Ending Scar Ledger / 结局伤痕账本机制

Ending Scar Ledger is the mechanic that lets late-route scars change terminal eligibility.

The existing mesh can now produce scarred route assets, clean-ending custody branches, stabilization liabilities, release receipts, proxy posture breaks, public bonds, and recovery-only states. This mechanic defines how those scars are read when the game asks what ending is actually available.

It is not an ending-count framework. It is the terminal state machine for scars that already exist.

Design problem

Without this mechanic, a branch can be perfectly authored and still disappear at the end:

• sponsor clean capture changes a route asset, but the public ending ignores it;
• public countercopy survives, but private lawful closure still becomes exclusive truth;
• release receipt marks a target released_with_scar, but ending resolution treats it as clean;
• proxy testimony carries the route, then the proxy disappears from the final proof;
• split custody exists, but the ending index can only choose one owner.

This mechanic makes the scar itself a terminal object.

Core objects

Scar row

A scar row is created on 结局伤痕账本. It must carry source row, ending family, proof carrier, privileged claimant, harmed claimant, scar state, and route effect.

Eligibility hearing

结局资格听证 reads one or more scar rows and chooses a terminal posture:

• public verdict;
• private capture;
• split canon;
• recovery-only;
• reopen black box;
• block false-clean.

Scar audit

结局伤痕审计 fires when terminal resolution ignores an active scar, lets an exclusive ending overclaim, or upgrades recovery-only into clean closure.

Scar states

State	Meaning	Terminal effect
pending	The scar exists but no ending family has read it.	Ending hearing must be offered or explicit audit recorded.
clean_requested	A claimant asks to close the ending without naming the scar.	Audit can block or make the ending costlier.
underwritten	A guarantor carries the scar into terminal closure.	Ending can remain eligible with debt and call risk.
released_with_scar	A target re-enters play through release but keeps a scar.	Ending can unlock only with visible release condition.
public_only	Public proof can carry the ending but private lawful closure cannot be exclusive.	Public scar verdict or split canon becomes likely.
lawful_only	Legal or archive proof can carry the ending but public proof is narrowed.	Private clean capture or recovery-only becomes likely.
split	Two incompatible copies survive.	Split custody canon must remain eligible.
captured	One faction owns the terminal carrier.	Private capture or recovery-only; harmed claimant must be named.
false_owner	Wrong claimant hardened as owner.	Clean ending blocked until audit, recovery, or split.
recovery_only	The route can be repaired but not cleaned.	Recovery-only broadcast becomes eligible; clean closure blocked.
contradiction_pending	Black-box, public, legal, or source proof contradicts the proposed ending.	Audit or black-box reopening required.

Ending families

The mechanic currently binds four Storyteller ending families plus legacy black-box reopening:

• 公开伤痕裁决 — public proof prevents private capture while preserving visible cost.
• 私有洁净收编 — sponsor, inspector, archive, or editor custody stabilizes the version by narrowing who may speak.
• 分裂托管正典 — two incompatible copies survive as terminal canon.
• 仅可复原播出 — clean closure is blocked, but recovery hooks remain playable.
• Black Box Opened — black-box causal proof can still reopen terminal contradiction.

Terminal-posture rules

Rule 1 — Exclusive endings require claimant accounting

Any ending that privileges sponsor, inspector, archive, editor, fan public, artist, witness, pirate, producer, or black-box truth must name the harmed claimant.

The mechanic fails if exclusive truth is granted with no harmed claimant.

Rule 2 — Public proof blocks private laundering

If public receipt, fan oath, artist refusal, witness proof, pirate relay, or black-box copy survives, a private clean ending cannot be exclusive unless the public proof is formally blocked, made costlier, split, or recovery-only.

Rule 3 — Lawful capture blocks over-clean public closure

If legal seal, sponsor contract, archive lock, inspector quarantine, edit checksum, or release refusal survives, a public verdict cannot claim complete moral closure without legal, editorial, or custody scar.

Rule 4 — Split copies must remain two copies

A split ending must name at least two copy carriers and two claimants. It cannot collapse the split into a single truth at the final screen.

