Recovery Indemnity Shelf / 复原追偿搁架机制

Recovery Indemnity Shelf is a cross-pressure mechanic for assigning future recourse after a recovery row, sponsor afteruse object, archive proof, or claimant receipt has been used to stabilize a route.

The design gap it closes is specific: 复原库存分诊机制 can decide which finite recovery row is spent; 赞助后用引证机制 can stop sponsor proof from becoming a clean universal key; Route Assets and Custody can track custody states. This mechanic asks the next question: when that decision later fails or is recalled, who receives the claim?

If the answer is hidden, a sponsor, archive, management desk, ward queue, or absent handler can silently move liability onto a worker, claimant body, public trust, or producer license. The mechanic makes that transfer playable and replay-checkable.

Core objects

Shelf card

复原追偿搁架 records the source scar, proposed holder, protected reader, burdened reader, recall trigger, holder state, shelf state, and future route effect.

Assignment rite

复原追偿指派 chooses sponsor retention, producer underwriting, archive escrow, public/fan trust, worker protected refusal, split recourse, quarantine, or default.

Default event

复原追偿默认 fires or arms when recourse is hidden, falsely cleaned, moved onto an absent holder, or assigned to a worker/claimant without protection.

State-triggered entry

Open this mechanic when all conditions are true:

entry_state:
  trigger_kind: state_pressure
  source_object_present: true
  source_object_kind: recovery_inventory_row | sponsor_afteruse_citation | archive_custody_proof | claimant_floor_receipt | management_clean_report | equivalent
  source_scar_present_or_explicit_absence: true
  proposed_or_missing_indemnity_holder_visible: true
  protected_reader_present: true
  burdened_or_excluded_reader_present_or_explicit_absence: true
  future_recall_reader_present: true
  player_can_assign_split_escrow_refuse_quarantine_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The mechanic fails if it opens from fixed sequence position, day/week interval, chapter quota, raw content count, lens health, generic legal review, or generic sponsor anger.

Indemnity holder vocabulary

Valid or equivalent holders:

• sponsor
• producer_license
• archive_escrow
• ward_queue
• public_fan_trust
• worker_carrier
• claimant_body
• inspector_escrow
• explicit_absence

A holder is not valid unless the mechanic records its state before and after assignment.

Holder states

Accepted holder states:

• protected
• exposed
• coerced
• captured
• hostile
• absent
• escrow_witness
• public_trust_witness
• route_asset_indemnity_witness
• false_owner
• recovery_only

The mechanic fails if a low-rank worker, claimant, or archive copy silently absorbs the shelf without a state change.

Reader states

Accepted or equivalent reader states:

• accepted_with_cost
• sponsor_only
• lawful_only
• public_only
• artist_boundary_only
• worker_testimony_armed
• claimant_hostile
• worker_hostile
• split_required
• checksum_required
• route_costlier
• blocked
• recovery_only
• contradiction_pending

At least two readers must end in different states.

Branch model

Branch	Relief	Cost	Future effect
Sponsor retains	worker/claimant burden blocked	sponsor pressure or contract capture rises	sponsor recall or sponsor-only route
Producer underwrites	route has named backer	license encumbrance, inspection heat, management pressure	route costlier, accepted with cost
Archive escrow	lawful proof can review source	archive debt, public delay, checksum pressure	lawful-only or checksum-required
Public/fan trust	public memory or refund path visible	sponsor pressure, fan resentment, inspection heat	public-only or refund audit
Worker protected refusal	worker not silent liability sink	handler burden, payroll leak, inspection exposure	worker testimony or route-asset witness
Split recourse	immediate route partly unblocks	source ambiguity, archive debt, hostile reader	split-required or contradiction pending
Quarantine source	unsafe transfer blocked	current route blocks, pressure rises	blocked, recovery-only, lawful-after-review
Default shelving	immediate metric or slot may close	burden hidden, false-clean hardened	worker hostile, claimant hostile, sponsor-only, lawful-only, public-only, blocked, recovery-only

No branch can create universal acceptance across sponsor, lawful/archive, public/fan, artist-boundary, worker, claimant, management, and route-asset readers.

Worker route requirement

At least one implementation path must make worker or claimant liability concrete. Valid worker/claimant outcomes include:

• 交接链跑腿 becomes route_asset_indemnity_witness, coerced_indemnity_signer, or hostile_recourse_witness;
• 首接保全员 becomes archive_escrow_witness, sponsor_burdened_worker, indemnity_absent_signer, or hostile_recourse_witness;
• a claimant row becomes claimant_burdened_body, recovery_only_claimant, or claimant_hostile;
• a worker/claimant is explicitly protected by refusal or escrow and a cost rises elsewhere.

The mechanic fails if worker or claimant liability is only implied in prose.

Counter contract

Every branch, including default, must mutate at least three surfaces: relief, cost, and future route/reader effect.

counter_surfaces:
  relief:
    - worker_burden_blocked
    - source_trace_preserved
    - public_receipt_legitimacy
    - lawful_reader_review
    - false_clean_assignment_blocked
  cost:
    - sponsor_stop_loss_pressure
    - contract_capture
    - producer_license_encumbrance
    - archive_debt
    - inspection_heat
    - fan_oxygen_resentment
    - worker_coercion_risk
    - payroll_leak
    - handler_burden
    - claimant_body_burden
    - source_ambiguity
  future:
    - sponsor_only
    - lawful_only
    - public_only
    - artist_boundary_only
    - worker_testimony_armed
    - claimant_hostile
    - worker_hostile
    - route_costlier
    - blocked
    - recovery_only
    - contradiction_pending

Replay evidence shape

mechanic_id: storyteller.mechanic.recovery_indemnity_shelf.v1
session_id: lens-recovery-indemnity-shelf-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  source_object_present: true
  source_scar_present_or_explicit_absence: true
  proposed_or_missing_indemnity_holder_visible: true
  protected_reader_present: true
  burdened_or_excluded_reader_present_or_explicit_absence: true
  future_recall_reader_present: true
  no_fixed_turn_trigger: true
offered:
  card: storyteller.card.recovery_indemnity_shelf.v1
  rite: storyteller.rite.recovery_indemnity_assignment.v1
branch_runs:
  assignment_branch:
    selected_branch: sponsor_retains | producer_underwrites | archive_escrow | public_fan_trust | worker_protected_refusal | split_recourse | quarantine_source
    holder_state_after: <state>
    protected_reader_state_after: <state>
    burdened_reader_state_after: <different state>
    shelf_state_after: <state>
    future_route_effect: <effect>
    counter_deltas:
      relief: []
      cost: []
      future: []
  default_branch:
    event_seen_or_armed: storyteller.event.recovery_indemnity_default.v1
    default_actor: <actor>
    captured_holder: <holder>
    false_clean_claim: <claim>
    burdened_or_hidden_reader: <reader>
    future_route_effect: <effect>
assertions:
  - source_scar_visible
  - proposed_holder_visible_or_absent
  - protected_and_burdened_readers_visible
  - holder_state_mutates
  - readers_diverge
  - success_has_cost
  - worker_or_claimant_liability_is_not_silent
  - default_names_false_clean_claim_and_burdened_reader
  - future_recall_reader_consumes_shelf
  - no_fixed_turn_trigger

Non-goals

• Not a governance page.
• Not abstract insurance.
• Not a generic legal review.
• Not a sponsor cleanup route.
• Not a replacement for recovery inventory or sponsor afteruse.
• Not valid unless the shelf changes future playable state.