Route Loadout Compatibility / 路线装配兼容机制

Route Loadout Compatibility treats a multi-asset route bundle as its own custody surface.

The existing mesh can already prove that a route asset is fresh, maintained, discontinued with a register, scarred, reconciled across ledgers, or carried forward from prior evidence. This mechanism covers the next edge: several individually valid assets may still become invalid when loaded into the same route at the same time.

A route must not unlock only because every slot has some asset. It must prove that the selected assets can coexist for the requested reader, proof claim, custodian, carrier, and future route effect.

Design promise

A valid implementation makes route loadout compatibility playable:

• requested route or rite is visible;
• at least two required asset slots are visible;
• each candidate asset has state, custodian, source surface, and scope;
• at least one compatibility risk or explicit no-risk row is visible;
• harmed reader or claimant is visible or explicitly absent;
• the player can reconcile, swap, narrow, split, quarantine, sacrifice, or default;
• future play reads the resulting loadout state.

The mechanism fails if route readiness is raw asset count, generic inventory validity, or a clean bundle flag.

Entry rule

Open this mechanic only from state pressure:

entry_state_required:
  trigger_kind: state_pressure
  requested_route_or_rite_present: true
  required_asset_slots_min: 2
  asset_candidates_present_or_explicit_absence: true
  asset_states_visible: true
  asset_custodians_visible_or_explicit_absence: true
  future_route_or_reader_consumes_loadout_state: true
  at_least_one_pair_has_compatibility_risk_or_explicit_no_risk: true
  player_can_assign_reconciliation_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_asset_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Valid requested uses include route unlock, correction slot, public table, lawful bridge, sponsor package, fan refund lane, archive readback, editor release, memorial recovery, route asset bridge, or equivalent.

Canonical state object

路线装配清单 is the canonical row for this mechanic.

route_loadout_state:
  request:
    requested_route_or_rite: <id>
    requested_clean_claim: <claim>
    future_reader: <reader>
  slots:
    slot_count_min: 2
    slot_rows:
      - slot_id: <slot>
        required_role: <role>
        candidate_asset: <asset or explicit_absence>
        asset_state_before: <state>
        custodian_or_absence: <custodian or explicit_absence>
        accepted_scope: <scope or explicit_absence>
  compatibility:
    conflict_kind: <kind or explicit_no_risk>
    conflicting_slots: []
    harmed_reader_or_claimant: <reader claimant or explicit_absence>
    loadout_state_before: draft | proposed_clean | incompatible | contested | underfilled | captured | explicit_absence
  resolution:
    selected_posture: reconcile_with_scope | swap_asset | narrow_route_use | split_loadout | quarantine_combination | sacrifice_slot | allow_incompatible_default
    loadout_state_after: compatible_with_scope | substituted | narrowed | split_required | quarantined | slot_sacrificed | false_compatible | captured | blocked | recovery_only | equivalent
    future_route_effect: <effect>

Compatibility risks

The mechanic should recognize at least these risk families:

• reader_scope_mismatch — one asset is public-only, lawful-only, sponsor-only, fan-only, or archive-only while the route requests another reader.
• custody_owner_mismatch — two assets require incompatible custodians or owners.
• proof_truth_mismatch — two proofs certify incompatible source truths.
• checksum_vs_archive — editor checksum and archive copy do not certify the same object.
• sponsor_vs_public — sponsor release is loaded as public truth or public consent.
• lawful_vs_artist_boundary — lawful permission is loaded as artist, voice, or memorial consent.
• witness_protection_vs_publicity — a protected witness is loaded into a public package without protection.
• carrier_capacity_mismatch — one carrier is assigned incompatible custody duties.
• stale_asset_loaded_as_fresh — route asset maintenance state is ignored.
• false_owner_loadout — false-owner custody is treated as valid ownership.

Playable operations

路线装配对表 exposes these operations:

Operation	Immediate relief	Required cost
Reconcile with scope	route opens with legible boundaries	handler burden, inspection heat, public distrust, sponsor pressure, or proof exposure
Swap asset	incompatible pair is replaced	old asset stales, substitute wears, route cost rises, or claimant objects
Narrow route use	one reader/use can proceed	excluded reader resentment, future reconciliation cost, or route narrowing
Split loadout	incompatible readers proceed separately	schedule pressure, source ambiguity, carrier burden, or correction cost
Quarantine combination	false compatibility is blocked	delay, sponsor pressure, fan resentment, or recovery-only gate
Sacrifice slot	higher-value route survives	sacrificed asset lost, hostile, captured, or recovery-only
Incompatible default	fastest narrator files clean bundle	durable false-compatible, captured, hostile, blocked, or recovery-only state

Transition rules

1. Individual validity is not bundle validity

A route asset can be fresh or lawful alone and still fail beside another asset. Implementation must not consume asset_available as bundle_compatible.

