Custody Proof Chain Receipt / 羁押证据链回执机制

Custody Proof Chain Receipt is the rule that prevents a valid proof object from becoming clean universal evidence when it changes hands.

A proof object can be correct in its source scene and still unsafe in the next one. This mechanic asks the implementation to name the source holder, the carrier, the receiving reader, the transfer scope, the proof gap or explicit absence, and the future effect before a route, hearing, archive, sponsor desk, public table, or cutroom may cite the object.

Entry contract

Create the receipt only from visible state pressure:

entry_state_required:
  trigger_kind: state_pressure
  transfer_or_handoff_attempted: true
  source_proof_object_visible: true
  source_holder_or_explicit_absence: true
  carrier_or_explicit_absence: true
  receiving_reader_or_route_visible: true
  proof_gap_or_explicit_absence_visible: true
  future_reader_consumes_receipt_state: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_proof_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Valid proof objects include black-box fragments, archive shards, voice custody receipts, legal-body files, memorial licenses, fan oxygen proofs, public testimony, enforcement dockets, route-asset packets, proof-board rows, or an explicit absence that becomes stateful.

Required separations

Every active receipt must keep these fields separate:

• source proof object - the object or explicit absence being transferred.
• source holder - archive, public table, Baiya, Yu Lan, Han Yanshuang, Shen Luo, lawful desk, route asset, fan oxygen ledger, or explicit absence.
• carrier - runner, docket, corridor note, black-box checksum, legal seal, public counterstub, route asset, or explicit absence.
• receiving reader - lawful reader, archive, public table, sponsor desk, cutroom, fan oxygen audit, memorial route, recovery reader, route asset, or management report.
• transfer scope - lawful-only, archive-only, public-only, sponsor-only, split, recovery-only, blocked, or equivalent.
• proof gap - missing holder, missing carrier, missing signature, scope mismatch, stale copy, hostile counterstub, or explicit absence.
• future effect - how the next reader must handle the receipt.

The receipt fails if it stores only proof accepted, handoff done, receipt filed, or clean chain.

Branch families

seal_chain

The player seals the proof for one narrow reader.

receipt_state_after: sealed
relief_any: [proof_chain_integrity_up, archive_signature_legitimacy_up, lawful_reader_can_cite]
cost_any: [reader_scope_narrowed, public_notice_delayed, sponsor_copy_pressure_up]
future_effect_any: [lawful_only, archive_only, public_addendum_required]

split_receipt

The player preserves two custody accounts instead of pretending one reader owns all proof.

receipt_state_after: split
relief_any: [public_capture_blocked, source_holder_preserved, receiving_reader_named]
cost_any: [dual_reader_conflict_up, reconciliation_hearing_required, inspection_heat_up]
future_effect_any: [two_reader_ruling_required, split_custody_required, route_reader_costlier]

public_counterstub

A public or fan-facing counterstub makes the handoff visible without making it fully legal.

receipt_state_after: public_counterstub
relief_any: [public_receipt_legitimacy_up, hidden_transfer_risk_down]
cost_any: [lawful_annex_required, sponsor_dispute_up, inspection_heat_up]
future_effect_any: [public_only, lawful_annex_required, sponsor_reader_costlier]

lawful_annex

The player attaches a legal or white-glove annex after a gap appears.

receipt_state_after: lawful_annex
relief_any: [admissibility_up, false_clean_transfer_risk_down]
cost_any: [route_delay_up, excluded_reader_notice_required, archive_debt_up]
future_effect_any: [lawful_only, annex_required, recovery_costlier]

carrier_rebuild

The player rebuilds the path through a named carrier.

receipt_state_after: rebuilt
relief_any: [carrier_path_visible, route_asset_acceptance_up, proof_gap_named]
cost_any: [carrier_burden_up, witness_exposure_up, corridor_or_route_cost_up]
future_effect_any: [rebuilt_but_scarred, carrier_required, recovery_reader_named]

quarantine_proof

The player blocks use until a future receipt exists.

receipt_state_after: quarantined
relief_any: [false_clean_use_blocked, hidden_gap_debt_capped]
cost_any: [route_delay_up, recovery_cost_up, sponsor_or_public_pressure_up]
future_effect_any: [blocked, recovery_only, future_proof_receipt_required]

Modern observability packet

The current packet makes the rule inspectable:

• Custody Proof Receipt Docket records source proof, holder, carrier, receiving reader, scope, gap, receipt state, future effect, and false-clean default risk.
• Custody Proof Chain Review resolves seal, split, public counterstub, lawful annex, carrier rebuild, quarantine, and false-clean transfer branches.
• False-Clean Proof Transfer Default arms when a later reader consumes transferred proof while holder, carrier, scope, gap, or future effect is hidden.
• Custody Proof Chain Receipt Lens verifies that the receipt is state-triggered, branch-divergent, and future-costed.

Non-goals

• Not a generic evidence log.
• Not a fixed turn or dashboard trigger.
• Not a replacement for proof-board custody, archive enforcement, facility access, or liability handoff.
• Not valid unless a named future reader can inspect why the transferred proof is sealed, split, public-only, annexed, rebuilt, quarantined, or defaulted.