Protected Witness Payroll / 受保护证人薪册机制

Protected Witness Payroll is the mechanism for the moment after Storyteller successfully creates a useful witness, carrier, follower, or route asset and then has to keep that person alive, paid, believable, and usable.

The recent archive/custody surface can now create enforceable orders, aftershock ledgers, claimant locks, and low-rank logistics assets. The remaining playable gap is maintenance pressure: a protected person is not solved merely because they were recruited once. Someone must fund shelter, decide who can know the safe name, handle sponsor retaliation, satisfy inspectors, and prevent the witness from becoming a hostile claimant.

This mechanism converts recruited or protected people into ongoing management/RPG pressure without using fixed turn counts.

Mechanism entry

Open or update a protected-witness payroll when all of the following are true:

1. a prior branch created, recruited, protected, exposed, or partially relied on a witness, follower, carrier, public receipt holder, low-rank staffer, editor source, fan queue delegate, archive clerk, memorial claimant, or equivalent route asset;
2. the person can still alter a future rite, route, proof chain, public receipt, archive order, or broadcast reality state;
3. at least one ongoing support requirement is unresolved: money, shelter, oath, alias, escort, editor masking, audit protection, fan mutual aid, sponsor quiet payment, or public apology;
4. at least two factions can benefit from paying, exposing, capturing, suppressing, or discrediting the person;
5. the person has not already reached a terminal state such as final disappearance, clean discharge, terminal hostile witness, or irreversible capture.

Valid source states include recruited, protected, route_asset, public_witness_recruited, carrier_protected_under_oath, runner_protected_under_oath, receipt_publicly_split, witness_route_asset, hostile, captured, missed, sacrificed, or equivalent.

Primary design problem

Route assets currently become valuable through custody rulings and logistics rites. Without a payroll layer, every recruited witness risks becoming a free permanent key or a one-scene casualty. This mechanism keeps the human cost visible:

• a witness needs cash, shelter, and a handler;
• an alias lowers retaliation but can damage public legitimacy;
• audit protection raises inspection heat or bureau favor debt;
• fan protection can stabilize public receipt while increasing oxygen liability;
• sponsor quiet money can save a slot and make the witness contract-captured;
• suppression can buy silence and harden a future hostile claimant.

Core objects

A satisfying implementation should expose equivalent versions of:

• a roster card that records protected people, support state, owed cost, claimant pressure, and next risk;
• an assignable triage rite that allocates pay source, shelter/cover, handler, and claimant pressure;
• a leak or retaliation event that fires when support is missing, hidden, captured, or publicly contradicted;
• durable follower states used by future routes and route-asset custody checks.

Payroll state machine

State	Meaning	Required playable consequence
payroll_unopened	A protected person exists but no support roster is active.	A triage, leak, capture, or hostile path remains possible.
payroll_due	Support cost is visible and unpaid.	The player must pay, defer, publish, shelter, audit, mask, sponsor, or abandon.
sheltered	Safe location or escort exists.	Retaliation risk decreases while capacity, leak, or favor cost rises.
paid_route_asset	The person is paid/protected enough to remain assignable.	Future rites can use them; payroll leak or debt remains visible.
audit_protected	Inspector/archive oath protects the person.	Admissibility improves while inspection heat or bureau favor debt rises.
public_shelter	Fan/public witness network protects the person.	Public legitimacy improves while fan oxygen liability, sponsor pressure, or exposure rises.
sponsor_retained	Sponsor or manager funds silence/shelter.	Immediate slot pressure falls while contract capture or public distrust rises.
masked_by_edit	Editor/black-box hides identity or cuts around them.	Retaliation risk falls while edit debt, drift, or archive doubt rises.
payroll_deferred	Support is delayed with explicit cost.	Immediate resource pressure falls while future breach difficulty rises.
unpaid_hostile	Unpaid or exposed person turns against the player.	Creates hostile witness, leak, duplicate claim, or recovery-only route.
captured_witness	Another faction controls the person.	Future use requires rescue, exchange, counterproof, or suppression.
witness_disappeared	The person is missed, hidden too well, or lost.	A future rite loses a carrier/witness option and one pressure counter rises.
sacrificed_witness	The player burns the person to protect a stronger route.	Short-term relief appears; long-term legitimacy/custody debt rises.

Support slots

A payroll triage must not be satisfied by assigning a famous actor alone. It needs all slots or explicit absence:

• roster: the protected-witness payroll or equivalent support surface;
• person: witness, runner, follower, carrier, clerk, fan delegate, editor source, or explicit missing/hostile/captured state;
• handler: manager, inspector, historian, editor, security, sponsor liaison, or explicit no-handler failure;
• support: cash, safe room, fan oxygen support, audit oath, sponsor retainer, alias, edit mask, escort, apology, or explicit no-support failure;
• claimant_pressure: sponsor, inspector, archive desk, fan public, editor, false owner, pirate relay, artist boundary, or equivalent.

