Stabilization Liability Handoff / 稳定化责任交接机制

Stabilization Liability Handoff is the mechanism that converts any successful stabilization, scoped readback, or callback-bearing relief into a durable liability object before a later route can treat it as clean closure.

It sits after source mechanisms such as 播出合约回读机制, 回叫消费证明机制, 观众稳定性下限, and 播出实在漂移. It feeds downstream mechanisms such as 派系责任承保机制, 担保追偿优先级机制, 追偿放行机制, 代理人姿态链机制, 制作分诊台机制, and Route Assets and Custody.

It is not a finance layer. It is an anti-cleanup rule: when survival depends on scope, callback memory, public bond, lawful seal, edit checksum, sponsor patch, proxy body, or route-asset custody, the carrier and future call must be visible.

Canonical state flow

source_branch_resolves:
  eligible_source_any:
    - broadcast_contract_readback
    - callback_consumption_proof
    - audience_stability_floor
    - broadcast_reality_drift_audit
    - public_receipt
    - sponsor_patch
    - edit_checksum
    - proxy_row
    - route_asset_custody
  creates_or_updates: storyteller.card.stabilization_liability_ticket.v1
  requires:
    - source_row_id
    - stabilized_or_scoped_object_id
    - relief_claimed
    - beneficiary
    - harmed_or_owed_claimant_or_explicit_absence
    - carrier_or_explicit_absence
    - maturity_trigger
    - scar_after_source
    - future_route_or_reader_effect
handoff_rite_resolves:
  offered_rite: storyteller.rite.stabilization_liability_handoff.v1
  branches:
    - underwrite
    - recourse
    - proxy
    - public_bond
    - production_carry
    - refuse_or_false_clean
maturity_or_failure:
  emits_or_records: storyteller.event.stabilization_debt_recall.v1
  mutates_one_or_more:
    - liability_underwriting
    - guarantee_recourse
    - collection_release
    - proxy_posture
    - public_receipt
    - callback_debt
    - reader_scope
    - route_asset_custody
    - production_triage
    - broadcast_reality

No part of this state flow is triggered by a fixed numbered turn, day, week, raw count, dashboard state, or lens-health state.

Eligible source contract

A source surface is eligible when it produces immediate relief and a deferred cost.

Readback source

A readback source must expose:

readback_source_required:
  source_surface: broadcast_contract_readback
  prior_contract_row: <row id or explicit_absence>
  current_reader: <reader>
  scope_delta: <inside_scope | reader_mismatch | proof_mismatch | excluded_reader_returns | equivalent>
  readback_state_after: accepted_inside_scope | accepted_with_addendum | split_required | proof_rehearing_required | claimant_unwind_required | escrow_required | blocked | default_armed | equivalent
  harmed_or_excluded_reader: <reader or explicit_absence>
  future_route_effect: accepted_with_scope | addendum_required | split_canon | contradiction_pending | blocked_until_proof | sponsor_only | lawful_only | public_only | blocked | hostile | recovery_only | equivalent

A readback result becomes a ticket when any future route wants to cite the scoped result as authority.

Callback source

A callback source must expose:

callback_source_required:
  source_surface: callback_consumption_proof
  source_relief_row: <row id or explicit_absence>
  callback_state_after: accepted_with_callback | callback_required | reader_scoped | debt_published | quarantined | waived_with_named_harm | false_clean_laundered | blocked | recovery_only | equivalent
  owed_reader_or_absence: <reader or explicit_absence>
  excluded_or_deferred_reader_or_absence: <reader or explicit_absence>
  callback_carrier_or_absence: <carrier or explicit_absence>
  proof_bridge_or_absence: <proof or explicit_absence>
  future_reader_effect: accepted_with_callback | callback_required | costlier | public_only | lawful_only | sponsor_only | split_required | contradiction_pending | blocked | hostile | recovery_only | false_clean_relief | equivalent

A callback result becomes a ticket when relief is accepted but the callback can still be called, challenged, waived, or laundered.

Stabilization source

Audience, broadcast-reality, public receipt, fan bridge, sponsor patch, edit checksum, release, facility, proxy, or route asset sources remain eligible when they name a stabilized object and deferred claimant.

A generic pressure down state is invalid.

Ticket creation rule

Whenever an eligible source improves a live surface while deferring a cost, create or update 稳定化责任票据.

Minimum payload:

ticket_id: <stable id>
source:
  source_surface: broadcast_contract_readback | callback_consumption_proof | audience_stability_floor | broadcast_reality_drift_audit | public_receipt | sponsor_patch | edit_checksum | route_asset_custody | equivalent
  source_row_id: <row id>
  source_state_after: <state>
  source_session_id: <session id if inherited>
  source_seed: <seed if inherited>
stabilized_or_scoped_object:
  object_id: <slot, proof object, public version, receipt, room, route asset, proxy row, callback relief row, legal seal, or schedule lane>
  object_family: slot_scope | callback_relief | public_version | proof_object | public_receipt | facility_room | route_asset | proxy_row | fan_oxygen_pool | legal_seal | schedule_lane
relief_claimed:
  - <immediate relief>
beneficiary: producer | sponsor | inspector | archive | editor | fan_public | artist | witness | pirate | route_claimant | lawful_reader | public_reader | split
harmed_or_owed_claimant: sponsor | inspector | archive | editor | fan_public | artist | witness | pirate | route_claimant | public_audience | lawful_reader | excluded_reader | owed_reader | none
carrier: sponsor_escrow | inspector_surety | edit_checksum | public_bond | fan_refund | route_asset | proxy | handler_time | production_lane | facility_room | callback_carrier | proof_bridge | none
handoff_state: unassigned | escrowed | underwritten | routed_to_recourse | proxy_carried | production_carried | public_bonded | disputed | matured | recalled | recovery_only
maturity_trigger: contradiction | audit | sponsor_stop_loss | fan_refund | witness_leak | checksum_challenge | room_collision | release_challenge | callback_call | reader_challenge | proof_rehearing | blackout | manual_review
scar_after_source: <durable scar>
future_route_effect: unlocked_with_debt | costlier | public_only | lawful_only | sponsor_only | split_required | captured | hostile | blocked | recovery_only | recall_pending