2. Reader scope travels per slot

If one slot is public-only and another is lawful-only, a clean shared route requires a bridge, split, or narrowed use.

3. Custody owners cannot be merged silently

Archive, editor, sponsor, fan, artist, witness, and route-asset custodians must remain visible. A single package cannot imply all owners agreed.

4. Swap does not delete residue

The removed asset must become stale, unselected with notice, recovery-only, hostile, or still available with a named reason. It cannot vanish from consequences.

5. Default is durable

不兼容装配默认 must fire or arm when a future route consumes a multi-asset bundle without manifest, conflict, harmed reader, bridge, and future state.

Counter contract

Every branch must mutate at least three counters or durable states: one relief, one cost, and one future route effect.

Suggested surfaces:

• loadout_integrity
• asset_slot_pressure
• compatibility_conflict
• route_asset_integrity
• custody_clarity
• handler_burden
• carrier_burden
• inspection_heat
• sponsor_stop_loss_pressure
• fan_oxygen_resentment
• public_receipt_legitimacy
• public_receipt_distrust
• archive_debt
• edit_debt
• source_ambiguity
• broadcast_reality_drift
• future_route_acceptance
• recovery_route_cost

Integration rules

• With 路线资产维护分诊线, stale, frozen, degraded, or recovery-only assets must not be loaded as fresh.
• With 路线停办登记线, stopped routes may provide salvage floors but not clean route slots unless the register permits it.
• With 危机台账对表线, a ledger conversion may supply one slot but cannot make all other slots compatible.
• With 伤痕汇流台线, a scarred stabilizer may be a required slot but not a universal clean key.
• With 排名流羁押线, the loadout must preserve which reader receives the bundled proof first.
• With 制作人抗辩召回线, the reason for bundling assets may later become an alibi row.

Replay evidence shape

mechanic_id: storyteller.mechanic.route_loadout_compatibility.v1
session_id: lens-route-loadout-compatibility-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  requested_route_or_rite_present: true
  required_asset_slots_min: 2
  asset_states_visible: true
  compatibility_risk_or_explicit_no_risk_visible: true
  harmed_reader_or_claimant_visible_or_explicit_absence: true
  future_route_or_reader_consumes_loadout_state: true
  no_fixed_turn_trigger: true
objects:
  manifest: storyteller.card.route_loadout_manifest.v1
  rite: storyteller.rite.route_loadout_reconciliation.v1
branch_runs:
  compatible_branch:
    selected_posture: reconcile_with_scope | swap_asset | narrow_route_use | split_loadout | quarantine_combination | sacrifice_slot
    loadout_state_after: <state>
    future_route_effect: <effect>
    counter_deltas:
      relief: []
      cost: []
      future: []
  default_branch:
    selected_posture: allow_incompatible_default
    event_seen_or_armed: storyteller.event.incompatible_loadout_default.v1
    default_actor: <actor>
    false_compatibility_claim: <claim>
    loadout_state_after: false_compatible | captured | hostile | blocked | recovery_only
    future_route_effect: <effect>
assertions:
  - individual_asset_validity_not_bundle_validity
  - slot_scope_and_custodian_visible
  - compatibility_conflict_or_explicit_no_risk_visible
  - branch_postures_diverge
  - success_has_cost
  - default_is_durable
  - future_route_consumes_loadout_state
  - no_raw_asset_count_or_fixed_turn_trigger

Non-goals

• Not an inventory screen.
• Not a raw asset-count gate.
• Not a universal build optimizer.
• Not a dashboard or governance page.
• Not a fixed sequence checkpoint.
• Not a replacement for maintenance, discontinuance, ledger reconciliation, scar convergence, feed ranking, claimant collision, or reader collision systems.
• Not valid unless multi-asset compatibility changes route access, reader scope, custody state, bridge requirements, or recovery cost.

Downstream afteruse

Route Loadout Afteruse Receipt applies after this mechanism has already produced a manifest result and another reader attempts to reuse that result. This keeps the original compatibility check separate from later citation, route bridge, stale-slot, split-reader, quarantine, or false-clean afteruse consequences.