Custody Oracle Crossread / 羁押判读交叉机制

Custody Oracle Crossread is the mechanism for asking the world a dangerous question after a custody, voice, archive, memorial, stability, or route-asset branch has already produced a durable scar:

Which surface is allowed to answer what this asset currently is?

The answer is playable. It is not a lore recap, tooltip, or free state reveal. The player selects or is forced into an oracle surface, pays the surface’s cost, and receives a scoped answer that future routes may cite, contest, or punish.

Design promise

Storyteller already contains many first-order custody decisions: voice probate, availability readers, reality drift, fan oxygen mandates, stability clearance, archive dockets, and field logistics. The remaining implementation risk is that their outcomes become hidden flags. This mechanism makes a later readout explicit and costly.

A correct readout must expose:

• the prior custody or route-asset state being queried;
• the oracle surface answering it;
• who is excluded, contradicted, or made liable by that answer;
• the future route effect;
• at least one relief and one cost.

Entry predicate

Open a custody oracle crossread from state pressure only:

entry_state:
  trigger_kind: state_pressure
  prior_custody_or_route_asset_state_present: true
  future_route_requires_readable_answer: true
  oracle_surfaces_available_min: 2
  answer_can_change_route_access_or_counter_cost: true
  prior_state_not_already_clean_consensus: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_count_trigger: true

Valid prior states include memorial voice probate rows, archive custody rows, availability-reader results, reality-drift dockets, stability-clearance tables, fan oxygen ledger rows, memorial air chain rows, black-box patch rows, route assets marked protected, missed, captured, hostile, sacrificed, false_owner, public_only, lawful_only, sponsor_only, relay_only, or recovery_only.

Oracle surfaces

Each oracle is a concrete game surface, not a UI convenience.

Oracle surface	What it can answer	Cost it must threaten
Archive oracle	whether a chain is admissible, sealed, poisoned, or false-owned	inspection heat, archive debt, lawful-only routing
Public receipt oracle	whether the crowd can cite the state as public witness	sponsor pressure, witness exposure, fan liability
Cutroom checksum oracle	whether continuity can carry the state without raw exposure	edit debt, source ambiguity, public distrust
Sponsor readback oracle	whether stop-loss or contract language will treat the state as usable	contract capture, public distrust, future recovery cost
Fan oxygen oracle	whether mutual-aid memory accepts the state as paid, betrayed, or owed	fan resentment, queue retaliation, public grief volatility
Stability table oracle	whether the answer can keep the broadcast legible	stability escrow debt, clearance premium, delayed contradiction

Core state model

custody_oracle_state_any:
  - crossread_needed
  - archive_answer_scoped
  - public_answer_scoped
  - cutroom_answer_scoped
  - sponsor_answer_scoped
  - fan_oxygen_answer_scoped
  - stability_table_answer_scoped
  - split_answer_recorded
  - oracle_refused
  - false_answer_hardened
  - answer_consumed_by_future_route

The oracle answer is not complete until it is consumed by a future route, rite, event, or reader. A docket that only reveals information and changes nothing is invalid.

Branch rules

Archive answer

The player routes the query through lawful custody, archive docket, inspector seal, or white-glove verification.

state_after: archive_answer_scoped
relief_any: [custody_clarity_up, archive_signature_legitimacy_up, false_owner_pressure_down]
cost_any: [inspection_heat_up, archive_debt_up, lawful_only_routing_up]
future_effect_any: [lawful_route_opens, public_addendum_required, sponsor_claim_contested]

Public receipt answer

The player lets public witness, fan proof, historian receipt, or visible testimony answer the state.

state_after: public_answer_scoped
relief_any: [public_receipt_legitimacy_up, private_capture_blocked, audience_stability_up]
cost_any: [sponsor_stop_loss_pressure_up, witness_exposure_up, fan_oxygen_liability_up]
future_effect_any: [public_route_opens, lawful_annex_required, sponsor_route_costlier]

Cutroom checksum answer

The player asks editor/cutroom evidence to make the state legible without raw custody exposure.

state_after: cutroom_answer_scoped
relief_any: [continuity_hazard_down, immediate_slot_pressure_down, source_retaliation_risk_down]
cost_any: [edit_debt_up, source_ambiguity_up, public_receipt_distrust_up]
future_effect_any: [checksum_required, archive_reader_contests, double_reality_risk_up]