The rule fails if the row only records stabilized, accepted, relief granted, money paid, slot authorized, or a generic counter.

Handoff sinks

Underwriting sink

Use when guarantor, collateral, harmed claimant, and call trigger exist.

handoff_state_after: underwritten
creates_or_updates: storyteller.card.liability_underwriting_ledger.v1
must_record:
  - guarantor
  - collateral_type
  - harmed_or_owed_claimant
  - call_trigger
  - future_route_effect

Recourse sink

Use when a claimant can call the cost against a target.

handoff_state_after: routed_to_recourse
creates_or_updates_any:
  - storyteller.card.guarantee_recourse_docket.v1
  - storyteller.card.collection_release_receipt.v1
must_record:
  - collectible_target
  - priority_or_release_condition
  - harmed_party
  - scar

Proxy sink

Use when a person carries the stabilized or scoped version.

handoff_state_after: proxy_carried
creates_or_updates: storyteller.card.proxy_posture_docket.v1
must_record:
  - proxy_id
  - requested_role
  - claimant
  - risk_if_used
  - future_route_effect

Public or fan bond sink

Use when public receipt, fan oxygen, witness proof, pirate relay, or public oath carries the cost.

handoff_state_after: public_bonded
must_record:
  - public_object
  - refund_or_correction_trigger
  - exposed_witness_or_public_claimant
  - private_route_blocked_or_costlier

Production carry sink

Use when no outside carrier accepts the cost and production absorbs it.

handoff_state_after: production_carried
creates_or_updates_any:
  - production_triage_ticket
  - lane_scar
  - handler_fatigue
  - unstaffed_crisis_risk
  - black_screen_pressure

Recall sink

Use when the ticket is false-clean, unassigned, rejected, or challenged.

handoff_state_after: recalled | recovery_only
emits_or_records: storyteller.event.stabilization_debt_recall.v1
must_mutate_one_or_more:
  - route_block
  - recourse_target
  - proxy_break
  - public_refund
  - callback_call
  - reader_challenge
  - edit_checksum_reopen
  - lawful_appeal
  - production_default

Invariants

• Every scoped, callback-bearing, or stabilized success has a named carrier or explicit absence.
• A carrier must be a faction, person, room, route asset, proof object, public bond, callback carrier, production lane, or explicit none.
• Every ticket has a maturity trigger.
• Readback scope and callback debt must remain visible after handoff.
• Every branch improves or preserves one surface while worsening, committing, or narrowing another.
• Underwriting, recourse, proxy, public bond, production carry, and recall branches cannot collapse into equivalent outcomes.
• Recovery can reduce harm, but it cannot erase the scar created by the source.
• Clean stabilization, clean readback, or clean callback relief without a ticket or explicit refusal is invalid.

Counter and state deltas

Valid relief deltas include:

• audience_stability_up;
• reality_drift_down;
• slot_legibility_up;
• readback_scope_legible_up;
• callback_legitimacy_up;
• public_receipt_legitimacy_up;
• lawful_use_up;
• route_access_up;
• custody_clarity_up;
• sponsor_default_pressure_down.

Valid cost deltas include:

• callback_debt_up;
• owed_reader_hostility_up;
• excluded_reader_pressure_up;
• inspection_heat_up;
• bureau_favor_debt_up;
• edit_debt_up;
• source_ambiguity_up;
• fan_refund_trigger_armed;
• witness_exposure_up;
• route_asset_pressure_up;
• proxy_hostility_armed;
• lane_scar_up;
• handler_fatigue_up;
• black_screen_slots_up;
• future_route_costlier.

Failure conditions

The mechanism fails if:

• an eligible source succeeds without creating or updating a ticket or explicitly refusing one;
• the ticket omits source row, stabilized or scoped object, beneficiary, harmed or owed claimant, carrier, maturity trigger, scar, and future route effect;
• a readback result is later cited without preserving scope delta and harmed reader;
• callback-bearing relief is later cited without preserving owed reader and carrier/proof bridge;
• a source branch uses only a generic counter and no object;
• a handoff branch has no downstream mutation;
• recall is flavor-only;
• recovery makes the source clean;
• any trigger is based on fixed timing, raw counts, dashboard state, or lens health.

Non-goals

• Not a global debt dashboard.
• Not governance.
• Not raw balance tuning.
• Not a generic failure queue.
• Not a replacement for broadcast readback, callback consumption, audience stability, drift audit, underwriting, recourse, release, proxy posture, facility access, custody, or production triage.
• Not satisfied by page existence; it must be observable through ticket, handoff branch, recall/default, and future state mutation.