Recovery Counterstub Provenance / 复原副签来源机制

Recovery Counterstub Provenance is the mechanism that turns a scarce recovery inventory row’s low-rank signoff into playable custody pressure.

复原库存分诊机制 already says a recovery row is finite. 赞助后用引证机制 already says a sponsor source is not a universal receipt. This mechanism covers the seam between them: when a row is later cited, released, archived, or reallocated, the system must know who held the counterstub, who is being blamed, who is excluded, and which future reader consumes the scar.

Primary observation link

This mechanism observes pressure from:

• 复原库存分诊线;
• 赞助后用引证线;
• 归档执行案卷;
• 认领人现场接待线;
• Live Floor Crew Load;
• Route Assets and Custody;
• Broadcast Schedule;
• Fan Oxygen.

It is observed through:

• 复原副签案卷;
• 复原副签听证;
• 复原副签替罪默认.

Design rule

A worker counterstub is not a clean institutional signature.

A counterstub may prove that an inventory row moved, but it does not prove that every reader accepted the move. Sponsor, archive, public, fan oxygen, ward, artist-boundary, lawful, management, and route-asset readers may require different surfaces. If one reader uses the counterstub, the holder and excluded reader remain visible.

Entry contract

Open this mechanism only when all of the following are true or explicitly absent:

entry_state:
  trigger_kind: state_pressure
  source_inventory_row_present_or_explicit_absence: true
  counterstub_contested_or_missing_or_blameable: true
  afteruse_or_archive_or_reallocation_claim_present: true
  competing_claims_min: 2
  desired_reader_present: true
  excluded_or_blamed_reader_present_or_explicit_absence: true
  future_route_effect_pending: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Valid claim collisions include:

• sponsor afteruse wants a recovery row to prove a package, refund, makegood, stop-loss, or commercial release;
• archive enforcement wants the original stub or a custody-locked scan;
• ward or fan oxygen wants the row returned to recovery use;
• management wants the row filed as used, available, or worker-faulted;
• a route asset depends on whether the row is accepted, split, quarantined, refused, or marked recovery-only.

Invalid entries:

• fixed sequence position;
• generic legal review;
• generic sponsor pressure;
• generic inventory scarcity with no holder, missing stub, afteruse claim, or blamed reader;
• raw content count, dashboard, board sync, or lens health.

Counterstub state model

counterstub_row:
  counterstub_id: <stable id or explicit_absence>
  inventory_id: <recovery inventory row id or explicit_absence>
  holder_or_absence: <worker/handler/faction/explicit_absence>
  holder_state: protected | recruited | missed | hostile | unavailable | blamed | coerced | explicit_absence | equivalent
  source: paper_stub | archive_scan | sponsor_copy | fan_queue_copy | ward_log | edit_checksum | oral_witness | explicit_absence | equivalent
  signature_pressure: voluntary | protected | coerced | bribed | blamed | absent | unknown | equivalent
  state_before: unsigned | held | copied | split | overwritten | missing | quarantined | surrendered | scapegoated | sponsor_captured | archive_locked | equivalent
  state_after: held | split | archived | sponsored | quarantined | refused | missing | locked_default | equivalent

The model fails if it stores only a boolean signed, released, approved, or worker_fault.

Claim model

claim_collision:
  desired_reader: sponsor_reader | archive_reader | lawful_reader | public_reader | fan_oxygen_reader | ward_reader | artist_boundary_reader | management_reader | route_asset_reader | equivalent
  desired_use: cite_afteruse | release_inventory | archive_original | public_footnote | lawful_proof | ward_recovery | fan_oxygen_refund | metric_report | route_unlock | equivalent
  minimum_surface: <surface>
  excluded_or_blamed_reader: <reader or worker or explicit_absence>
  false_clean_claim_if_unworked: worker_signed_release | inventory_was_available | sponsor_settled_row | archive_scan_is_original | recovery_clean | lawful_proof_clean | route_safe | equivalent

At least two claims must be present, or one claim plus meaningful explicit absence of holder/source/reader that changes default risk.