Branch contract

Branch A — Pay and shelter

The player spends money, safehouse capacity, security escort, or staff favor to keep the person assignable.

Expected outcome:

• payroll_state = sheltered or paid_route_asset;
• witness_retaliation_risk, custody_gap, or route_asset_pressure decreases;
• cash_reserve, safehouse_capacity, payroll_leak, favor_debt, or inspection_heat worsens.

Branch B — Oath and audit protection

The player uses Han Yanshuang, Inspector Rhee, archive seal, lawful oath, or custody proof to protect admissibility.

Expected outcome:

• payroll_state = audit_protected;
• archive_signature_legitimacy, custody_clarity, or public_witness_legitimacy improves;
• inspection_heat, bureau_favor_debt, sponsor_stop_loss_pressure, or archive_debt rises.

Branch C — Public shelter through fan or historian network

The player uses Yu Lan, fan oxygen queue, public receipt, pirate relay, or witness chain to make harm politically expensive.

Expected outcome:

• payroll_state = public_shelter;
• public_receipt_legitimacy, fan_oxygen_balance, or audience_stability improves;
• fan_oxygen_liability, sponsor_stop_loss_pressure, inspection_heat, pirate_exposure, or witness_retaliation_risk rises.

Branch D — Sponsor retainer or managed quiet

The player accepts sponsor/manager money or contract cover to keep the person quiet and housed.

Expected outcome:

• payroll_state = sponsor_retained or payroll_deferred;
• immediate slot, money, or retaliation pressure decreases;
• contract_capture, public_receipt_distrust, witness_loyalty_doubt, future_blackmail_cost, or fan_oxygen_resentment rises.

Branch E — Editorial mask or identity cut

The player uses Baiya, black-box cut, alias, redaction, checksum, or source edit to hide the person.

Expected outcome:

• payroll_state = masked_by_edit;
• witness exposure or retaliation risk decreases;
• edit_debt, reality_drift, archive_debt, public_receipt_distrust, or future_fraud_cost rises.

Branch F — Abandon, suppress, sell, or sacrifice

The player lacks support, hides the roster, lets claimant pressure reach the person, sells them to a sponsor/archive desk, or burns them to protect another route.

Expected outcome:

• payroll_state = unpaid_hostile, captured_witness, witness_disappeared, or sacrificed_witness;
• a leak, retaliation, duplicate claim, hostile testimony, false owner, or blocked future rite appears;
• at least three counters or durable states change.

Counter contract

Every payroll resolution or breach must move at least three counters or durable states. At least one must be visible relief and at least one must be visible cost.

Primary states:

• witness_payroll_due
• cash_reserve
• safehouse_capacity
• payroll_leak
• follower_morale
• witness_loyalty_doubt
• witness_retaliation_risk
• public_witness_legitimacy
• public_receipt_legitimacy
• public_receipt_distrust
• fan_oxygen_balance
• fan_oxygen_liability
• fan_oxygen_resentment
• inspection_heat
• bureau_favor_debt
• archive_signature_legitimacy
• archive_debt
• custody_clarity
• route_asset_pressure
• sponsor_stop_loss_pressure
• contract_capture
• edit_debt
• reality_drift
• future_blackmail_cost
• false_owner_hardening_risk

Replay evidence contract

A replay or dashboard projection must show:

mechanic: storyteller.mechanic.protected_witness_payroll.v1
source_state:
  source_storyline: archive_enforcement_docket | settlement_aftershock_ledger | claimant_collision_lock | field_logistics_runner | equivalent
  source_session_id: <session_that_created_or_exposed_the_person>
  person_state_before: recruited | protected | route_asset | hostile | captured | missed | equivalent
payroll:
  roster_state_before: payroll_unopened | payroll_due | deferred | equivalent
  person: <id_or_explicit_missing_state>
  handler: <assigned_or_absent>
  support: <assigned_or_absent>
  claimant_pressure: <active_claimant_or_absent>
branch:
  selected: pay_and_shelter | audit_protect | public_shelter | sponsor_retainer | editorial_mask | abandon_or_sacrifice
result:
  payroll_state_after: sheltered | paid_route_asset | audit_protected | public_shelter | sponsor_retained | masked_by_edit | unpaid_hostile | captured_witness | witness_disappeared | sacrificed_witness
  counter_deltas: {}
  future_route_effects:
    unlocked: []
    blocked_or_costlier: []

Non-goals

• Not a fixed-turn upkeep timer.
• Not a passive relationship meter.
• Not a generic economy page.
• Not a governance/dashboard page.
• Not a free follower-retention mechanic.
• Not a retcon of earlier recruitment success; the earlier success remains true, but its human cost becomes payable or breachable.