Three-Key Custody Collision / 三钥羁押撞锁机制

Three-Key Custody Collision is the mechanism for assets that require three different authorities to move: sponsor liability, inspection admissibility, and cutroom/source custody.

It sits after single-pressure systems have already armed their claims. 播出破产账本机制 can make sponsor default or collateral pressure visible; 剪辑室优先队列机制 can make source scarcity visible; 叙述优先栈机制 can show who speaks first. This mechanism asks a narrower playable question:

Can the asset be released when sponsor, inspection, and cutroom do not all hold the same version of custody?

Mechanic promise

When a route asset, proof object, edit copy, voice object, memorial package, correction version, public record, or lawful record needs all three keys, the implementation must make the three authorities visible before release, seizure, lockout, or recovery-only mutation.

The player must be able to seat all three keys with debt, release through two keys while excluding the third, split or escrow the keys, quarantine/blackout the asset, or suffer lockout.

The mechanism fails if a sponsor, inspector, or editor silently approves the asset for everyone.

Inputs

Accept rows from:

• 播出破产账本机制 when a sponsor, creditor, or stop-loss row can fund, brand, freeze, cancel, or seize the asset;
• 剪辑室优先队列机制 when an edit lane, source copy, checksum, or final cut is scarce;
• 叙述优先栈机制 when rival narrators target the same asset version;
• 认领撞锁 when incompatible owners cannot both hold the asset;
• Custody and Proof and Route Assets and Custody when the asset has custody, proof, or route-state consequences.

State model

Every active collision row is written to 三钥羁押案卷. Minimal state:

three_key_collision:
  asset_id: <asset>
  shared_target_version: <version>
  sponsor_key:
    holder: sponsor | manager | funder | naming_rights_desk | explicit_absence
    state: key_unasked | key_offered | key_refused | key_seated | key_split | key_escrowed | key_counterfeit | key_hostile | key_missing
    power: fund | freeze | brand | insure | cancel | default | collateralize | explicit_absence
  inspection_key:
    holder: inspector | archive | white_glove | legal_seal | explicit_absence
    state: key_unasked | key_offered | key_refused | key_seated | key_split | key_escrowed | key_counterfeit | key_hostile | key_seized | key_missing
    power: admit | quarantine | seize | demand_token | reject | seal | explicit_absence
  cutroom_key:
    holder: editor | source_custodian | black_box | checksum_holder | explicit_absence
    state: key_unasked | key_offered | key_refused | key_seated | key_split | key_escrowed | key_counterfeit | key_hostile | key_missing
    power: checksum | withhold | split_copy | redact | source_release | reveal_counterfeit | explicit_absence
  excluded_holder: <holder>
  proposed_release_pattern: sponsor_inspection | sponsor_cutroom | inspection_cutroom | split_three_key | escrow_and_delay | quarantine | blackout_fold | no_valid_release
  default_if_ignored: sponsor_capture | inspection_seizure | editor_withhold | counterfeit_key | route_asset_lockout | blackout_fold | recovery_only
  future_route_effect: protected | costlier | captured | lawful_only | public_only | split_canon | contradiction_pending | recovery_only | hostile | blocked

Resolution rules

Rule 1 — All three keys can seat only with debt

A complete release is valid only if it writes at least one debt/scar surface: sponsor escrow debt, inspection heat, edit debt, public distrust, route-asset liability, or future correction cost.

Rule 2 — Two-key release must name the excluded key

A sponsor-inspection release must name cutroom/source harm. A sponsor-cutroom release must name inspection/admissibility harm. An inspection-cutroom release must name sponsor/funding/public-liability harm.

Rule 3 — Split keys preserve contradiction

When keys are split, the asset cannot be treated as clean. The resulting state must be split_canon, contradiction_pending, costlier, or equivalent.

Rule 4 — Escrow and quarantine are real outcomes

Escrow or quarantine can be correct play if release would create false ownership. It must preserve proof while adding schedule, public, sponsor, inspection, or black-screen cost.

Rule 5 — Missing keys default into lockout

If a release is attempted with a hidden missing key, counterfeit key, or broken split term, 三钥羁押锁死 fires or becomes default-ready.

Counter and durable-state deltas

Every resolved collision changes at least three surfaces, chosen from:

• route_asset_pressure
• sponsor_stop_loss_pressure
• sponsor_escrow_debt
• inspection_heat
• archive_fraud
• lawful_admissibility
• edit_debt
• source_ambiguity
• checksum_challenge
• contract_capture
• public_receipt_legitimacy
• public_grief_stability
• fan_oxygen_liability
• slot_pressure
• broadcast_reality_drift
• black_screen_pressure
• recovery_route_cost

At least one delta must be relief and at least one must be cost.

Integration notes

• A sponsor default narrator from insolvency should become a sponsor key if the same asset also needs source or lawful custody.
• A cutroom priority row should become a cutroom key when its selected row controls a route asset, proof object, or public/lawful version.
• An inspector voice-token or archive-seal demand should become an inspection key when release without it would create fraud, quarantine, seizure, or lawful-only state.
• Narration priority may decide who speaks first, but this mechanism decides whether the object can move after the voices are armed.
• Route asset systems must inherit protected, costlier, captured, lawful_only, public_only, split_canon, contradiction_pending, recovery_only, hostile, or blocked states.

Non-goals

• Not a governance approval matrix.
• Not a generic checklist.
• Not an initiative order.
• Not a turn phase.
• Not a raw content-count expansion.
• Not valid if every key holder is automatically satisfied.
• Not valid if lockout has no route-state consequence.