Resolution modes

Mode	Required effect
protect_holder	holder becomes protected, recruited, or available; false clean use is blocked or narrowed
split_counterstub	two readers receive scoped truths; ambiguity, proof burden, or distrust rises
archive_lock	original or lawful proof is preserved; sponsor/schedule/ward/public route pays delay or cost
sponsor_release	sponsor receives a scoped release; public/lawful/worker/ward reader remains hostile, narrowed, or scarred
recovery_reallocate	row returns to recovery use; proof or sponsor afteruse route becomes blocked, costlier, or recovery-only
refuse_false_stub	unsafe or coerced stub is rejected; immediate pressure rises and future contradiction remains visible
default_selects	institution files first; scapegoat default records actor, false claim, excluded reader, and future scar

No mode can produce universal acceptance across sponsor, archive, public, ward, fan oxygen, lawful, artist-boundary, management, and route-asset readers.

Output contract

Every branch must output:

branch_output:
  selected_mode: protect_holder | split_counterstub | archive_lock | sponsor_release | recovery_reallocate | refuse_false_stub | default_selects
  recovery_row: <inventory id or explicit_absence>
  counterstub_state_after: <state>
  holder_state_after: <state>
  desired_reader_state_after: <state>
  excluded_or_blamed_reader_state_after: <different state or explicit_absence>
  future_route_effect: accepted_with_counterstub | split_required | worker_protected | sponsor_only | archive_only | lawful_only | public_only | recovery_only | blocked | costlier | scapegoat_default | equivalent
  counter_deltas:
    relief: []
    cost: []
    future: []

At least one relief, one cost, and one future reader or route effect must be present. A branch that only lowers pressure or spends money is invalid.

Default contract

复原副签替罪默认 must fire or arm if:

• no counterstub docket exists when a row is cited;
• the holder is unnamed;
• the holder is blamed without signature pressure and excluded reader state;
• a sponsor release, archive scan, edit checksum, ward log, or management report becomes clean proof;
• the row is consumed while the holder’s state is missed, hostile, unavailable, coerced, or absent;
• the future route effect is hidden.

The default must mutate future play, not just money.

Replay evidence shape

mechanic_id: storyteller.mechanic.recovery_counterstub_provenance.v1
session_id: lens-recovery-counterstub-provenance-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  source_inventory_row_present_or_explicit_absence: true
  counterstub_contested_or_missing_or_blameable: true
  afteruse_or_archive_or_reallocation_claim_present: true
  competing_claims_min: 2
  no_fixed_turn_trigger: true
docket: storyteller.card.recovery_counterstub_docket.v1
rite: storyteller.rite.recovery_counterstub_hearing.v1
branch_runs:
  resolved_branch:
    selected_mode: protect_holder | split_counterstub | archive_lock | sponsor_release | recovery_reallocate | refuse_false_stub
    holder_state_after: <state>
    desired_reader_state_after: <state>
    excluded_or_blamed_reader_state_after: <different state>
    future_route_effect: <effect>
    counter_deltas: {}
  default_branch:
    event_seen_or_armed: storyteller.event.recovery_counterstub_scapegoat_default.v1
    capture_actor: <actor>
    false_clean_claim: <claim>
    future_route_effect: <effect>
assertions:
  entry_state_driven: true
  holder_and_reader_named: true
  branch_non_equivalence: true
  success_has_future_cost: true
  scapegoat_default_mutates_future_play: true
  no_fixed_turn_trigger: true

Non-goals

• Not a generic labor-protection policy page.
• Not governance content.
• Not a replacement for recovery inventory triage.
• Not a replacement for sponsor afteruse citation.
• Not a raw worker morale system.
• Not a clean archive stamp.
• Not a fixed upkeep phase.