Rule 5 — Recovery-only is terminal, not hidden failure

A recovery-only route must leave a future hook: appeal, rescue, correction, checksum release, substitute carrier, triage repair, or black-box reopening. It cannot become clean by omission.

Rule 6 — Black box can reopen proposed closure

If black-box proof exposes an omitted claimant or causal contradiction, the ending family becomes contradiction-pending unless the black-box copy is seated as carrier.

Branch outputs

A valid resolver must produce:

mechanic: storyteller.mechanic.ending_scar_ledger.v1
scar_rows_read:
  - <scar id>
selected_terminal_posture: public_verdict | private_capture | split_canon | recovery_only | reopen_black_box | block_false_clean
ending_family_after: public_scar_verdict | private_clean_capture | split_custody_canon | recovery_only_broadcast | black_box_opened | blocked
proof_carrier_after: public_receipt | legal_seal | edit_checksum | sponsor_contract | fan_oath | proxy_testimony | pirate_relay | route_asset | black_box | explicit_absence
claimant_privileged_after: sponsor | inspector | archive | editor | fan_public | artist | witness | pirate | producer | split | none
claimant_harmed_after: sponsor | inspector | archive | editor | fan_public | artist | witness | pirate | route_claimant | public_audience | none
scar_state_after: eligible | blocked | costlier | public_only | lawful_only | split | captured | recovery_only | contradiction_pending
route_effect_after: ending_unlocked_with_scar | ending_blocked | ending_costlier | private_capture | public_audit_required | split_canon | recovery_only_terminal | contradiction_pending

Oracle assertions for executable lenses

A sibling executable lens should fail unless these claims are true in replay or data inspection:

1. State-triggered entry — ending eligibility is offered because a scar row exists, not because a turn number arrived.
2. Concrete scar row — the row records source, proof carrier, claimant privilege, harmed claimant, scar before/after, and route effect.
3. Branch divergence — public verdict, private capture, split canon, recovery-only, black-box reopening, and blocked false-clean do not collapse into the same outcome.
4. No clean laundering — an ending cannot erase release, proxy, route-asset, stabilization, public, legal, edit, sponsor, or black-box scars.
5. Ending mutation — at least one ending family becomes eligible, blocked, costlier, split, captured, or recovery-only because of the scar.
6. Audit mutation — 结局伤痕审计 changes ending eligibility or proof carrier state when contradiction is ignored.
7. Multi-session inheritance — a scar produced by an earlier source session can later be read by terminal resolution with seed/session provenance.

Replay/session evidence shape

mechanic: storyteller.mechanic.ending_scar_ledger.v1
session_id: lens-storyteller-ending-scar-ledger-v1-<timestamp>
seed: <deterministic-seed>
source_scar:
  source_storyline: stabilization_liability_handoff | clean_ending_seizure_cascade | recourse_collection_release | proxy_posture_chain | equivalent
  source_session_id: <id>
  source_seed: <seed>
  source_row_id: <ticket, docket, receipt, proxy row, route asset, event, or proof object>
ledger_row_before:
  scar_id: <id>
  ending_family: <candidate>
  proof_carrier: <carrier>
  claimant_privileged: <claimant>
  claimant_harmed: <claimant>
  scar_state_before: <state>
hearing:
  offered_rite: storyteller.rite.ending_eligibility_hearing.v1
  selected_terminal_posture: public_verdict | private_capture | split_canon | recovery_only | reopen_black_box | block_false_clean
ledger_row_after:
  ending_family_after: <family>
  scar_state_after: <state>
  route_effect_after: <effect>
audit:
  emitted_event: storyteller.event.ending_scar_audit.v1 | none_if_valid
assertions:
  state_triggered_entry: true
  concrete_scar_row: true
  branch_non_equivalence: true
  no_clean_laundering: true
  ending_mutation: true
  multi_session_inheritance: true

Non-goals

• Not a count-growth target.
• Not an ending registry for placeholder outcomes.
• Not a morality score.
• Not a fixed final-turn phase.
• Not a way to make every ending available.
• Not governance content.