Sponsor readback answer

The player lets contract language, sponsor packaging, or stop-loss accounting answer the state.

state_after: sponsor_answer_scoped
relief_any: [sponsor_stop_loss_pressure_down, slot_pressure_down, immediate_money_pressure_down]
cost_any: [contract_capture_up, public_receipt_distrust_up, future_recovery_cost_up]
future_effect_any: [sponsor_only_route, neutrality_contested, archive_or_public_reader_hostile]

Fan oxygen answer

The player asks mutual-aid memory, queue receipts, grief ledgers, or delegate mandates to answer whether the state has social legitimacy.

state_after: fan_oxygen_answer_scoped
relief_any: [fan_oxygen_balance_up, public_grief_stability_up, public_receipt_legitimacy_up]
cost_any: [fan_oxygen_resentment_up, sponsor_pressure_up, queue_retaliation_risk_up]
future_effect_any: [fan_route_opens, lawful_route_costlier, sponsor_readback_contested]

Stability table answer

The player asks whether a version is stable enough to broadcast even when custody, proof, or public memory remains unsettled.

state_after: stability_table_answer_scoped
relief_any: [audience_churn_down, broadcast_legibility_up, schedule_pressure_down]
cost_any: [stability_escrow_debt_up, clearance_premium_up, delayed_contradiction_up]
future_effect_any: [broadcast_route_opens, future_crossread_required, drift_audit_costlier]

Split, refusal, or false answer

The player crossreads multiple surfaces, records an explicit refusal, or lets the loudest claimant answer by default.

state_after_any: [split_answer_recorded, oracle_refused, false_answer_hardened]
relief_any: [one_surface_temporarily_readable]
cost_any: [handler_burden_up, reality_drift_up, future_recovery_cost_up, excluded_reader_hostile]
future_effect_any: [recovery_only, blocked, hostile_reader, captured_or_false_owner_route]

Counter contract

Every resolved crossread must mutate at least three counters or durable states:

• custody_clarity
• archive_signature_legitimacy
• archive_debt
• inspection_heat
• public_receipt_legitimacy
• public_receipt_distrust
• fan_oxygen_balance
• fan_oxygen_resentment
• fan_oxygen_liability
• sponsor_stop_loss_pressure
• contract_capture
• continuity_hazard
• source_ambiguity
• edit_debt
• audience_stability
• audience_churn
• stability_escrow_debt
• clearance_premium
• reality_drift
• future_recovery_cost
• route_asset_pressure

Integration rules

• With Route Assets and Custody, the crossread must consume an explicit route-asset or custody state such as protected, missed, hostile, captured, false_owner, or recovery_only.
• With Archive Voice Custody, a memorial or voice answer must name why absence, consent debt, custodian chain, or false probate is still visible.
• With 可用性读者冲突线, crossread answers can become the scoped source that future readers then cite or reject.
• With 播出实在漂移审计, incompatible oracle answers can become the contradiction object.
• With 稳播托管机制, stability table answers may keep the audience watching while raising escrow debt.
• With 纪念声权验讫机制, an Iris or memorial voice answer cannot become universal permission.

Failure states

The mechanism fails if implementation allows any of these:

• route assets silently reveal their state without an oracle surface;
• one oracle answer satisfies archive, public, sponsor, fan, editor, and stability readers for free;
• public memory becomes lawful custody without annex cost;
• lawful custody becomes public legitimacy without witness cost;
• sponsor readback becomes neutral access without capture;
• checksum continuity becomes raw proof without source ambiguity;
• fan oxygen memory becomes universal consent;
• stability answer deletes reality drift instead of pricing it;
• refusal or default leaves no hostile, blocked, recovery-only, captured, or false-owner state;
• any trigger relies on fixed turn, day/week, raw content count, dashboard state, or lens health.

Non-goals

• Not a UI inspection tooltip.
• Not a lore oracle.
• Not a universal truth table.
• Not a new governance page.
• Not a free recovery mechanism.
• Not a replacement for reader collision, drift audit, stability escrow, or voice probate. It is the costly readout seam between them.