Card Schema Ingestion Audit / 卡牌结构入库审计机制

Card Schema Ingestion Audit is the mechanic that turns a questionable card-family use into a visible management decision.

It opens when a card row has a declared family, a requested slot or reader wants to consume it, and the declared fields either mismatch that use or are explicitly absent. The player must then certify, narrow, convert, split, quarantine, waive, or default the card row before a future route can rely on it.

Entry contract

trigger_kind: state_pressure
incoming_card_row_present: true
declared_card_family_visible: true
requested_slot_or_reader_visible: true
schema_mismatch_or_explicit_absence_visible: true
carrier_or_owner_visible_or_explicit_absence: true
future_reader_or_route_consumes_schema_state: true
no_fixed_turn_trigger: true
no_fixed_day_or_week_trigger: true
no_raw_card_count_trigger: true
no_dashboard_or_lens_health_trigger: true

The mechanic must not open because the player owns many cards, has reached a chapter boundary, or has a dashboard/lens-health warning.

State machine

State	Meaning	Required consequence
schema_row_pending	A card row is about to enter a slot, route, or reader.	Docket must record declared family and requested use.
schema_certified	The declared family is sufficient for the requested use.	Off-family uses are blocked or moved elsewhere.
schema_narrowed	The card works only for a scoped reader or slot.	Later broad use requires addendum or new proof.
schema_converted_with_receipt	The family changes with owner, bridge, and cost visible.	Source family scar remains queryable.
schema_split_faces	More than one face remains true.	Future reader must pick or reconcile the split.
schema_quarantined	The row cannot safely enter the current use.	Route delays or replacement requirement appears.
schema_waived_with_debt	A reader permits mismatch but records a claim.	Waiver creates sponsor, edit, archive, lawful, or management debt.
schema_miscast_defaulted	Wrong family is accepted without visible inputs.	schema-miscast-default fires or arms.

Required row

schema_ingestion_row:
  source_card_id: <card id or explicit_absence>
  declared_card_family: schedule | character | scene | resource | secret | thought | blackout | equivalent | explicit_absence
  observed_fields:
    [
      mirror_rights,
      allowed_slots,
      resource_tags,
      secret_tags,
      risks,
      route_hooks,
      folds_to,
      legacy_hooks,
    ]
  requested_use: schedule_slot | on_screen_slot | route_asset | proof_bridge | public_narrative | lawful_annex | sacrifice_payment | blackout_repair | equivalent
  required_card_family_or_slot: <family or slot>
  mismatch_kind: missing_field | wrong_family | stale_countdown | hidden_blackout | owner_absent | reader_scope_gap | equivalent
  carrier_or_owner: <person, desk, card owner, explicit_absence>
  proof_bridge_or_absence: <receipt, checksum, testimony, schedule row, explicit_absence>
  handler_or_reader: <reader or explicit_absence>
  selected_response: certify_declared_schema | narrow_schema_scope | convert_with_receipt | split_card_faces | quarantine_miscast_card | schema_waiver_with_debt | schema_miscast_default
  schema_state_after: schema_certified | schema_narrowed | schema_converted_with_receipt | schema_split_faces | schema_quarantined | schema_waived_with_debt | schema_miscast_defaulted
  future_reader_or_route_effect: declared_family_locked | narrow_reader_only | converted_with_receipt | split_custody | quarantine_required | waived_with_debt | recovery_only

Counter contract

Every non-default branch must name at least one relief, one cost, and one future route or reader mutation.

Accepted counters and surfaces:

• slot_legality
• schedule_pressure
• schema_trust
• proof_burden
• conversion_debt
• source_family_scar
• archive_debt
• edit_debt
• sponsor_capture
• reader_scope_gap
• blackout_pressure
• route_access
• handler_burden
• future_audit_cost

Default rule

The default is valid only if it names the false schema claim, source card or absence, hidden/missing inputs, capturing reader, state after, and future reader or route effect.

It is not enough to say “invalid card.” The event must explain how the false family use mutates future play.