Confidant Promise Breach / 私约违背机制

Confidant Promise Breach makes private character promises first-class route pressure. It prevents a protected confession, private refusal, source identity, checksum, route secret, witness name, child-voice trace, or selfhood boundary from becoming free proof just because the producer knows it.

This mechanism is for named character play. It links proof economy to recruitability, missability, handler availability, hostility, and future route cost.

Trigger surface

A confidant-promise pressure surface exists only when all required state is visible or explicitly absent:

confidant_promise_trigger:
  trigger_kind: state_pressure
  named_confidant_or_explicit_absence_visible: true
  private_promise_or_boundary_present: true
  protected_material_visible: true
  requested_use_present: true
  permission_scope_visible_or_explicit_absence: true
  pressure_actor_visible: true
  threat_if_unused_visible: true
  future_character_or_route_consumes_promise_state: true
  player_can_honor_renegotiate_anonymize_protect_trade_refuse_breach_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_promise_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Invalid entries include generic affinity changes, arbitrary character scenes, fixed sequence position, raw relationship count, lens health, dashboard state, or a recap that cannot change future route or character state.

State model

The mechanism keeps three locks separate.

promise_locks:
  trust_lock:
    promise_id: <stable id>
    confidant_character: <named character or explicit_absence>
    promise_holder: <holder>
    promise_origin_surface: <surface>
    private_boundary: <boundary or explicit_absence>
  material_lock:
    protected_material: confession | refusal | source_identity | route_secret | witness_name | checksum | unreleased_take | private_boundary | equivalent
    proof_or_absence: <proof or explicit_absence>
    requested_use: proof_anchor | public_addendum | lawful_appeal | sponsor_countercopy | management_metric | route_unlock | handler_authority | witness_protection | equivalent
  consequence_lock:
    permission_scope: private_only | named_hearing_only | anonymous_public | lawful_only | route_asset_only | emergency_only | disputed | explicit_absence
    threat_if_unused: <threat>
    shield_or_cost_or_absence: <shield cost or explicit_absence>
    future_character_or_route: <future consumer>

A character can still trust the producer while refusing a specific use. A proof can be useful while being outside promise scope. A route can open while leaving a character scar.

Branch families

The mechanism must expose these branch families through 私约承诺听证 or an equivalent rite:

Branch	Relief	Cost	Future scar
Honor privacy	trust and boundary preserved	proof gap, route cost, sponsor/archive pressure	substitute proof, route costlier, handler burden
Renegotiate consent	scoped use becomes legitimate	consent debt, notice burden, recovery cost	further notice, character route costlier
Anonymize source	use possible without exposure	source ambiguity, archive debt, weaker proof	corroboration required, contradiction pending
Protected disclosure	lawful/public hearing opens	witness payroll, inspection heat, route delay	shield required, witness route with cost
Trade promise	immediate route pressure drops	faction capture, public distrust, private capture	faction gate, hostile or costlier character route
Refuse use	breach blocked	proof gap, public/legal pressure	appeal, addendum, substitute proof required
Public breach	stronger truth or route unlocks now	trust loss, exposure, recruitability damage	hostile witness, contrition, recovery-only risk
Silent breach default	fastest desk consumes material	hidden breach hardens	hostile, unavailable, missed, blocked, recovery-only

No branch may convert a private promise into universal permission across public, lawful, sponsor, archive, management, route-asset, character, and broadcast-reality readers.

Durable states

Expected states include:

promise_states:
  - promise_unopened
  - promise_pending
  - promise_honored
  - consent_renegotiated
  - source_anonymized
  - protected_disclosure
  - promise_traded
  - use_refused
  - public_breach
  - silent_breach
  - confidant_hostile
  - handler_unavailable
  - recruit_missed
  - route_costlier
  - recovery_only

The mechanism fails if breach and honor both leave the same future character state.

Counter and route contract

Every resolution must change at least three surfaces.

counter_deltas_required:
  relief: at_least_one
  cost: at_least_one
  future_character_or_route_effect: at_least_one

Expected surfaces include confidant_trust, character_availability, recruitability, missability, witness_exposure, handler_burden, proof_legitimacy, source_ambiguity, public_receipt_distrust, sponsor_capture, archive_debt, producer_license_pressure, route_asset_access_cost, future_recovery_cost, and broadcast_reality_drift.

Default behavior

私约违背默认 fires or arms when private material is spent without a promise row, permission scope, character notice, protection/shield, or future consumer.

The default must mutate future play. Acceptable effects include hostile witness, handler unavailable, recruit missed, faction-bound character, sponsor-only proof, lawful-only proof, public-only proof, blocked route, recovery-only route, or ending scar.

Relation to existing systems

• 同意债转移线 can inherit a renegotiated promise as consent debt, but cannot erase the promise row.
• 导出证据回流分岔线 can carry a protected material forward only if the in-world promise state survives.
• 处理人负荷账本 can charge the handler cost of protection, anonymization, or apology.
• 证人报复链 can open when a breach exposes a source or witness.
• Route Assets and Custody must read whether the promise state makes the route protected, costlier, hostile, blocked, or recovery-only.

Non-goals

• Not a social sim meter.
• Not a generic trust tag.
• Not a clean proof converter.
• Not raw character-count growth.
• Not valid without named protected material, requested use, permission scope, and future route or character consumption.
• Not allowed to trigger from fixed turn count, fixed day/week interval, raw count, dashboard state, or lens-health state.