Consent Window Expiry Receipt / 同意窗口到期回执机制

Consent Window Expiry Receipt prevents scoped consent from becoming permanent permission. It opens when a consent, waiver, mandate, stay, or consent-like row is being reused after its original window, use surface, proof condition, subject posture, or reader roster has changed.

The mechanism does not ask whether the original consent was valid. It asks whether the later reader can still consume it.

Entry rule

entry_state_required:
  trigger_kind: state_pressure
  source_consent_row_present: true
  original_use_surface_visible: true
  expiry_condition_or_explicit_absence_visible: true
  attempted_future_use_visible: true
  subject_or_delegate_or_explicit_absence_visible: true
  proof_bridge_or_explicit_absence_visible: true
  excluded_reader_or_explicit_absence_visible: true
  future_reader_consumes_consent_state: true
  player_can_renew_narrow_readback_publish_escrow_substitute_quarantine_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_consent_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Valid source rows include consent debt transfer, sponsor release, fan mandate, class mandate, stay notice, broadcast contract, sponsor copy warranty, memorial consent, facility release, and route-asset custody rows.

Consent window row

consent_window_expiry_row:
  source_consent:
    source_row_id: <stable id>
    source_surface: consent_debt | fan_mandate | class_mandate | stay_notice | sponsor_copy | broadcast_contract | memorial_consent | route_asset_custody | equivalent
    original_subject_or_delegate: <subject delegate or explicit_absence>
    original_use_surface: live_air | recap_clip | sponsor_package | public_statement | lawful_annex | route_unlock | memorial_use | oxygen_haircut | equivalent
    original_reader_scope: public | lawful | sponsor | archive | fan_public | route_asset | split | explicit_absence | equivalent
    original_proof_bridge_or_absence: signature | witness_oath | public_receipt | lawful_seal | archive_stamp | checksum | sponsor_sideletter | explicit_absence | equivalent
  expiry:
    expiry_condition: one_use_only | until_rebuttal | until_release | until_public_notice | until_route_change | until_subject_readback | until_review | unknown | explicit_absence
    expiry_state_before: current | expired | stale | disputed | unsupported | hidden | explicit_absence
    review_condition_state: satisfied | unsatisfied | contested | missing | explicit_absence
  attempted_future_use:
    future_use_surface: live_air | recap_clip | mirror_relay | sponsor_afteruse | management_report | route_unlock | ending_scar | broadcast_reality | equivalent
    future_reader: <reader route desk or explicit_absence>
    beneficiary_of_false_current_consent: sponsor | management | archive | editor | producer | route_claimant | public_stability | explicit_absence
    excluded_reader_or_absence: artist | subject | fan_public | lawful_reader | sponsor | archive | witness | route_asset | explicit_absence
  result:
    selected_posture: renew_consent_window | narrow_to_original_use | fresh_subject_readback | publish_expired_scope_notice | lawful_escrow_review | substitute_current_carrier | quarantine_future_use | expired_consent_default
    consent_state_after: renewed_with_cost | original_use_only | readback_required | public_notice_required | lawful_escrowed | substitute_required | quarantined | false_current | recovery_only
    future_reader_or_route_effect: accepted_with_cost | original_use_only | notice_required | lawful_only | substitute_required | blocked | hostile | costlier | contradiction_pending | recovery_only

Rows are invalid if they record only consent ok, signature present, delegate approved, waiver active, or legal cleared.

Branch families

Renew consent window

The player obtains a current proof bridge or subject/delegate renewal.

Relief: current reader legibility rises. Cost: renewal cost, exposure, handler burden, sponsor pressure, or schedule pressure rises. Future: accepted with cost.

Narrow to original use

The player blocks off-scope reuse and preserves the original row.

Relief: false-current consent risk falls. Cost: current route delays or narrows. Future: original-use-only.

Fresh subject readback

The subject, delegate, public witness, or explicit absence is read back before future use.

Relief: consent integrity and subject agency rise. Cost: public, lawful, sponsor, schedule, or witness pressure rises. Future: accepted with readback or costlier.

Publish expired-scope notice

The expired window is made public instead of hidden.

Relief: private capture is blocked. Cost: public confusion, sponsor pressure, or witness exposure rises. Future: public notice required.

Lawful escrow review

Han Yanshuang, archive, lawful seal, or an equivalent reader holds the row until scope is reviewed.

Relief: false legal use falls. Cost: inspection heat, archive debt, lawful-only delay, or bureau debt rises. Future: lawful escrowed.

Substitute current carrier

The old carrier is replaced by a current carrier, delegate, proof holder, or explicit absence.

Relief: route can continue with named support. Cost: carrier leverage, payroll, capture risk, or handler burden rises. Future: substitute required or costlier.

Quarantine future use

The row cannot support the attempted future use.

Relief: consent laundering is blocked. Cost: route blockage, recovery pressure, or claimant hostility rises. Future: blocked or recovery-only.

Expired consent default

The future reader treats stale, scoped, or unsupported consent as current.

Relief: short pressure may drop. Cost: false-current consent, harmed reader, and future contradiction harden. Future: hostile, contradiction-pending, or recovery-only.

Counter contract

Every branch must change at least three surfaces: one relief, one cost, and one future effect.

Primary surfaces:

• consent_window_integrity
• consent_integrity
• subject_agency
• delegate_authority
• current_reader_legibility
• false_current_consent_risk
• renewal_cost
• handler_burden
• schedule_pressure
• inspection_heat
• archive_debt
• sponsor_pressure
• public_confusion
• witness_exposure
• carrier_capture_risk
• future_route_acceptance
• broadcast_reality_drift

Non-goals

• Not a calendar timer.
• Not a generic consent debt transfer.
• Not a replacement for stay notice relay or class mandate drift.
• Not valid unless a future reader consumes the consent state after expiry or scope pressure appears.