Fan Token Custody / 应援凭证羁押机制

Fan Token Custody makes fan-held proof objects playable as route assets without converting Storyteller into a merch economy.

The existing mesh has strong fan-facing pressure through 粉丝委任分裂线, 被排除者反回执挑战线, Oxygen Claim Exchange Storyline, 直播现场通行瓶颈线, 回顾分发漂移线, and 路线装配兼容线. The gap this mechanism covers is the object layer: the wristband, queue stub, lightstick pulse log, photocard checksum, memorial sticker, caption tag, refund stamp, relay chip, or sponsor coupon that a later route tries to treat as proof.

Mechanism promise

A fan token can prove something only for a named source, holder, scope, and future reader. It cannot be a universal clean key.

The mechanism is valid when it forces all of the following into play:

1. source fan claim;
2. token kind and instance or batch;
3. holder and custodian or explicit absence;
4. claimed use;
5. authentication state;
6. represented fans;
7. excluded or missing fans;
8. beneficiary of clean token;
9. harmed reader or claimant;
10. future route or reader;
11. branch with relief, cost, and future effect.

State-triggered entry

Open this mechanism only when all required state is visible:

entry_state_required:
  trigger_kind: state_pressure
  source_surface_present: true
  token_instance_or_batch_present: true
  claimed_use_present: true
  holder_visible_or_explicit_absence: true
  custodian_visible_or_explicit_absence: true
  authentication_state_visible: true
  represented_fans_visible: true
  excluded_or_missing_fans_visible_or_explicit_absence: true
  beneficiary_of_clean_token_visible_or_explicit_absence: true
  future_reader_or_route_consumes_token_state: true
  player_can_authenticate_attest_split_recall_quarantine_trade_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_token_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Valid entry examples:

• an oxygen ledger wants to accept wristbands as claims;
• an egress ledger cites lightstick pulse logs for who reached a bottleneck;
• a delegate mandate uses photocard stamps as proof of constituency;
• a counterreceipt arrives through mismatched refund stamps;
• a recap fragment is authenticated by fan token packets;
• a feed-ranking or mirror route cites relay chips or fan packets;
• a route loadout tries to bundle fan tokens with lawful, sponsor, or editor proof;
• a sponsor replaces public tokens with coupons and calls the replacement closure.

Core card, rite, and event

• 应援凭证羁押案卷 records the token and its proof claim.
• 应援凭证验真桌 resolves holder, custodian, scope, proof, addendum, and future reader.
• 应援凭证伪造默认 fires or arms when a token is consumed as clean proof without scope.

Token state machine

token_states:
  intake:
    - unverified
    - authenticated
    - batch_scoped
    - duplicate_seen
    - sponsor_issued
    - fan_made
    - forged
    - recalled
    - quarantined
    - recovery_only
  after_resolution:
    - authenticated_with_scope
    - fan_attested
    - batch_scoped
    - split_token_line
    - sponsor_issued_only
    - access_only
    - refund_only
    - public_receipt_only
    - route_asset_bounded
    - quarantined
    - recalled_with_addendum
    - duplicate_contested
    - forged_hostile
    - recovery_only
invalid_states:
  - clean_universal
  - all_fans_represented_by_absence
  - sponsor_coupon_as_public_receipt_without_addendum
  - pirate_chip_as_lawful_proof_without_bridge

Branch families

1. Authenticate with scope

Use when a token is valid, but only for a bounded source, holder, and reader.

Relief: route proof becomes legible. Cost: excluded holders require notice, addendum, or later claim. Future: token cannot be reused outside scope.

2. Fan-attest token line

Use when formal custody is weak but fan proof can be publicly attested.

Relief: private capture falls. Cost: witness, delegate, public distrust, or retaliation pressure rises. Future: public-only or protected-payroll route.

3. Split token batch

Use when one batch carries incompatible meanings: access, refund, oxygen, public receipt, sponsor coupon, or route asset.

Relief: incompatible readers stop overwriting each other. Cost: fan resentment and source ambiguity rise. Future: split-required or reader-only token lines.

4. Recall with addendum

Use when tokens are duplicated, compromised, or over-issued, but recall cannot erase old proof.

Relief: counterfeit pressure falls. Cost: sponsor, oxygen, public receipt, or inspection pressure rises. Future: addendum-required, oxygen-recheck, or recovery-only if ignored.

5. Quarantine duplicate

Use when a duplicate token line threatens route contamination.

Relief: false clean proof is blocked. Cost: route delay and excluded-holder pressure rise. Future: audit-required or recovery-only if consumed.

6. Trade token relief

Use when the token can satisfy money/access/oxygen pressure but not public truth.

