Signal Escrow Readback / 信号托管回读机制

Signal Escrow Readback turns a live broadcast signal repair into a custody state transition. A signal may be stabilized, split, quarantined, warehoused, delayed, or returned, but every resolution must preserve reader scope and future route effect.

The mechanism begins before the signal can be consumed as broadcast reality, proof, lawful annex, archive feed, sponsor asset, editor continuity, or fan relay evidence.

Escrow row

signal_escrow_row:
  signal_id: <stable signal id>
  affected_surface: live_broadcast | delayed_feed | archive_feed | lawful_annex | sponsor_package | editor_cut | fan_relay | route_asset | equivalent
  holder_before: <current signal holder or explicit_absence>
  custody_claim:
    claim_kind: public_receipt | lawful_archive | sponsor_warehouse | inspector_quarantine | editor_checksum | fan_relay | seizure_default | equivalent
    claimant: <actor or explicit_absence>
    proof_bridge_or_absence: public_receipt | checksum | lawful_annex | archive_row | sponsor_rider | fan_witness | explicit_absence | equivalent
  reader_scope:
    authorized_reader: public | lawful_reader | archive | sponsor | inspector | editor | fan_public | route_asset | explicit_absence
    excluded_reader: public | lawful_reader | archive | sponsor | inspector | editor | fan_public | route_asset | explicit_absence
  review:
    selected_posture: split_public_lawful_feed | sponsor_warehouse_rider | inspector_quarantine_hold | editor_checksum_delay | fan_relay_liability_scar | refuse_escrow_default
    holder_after: public_lawful_split_escrow | sponsor_warehouse_escrow | inspector_quarantine | editor_checksum_hold | fan_relay_with_scar | seized_false_clean_default | equivalent
    future_route_effect: split_feed_required | sponsor_only_costlier | quarantine_appeal_required | checksum_delay_required | fan_relay_liability_scar | recovery_only | equivalent
    counter_deltas_min: 3

The row is invalid if it stores only signal fixed, feed restored, stability +1, archive updated, or an implied all-reader repair.

State machine

State	Meaning	Required consequence
public_lawful_split_escrow	Public receipt and lawful archive both survive with separate scope.	Sponsor or route use narrows.
sponsor_warehouse_escrow	Sponsor controls the signal under a discoverable rider.	Public or lawful access becomes costlier.
inspector_quarantine	Inspector holds the signal against false-clean repair.	Appeal, audit debt, or recovery cost remains visible.
editor_checksum_hold	Editor delays release for checksum continuity.	Audience churn or edit debt rises.
fan_relay_with_scar	Fan relay receives the signal with liability attached.	Sponsor retaliation or recovery cost is durable.
seized_false_clean_default	The signal was patched without readback.	Hidden excluded reader and recovery-only future harden.

Branch contract

At least six responses must be playable or explicitly blocked:

• split public/lawful feed;
• sponsor warehouse rider;
• inspector quarantine hold;
• editor checksum delay;
• fan relay liability scar;
• refuse escrow default.

Every resolved branch must mutate holder state, authorized reader, excluded reader, relief, cost, future route effect, and at least three counter deltas.

Default conditions

Signal Escrow False-Clean Default fires or arms when:

• a signal is patched without holder before/after;
• authorized reader is recorded while excluded reader is hidden;
• proof bridge is absent but not marked explicit absence;
• sponsor, public, lawful, archive, editor, inspector, and fan readers are treated as one audience;
• a future route consumes the signal as clean after refusal;
• raw stability, day, dashboard state, or lens health declares the signal repaired.

Counter surfaces

Allowed relief surfaces include broadcast_stability, public_receipt_legitimacy, signal_fraud_pressure_down, continuity_hazard_down, and public_trust_up.

Allowed cost surfaces include sponsor_capture, route_narrowing, inspection_heat, recovery_cost, audience_churn, edit_debt, sponsor_retaliation, false_clean_signal, and hidden_excluded_reader.

Allowed future surfaces include split_feed_required, sponsor_only_costlier, quarantine_appeal_required, checksum_delay_required, fan_relay_liability_scar, named_readback_required, and recovery_only.

Non-goals

• Not a generic outage repair.
• Not a dashboard health gate.
• Not a replay export health signal.
• Not a universal public/lawful/sponsor fix.
• Not valid if the only observable mutation is a stability counter, day count, or signal_fixed flag.