset | split | explicit_absence | equivalent
    proof_bridge_or_absence: caption_witness | public_readback | lawful_seal | archive_stamp | editor_checksum | sponsor_sideletter | fan_receipt | explicit_absence | equivalent
  future:
    attempted_future_use: route_unlock | sponsor_reach | public_access | lawful_claim | archive_lookup | edit_cut | management_report | ending_scar | equivalent
    harmed_or_omitted_reader: access_reader | public_reader | lawful_reader | sponsor | archive | operator | fan_public | route_asset | explicit_absence | equivalent
    false_clean_claim_if_unresolved: proof_carrier_clean_for_all | sponsor_reach_proved | lawful_annex_satisfies_public | archive_checksum_satisfies_access | edit_caption_is_source | operator_silent_carrier | equivalent

Branch families

Public access handoff

The carrier is public or access-scoped. Public proof becomes readable, but sponsor, lawful, or archive consumers must keep their own cost.

selected_posture: public_access_handoff
carrier_state_after: public_scoped
future_effect_any: [public_route_accepted_with_access_scar, notice_required, disputed_reach]

Lawful annex handoff

The carrier moves through lawful annex, inspector memo, or court-facing transcript. It may preserve evidence while narrowing public use.

selected_posture: lawful_annex_handoff
carrier_state_after: lawful_scoped
future_effect_any: [lawful_only, public_notice_required, blocked_until_review]

Archive checksum handoff

The handoff preserves checksum, timestamp, or row order. It does not prove reader access by itself.

selected_posture: archive_checksum_handoff
carrier_state_after: checksum_bound
future_effect_any: [checksum_required, route_delay, contradiction_pending]

Sponsor scope handoff

The handoff may satisfy a sponsor reach or makegood claim only inside a named scope.

selected_posture: sponsor_scope_handoff
carrier_state_after: sponsor_scoped
future_effect_any: [sponsor_only, disputed_reach, costlier_public_route]

Operator protection handoff

The handoff names the operator, handler, or explicit absence so the operator does not become silent liability.

selected_posture: operator_protection_handoff
carrier_state_after: protected_operator_or_absence
future_effect_any: [operator_witness_route, protected_carrier_required, edit_debt]

Split carrier handoff

The carrier is split by reader, language, route, or surface.

selected_posture: split_carrier_handoff
carrier_state_after: split_required
future_effect_any: [split_required, contradiction_pending, costlier]

Quarantine carrier

The handoff is unsafe for the attempted future use.

selected_posture: quarantine_carrier
carrier_state_after: quarantined
future_effect_any: [blocked, recovery_only]

False caption carrier default

The fastest desk claims the carrier is clean.

selected_posture: false_caption_carrier_default
emitted_event: storyteller.event.false_caption_carrier_default.v1
carrier_state_after: false_clean_carrier
future_effect_any: [hostile, contradiction_pending, recovery_only]

Counters

The mechanic may move these counters:

• caption_carrier_integrity
• public_access_trust
• lawful_annex_debt
• archive_checksum_debt
• sponsor_reach_dispute
• operator_exposure
• route_asset_pressure
• broadcast_reality_drift

Non-goals

• Not another caption witness hearing.
• Not a translation waiver review.
• Not an access reliance settlement.
• Not valid if a handoff lacks carrier, reader scope, proof bridge, attempted future use, and future route effect.