Relief: immediate pressure falls. Cost: contract capture or public distrust rises. Future: sponsor-only, refund-only, access-only, or public counterreceipt armed.

7. Counterfeit default

Use when the producer hides or skips the table.

Relief: fastest desk gets temporary silence. Cost: token line becomes forged, hostile, contested, or recovery-only. Future: 应援凭证伪造默认 mutates route state.

Reader scope rules

A fan token must be narrowed before any route consumes it.

Claimed use	Minimum proof	Common false-clean failure	Valid future states
Oxygen claim	holder plus source ledger	wristband batch clears all oxygen debt	oxygen recheck, scoped credit, hostile holders
Access or egress	holder plus route/time/node	lightstick log proves safe exit for everyone	access recheck, public safety addendum, recovery-only
Delegate mandate	token line plus constituency	photocard stamp becomes universal consent	split mandate, public-only, lawful-only
Public receipt	token plus source claim	sponsor coupon replaces fan receipt	addendum required, counterreceipt armed
Recap proof	token plus fragment source	fan packet becomes whole-recap proof	disputed fragment, public audit required
Route loadout	token plus compatibility row	token bundles cleanly with lawful/sponsor proof	bounded route asset, loadout blocked, recovery-only
Feed or mirror ranking	token plus distribution scope	relay chip counts as public/lawful proof everywhere	feed contamination, mirror-only, public-only

Counter contract

Every non-default branch mutates at least three durable surfaces:

counter_deltas_required:
  relief: at_least_one
  cost: at_least_one
  future_reader_or_route_effect: at_least_one
candidate_surfaces:
  - token_legitimacy
  - token_custody_clarity
  - fan_oxygen_balance
  - fan_oxygen_resentment
  - public_receipt_legitimacy
  - public_receipt_distrust
  - excluded_fan_recognition
  - access_caption_pressure
  - sponsor_stop_loss_pressure
  - contract_capture
  - route_asset_integrity
  - feed_ranking_contamination
  - recap_fragment_legibility
  - archive_debt
  - inspection_heat
  - source_ambiguity
  - handler_burden
  - future_recovery_cost

Missability and recovery

The mechanism is missed when implementation treats fan-held tokens as ambient collectibles, evidence flavor, or clean inventory.

Miss states:

• token_used_as_clean_proof_without_docket;
• token_batch_scope_hidden;
• excluded_token_holders_erased;
• sponsor_coupon_misfiled_as_public_receipt;
• pirate_chip_misfiled_as_lawful_proof;
• duplicate_token_quietly_consumed;
• token_recall_without_addendum;
• route_loadout_consumes_unscoped_fan_token.

Recovery costs:

• late authentication table;
• fan attestation hearing;
• token-scope addendum;
• duplicate quarantine;
• oxygen recheck;
• access-caption or egress recheck;
• public counterreceipt;
• sponsor unwind;
• route asset recovery-only marking.

Replay evidence shape

mechanic_id: storyteller.mechanic.fan_token_custody.v1
session_id: lens-fan-token-custody-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  source_surface: <surface>
  token_instance_or_batch_present: true
  claimed_use_present: true
  holder_visible_or_explicit_absence: true
  authentication_state_visible: true
  excluded_or_missing_fans_visible_or_explicit_absence: true
  future_reader_or_route_consumes_token_state: true
  no_fixed_turn_trigger: true
offered:
  card: storyteller.card.fan_token_custody_docket.v1
  rite: storyteller.rite.fan_token_authentication_table.v1
branch_result:
  selected_posture: authenticate_with_scope | fan_attest_token_line | split_token_batch | recall_with_addendum | quarantine_duplicate | trade_token_relief | accept_counterfeit_default
  token_state_after: <state>
  represented_fans_after: <scope>
  excluded_or_missing_fans_after: <scope or explicit_absence>
  future_reader_or_route_effect: <effect>
  emitted_event: storyteller.event.fan_token_counterfeit_default.v1 | none
  counter_deltas:
    relief: []
    cost: []
    future: []
assertions:
  token_is_not_universal_clean_key: true
  holder_and_scope_visible: true
  excluded_holders_visible_or_explicit_absence: true
  branch_results_diverge: true
  future_reader_consumes_state: true
  no_raw_count_or_fixed_turn_trigger: true

Non-goals

• Not a merch shop.
• Not a rarity or gacha system.
• Not a social-media popularity surface.
• Not a replacement for fan delegate, counterreceipt, oxygen exchange, egress, recap drift, feed ranking, or route loadout systems.
• Not valid unless a token’s proof scope changes future play.