Service Recipient Authority Drift / 送达受领权限漂移机制

This mechanic prevents a delivered service row from becoming valid notice merely because someone received it.

Core rule: service has two locks: delivery proof and recipient authority. A future reader may consume service only when the recipient had current authority for that reader and scope, or when the absence of authority is explicit and priced.

Mechanic boundary

This is not a replacement for:

• 容量告知送达队列线, which proves that a capacity claimant was served or omitted;
• 集体代表委任漂移线, which proves that representative authority can become stale;
• 见证承载解除线, which prevents after-service carrier reuse;
• 替代承载征调线, which tests carrier fit.

This mechanic starts when those systems create a service row and a future reader could wrongly treat the chosen recipient as authoritative.

State machine

service_recipient_authority_state_machine:
  dormant:
    meaning: no future reader is trying to consume service through a recipient
  service_row_visible:
    required:
      - source_service_row
      - service_purpose
      - intended_reader
      - selected_recipient_or_explicit_absence
      - future_reader_or_route
  authority_test_open:
    required:
      - authority_source_row_or_absence
      - authority_scope
      - authority_state_at_service
      - service_claim
      - proof_of_current_authority_or_absence
  review_open:
    offered:
      card: storyteller.card.service_recipient_authority_docket.v1
      rite: storyteller.rite.service_recipient_authority_review.v1
  resolved:
    states:
      - served_named_scope
      - reservice_required
      - split_required
      - substitute_required
      - public_only
      - lawful_only
      - sponsor_only
      - escrowed
      - quarantined
      - false_served
      - recovery_only

Entry must be caused by live state pressure. It must not be caused by fixed turn number, day/week interval, raw notice count, raw claimant count, dashboard state, lens-health state, or generic legal aftercare.

Required fields

Every implementation must expose these fields through 送达受领权限案卷 or equivalent:

fields_required:
  source_service_row_id: <row id or explicit_absence>
  source_surface: <surface>
  service_purpose: <purpose>
  intended_reader: <reader>
  affected_cohorts: []
  selected_recipient: <actor desk carrier delegate proxy or explicit_absence>
  recipient_class: <class>
  authority_source_row_or_absence: <row or explicit_absence>
  authority_scope: <scope or explicit_absence>
  authority_state_at_service: current | stale | limited | refused | proxy_only | absent | disputed | equivalent
  proof_of_current_authority_or_absence: <proof or explicit_absence>
  delivery_surface: <surface>
  service_claim: <claim>
  omitted_or_deferred_readers: []
  selected_posture: <posture>
  service_state_after: <state>
  recipient_state_after: <state>
  future_reader_or_route_effect: <effect>

If any field is absent, the absence must be explicit and must carry cost.

Branch contract

The mechanic must support at least six non-equivalent branch families plus default, or explicitly block unavailable branches with state reasons.

Branch	Required proof	Required cost	Durable result
Verify current recipient	current authority proof for named reader	proof upkeep, callback pressure	served_named_scope
Re-serve named reader	direct or corrected service proof	delay, sponsor/management pressure	reservice_required then scoped service
Split service	readers and recipient scopes separated	proof upkeep, confusion, route delay	split_required
Substitute recipient	substitute authority and carrier fit visible	legitimacy risk, exposure	substitute_required
Publicize gap	authority mismatch is made visible	public distrust, inspection heat	addendum_required
Escrow service	unsafe service paused for lawful/archive reader	archive debt, lawful-only routing	escrowed
Quarantine service	false service blocked	route delay, recovery cost	quarantined
Unauthorized default	fastest desk files recipient as enough	false service scar	false_served

No branch may create clean universal service across public, lawful, sponsor, archive, fan oxygen, access caption, route asset, management, and broadcast reality readers.

Counter surfaces

counter_surfaces:
  relief:
    - service_legibility
    - recipient_authority_integrity
    - claimant_notice_protection
    - route_asset_truthfulness
  cost:
    - service_delay
    - cohort_fracture
    - sponsor_stop_loss_pressure
    - lawful_annex_debt
    - archive_debt
    - proxy_runner_exposure
    - access_operator_exposure
    - inspection_heat
  future:
    - reservice_required
    - public_addendum_required
    - callback_required
    - route_delay
    - broadcast_reality_drift
    - recovery_only_service

Every constructive branch must mutate relief, cost, and future route state.

Default rule

When a service row is consumed without current recipient authority, 无权限受领送达默认 must fire or arm. The event must name the source service row, intended reader, selected recipient, hidden authority gap, false service claim, omitted readers, and future route effect.

Replay evidence

mechanic_evidence:
  mechanic_id: storyteller.mechanic.service_recipient_authority_drift.v1
  session_id: lens-service-recipient-authority-drift-v1-<timestamp>
  seed: <deterministic-seed>
  entry_state:
    trigger_kind: state_pressure
    source_service_row_present: true
    intended_reader_visible: true
    selected_recipient_or_explicit_absence_visible: true
    authority_state_at_service_visible: true
    future_reader_or_route_consumes_service_state: true
    no_fixed_turn_trigger: true
  branch_result:
    selected_posture: <posture>
    service_state_after: <state>
    recipient_state_after: <state>
    future_reader_or_route_effect: <effect>
    default_event_if_any: storyteller.event.unauthorized_recipient_service_default.v1 | explicit_absence
  assertions:
    - service_row_preserved_as_history
    - recipient_authority_checked_before_consumption
    - omitted_reader_survives_or_costs
    - success_has_relief_cost_and_future_effect
    - default_names_false_service_claim
    - no_universal_service_recipient