Replay Export Custody / 复盘导出羁押机制

Replay Export Custody is the mechanism that makes replayable branch results portable but unsafe. A past branch can become proof only after the game records who owns the playback, what scar travels with it, what scope restricts it, which claimant benefits, and which future route will read it.

This mechanism fills the gap between existing public packaging, recap capture, evidence carryover, and management compression. Those systems already decide how a crisis is framed or how proof returns. Replay Export Custody decides whether the replay capsule itself becomes a valid route asset or a captured false-clean object.

Core promise

A replay export is never neutral. It must answer:

Which branch is being exported, what cost would be hidden by a clean clip, who becomes playback custodian, and what future reader accepts or rejects the capsule?

Entry model

Offer this mechanism only from state pressure:

entry_state:
  trigger_kind: state_pressure
  source_branch_result_present: true
  source_branch_has_relief_or_route_access: true
  source_branch_has_scar_or_omitted_cost: true
  export_request_present: true
  claimant_count_min: 2
  future_reader_present: true
  no_fixed_turn_trigger: true

Valid source branches include:

• resolved or captured stability packages;
• public recap states with scars;
• evidence carryover proof that has current route value;
• management compression reports with source debt;
• route-asset custody outcomes;
• fan oxygen receipt branches;
• inspector holds;
• editor checksum splits;
• sponsor makegood or bridge outcomes;
• archive signatures that changed future legality.

Primary objects

• 复盘导出匣 stores source branch, scar, export claimants, assignment slots, future reader, and default author.
• 复盘导出验讫 resolves scope, seal, trade, exposure, quarantine, refusal, or clean-clip default.
• 复盘匣误归属默认 hardens when another claimant exports first or the player files a clean clip.

State machine

replay_capsule_state:
  hidden: source branch exists but no export request has made it playable
  capsule_open: capsule enters hand or docket with claimants and future reader
  scoped: replay can be used only inside a named scope and with visible scar
  sealed: replay survives as lawful/archive/inspector proof but narrows public use
  traded: replay lowers immediate pressure by giving a claimant leverage
  exposed: replay becomes public proof and arms witness/consent/sponsor cost
  quarantined: replay is preserved but blocked until proof or consent is filled
  held_private: export refused; source branch protected but future reader unserved
  misattributed: wrong author or clean clip claims the branch
  captured: another faction controls future use
  false_clean: scar hidden; later routes treat the replay as suspect or hostile
  recovery_only: future use requires addendum, appeal, or substitute proof
  blocked: future reader cannot use this capsule

Claimant model

At least two claimants must contest the replay. Useful claimants include:

• sponsor: wants liability-safe proof, naming safety, or crisis relief evidence;
• editor: wants checksum-safe playback, continuity smoothing, or patch legitimacy;
• inspector/archive: wants lawful proof, admissibility, sealed scope, or hold authority;
• fan public: wants raw proof, oxygen receipt, mourning receipt, or witness legitimacy;
• management: wants case-study yield, metric proof, or debt compression;
• producer: wants route access without making every scar public;
• route-asset claimant: wants the replay to confirm or contest custody.

Branch families

Scope replay

Records the source branch with a scar and a named reader scope.

Typical result: route access becomes possible but costlier; sponsor pressure or handler burden rises.

Seal replay

Makes the capsule lawful-only, archive-only, or inspector-only.

Typical result: admissibility improves while public receipt distrust and archive debt rise.

Trade replay

Uses the capsule as leverage with a sponsor, editor, archive desk, inspector, or claimant.

Typical result: immediate pressure drops while contract capture, source ambiguity, or route asset integrity worsens.

Expose replay

Publishes the replay through fan-public, historian, pirate relay, or public table.

Typical result: public legitimacy rises while witness exposure, consent debt, and sponsor retaliation rise.

Quarantine replay

Preserves the capsule and blocks use until proof, consent, or counter-branch is resolved.

Typical result: misattribution risk drops while schedule pressure and future clearance cost rise.

Refuse export

Protects the source branch from reuse but fails the future reader.

Typical result: consent violation risk drops while route delay and claimant pressure rise.

Clean clip default

Lets another claimant file first or exports only useful footage.

Typical result: 复盘匣误归属默认 hardens and the capsule becomes misattributed, captured, false-clean, recovery-only, or blocked.

Required deltas

Every resolved branch must mutate at least one relief, one cost, and one future route or slot state.

resolution_contract:
  relief_min: 1
  cost_min: 1
  future_effect_min: 1
  capsule_state_changes: true
  source_scar_visibility_recorded: true

Expected surfaces:

• replay_capsule_legibility
• replay_capsule_capture_pressure
• source_scar_visibility
• public_receipt_legitimacy
• public_receipt_distrust
• sponsor_stop_loss_pressure
• contract_capture
• edit_debt
• source_ambiguity
• inspection_heat
• bureau_favor_debt
• fan_oxygen_resentment
• witness_exposure
• consent_debt
• management_pressure
• route_asset_integrity
• future_clearance_cost
• broadcast_reality_drift

Future reader contract

A capsule must name a future reader before it can resolve. Valid readers include:

• public recap qualification;
• stability package queue;
• evidence carryover fork;
• route-asset custody rite;
• management compression desk;
• lawful appeal or archive table;
• sponsor gate;
• fan-public receipt table;
• editor checksum route;
• broadcast reality drift audit;
• character recruit, miss, hostile, or protection branch.

The mechanism fails if a replay export changes only immediate pressure, mood, or summary wording.

Replay evidence expectation

mechanic_id: storyteller.mechanic.replay_export_custody.v1
session_id: replay-export-custody-v1-<timestamp>
seed: <deterministic_seed>
entry_state:
  trigger_kind: state_pressure
  source_branch_result_present: true
  source_branch_has_relief_or_route_access: true
  source_branch_has_scar_or_omitted_cost: true
  export_request_present: true
  claimant_count_min: 2
  future_reader_present: true
offered:
  card: storyteller.card.replay_export_capsule.v1
  rite: storyteller.rite.replay_export_attestation.v1
capsule:
  source_surface: <id>
  source_branch_id: <id>
  source_relief: <relief>
  source_scar: <scar>
  requesting_claimant: <claimant>
  requested_use: <use>
  future_reader: <reader>
branch_run:
  selected_posture: scope_replay | seal_replay | trade_replay | expose_replay | quarantine_replay | refuse_export | clean_clip_default
  assigned:
    playback_custodian_or_absence: <value>
    proof_anchor_or_absence: <value>
    consent_scope_or_absence: <value>
    counter_branch_or_absence: <value>
    bridge_or_cost: <value>
  capsule_state_after: <state>
  future_route_effect: <effect>
  counter_deltas: {}
default:
  emitted_event: storyteller.event.replay_capsule_misattribution_default.v1 | none

Non-goals

• Not a save/load feature.
• Not a dashboard evidence page.
• Not a generic recap or public package choice.
• Not a clean export that erases source scars.
• Not a fixed turn-count, day-count, or chapter-count trigger.
• Not valid unless future play consumes the resulting capsule state.