Witness Recantation Reliance / 证词翻供信赖机制

Witness Recantation Reliance is the mechanism that prevents old accepted testimony from remaining a clean key after the witness, operator, caption witness, delegate, or proof carrier changes state.

It sits after testimony formation and witness danger. 操作员证词合议线 can create multi-operator proof. 字幕证词羁押线 can make caption testimony a route object. 证人报复链 can make a witness captured, hostile, protected, masked, or disappeared. This mechanism tests the downstream reliance seam: a future route must read that changed state before citing the old proof.

Canonical state flow

accepted_testimony_exists:
  eligible_source_any:
    - operator_witness_conclave
    - caption_witness_custody
    - access_caption_reliance
    - recap_syndication_drift
    - callback_carrier_collision
    - protected_witness_payroll
    - witness_reprisal_chain
    - equivalent
  requires:
    - source_proof_id
    - accepted_by_reader
    - accepted_state_before
    - witness_id_or_explicit_absence
    - future_reader_or_route
witness_state_changes:
  creates_or_updates: storyteller.card.witness_recantation_ledger.v1
  requires:
    - state_change_source
    - new_statement_state
    - reliance_reader
    - omitted_or_harmed_reader_or_explicit_absence
    - proof_gap_or_explicit_absence
future_reliance_attempt:
  offered_rite: storyteller.rite.witness_reliability_rehearing.v1
  branches:
    - corroborate
    - narrow_scope
    - publish_correction
    - protect_recantation
    - substitute_proof
    - quarantine_reliance
    - default_clean_reuse
missing_or_false_rehearing:
  emits_or_records: storyteller.event.clean_testimony_reuse_default.v1

No part of this flow is triggered by fixed turn count, fixed day/week, raw testimony count, relationship score, dashboard state, or lens health.

Eligible source contract

A source proof is eligible when all are true:

eligible_source_required:
  source_proof_id: <stable row>
  source_surface: operator_witness_conclave | caption_witness_custody | access_caption_reliance | recap_syndication | callback_carrier_collision | protected_witness_payroll | equivalent
  accepted_by_reader: sponsor | public | lawful_reader | archive | fan_public | route_asset | broadcast_reality | split | equivalent
  accepted_state_before: accepted | accepted_with_scar | public_only | lawful_only | sponsor_only | caption_only | split_required | protected | quarantined | equivalent
  witness_or_carrier_visible_or_explicit_absent: true
  future_reader_or_route_consumes_source: true

A generic proof flag is invalid. The source must name who accepted it and which future route or reader would reuse it.

State-change contract

A witness state change can come from reprisal, protection, sponsor capture, lawful pressure, public contradiction, checksum challenge, archive order, route asset claim, caption context update, operator dissent, or equivalent.

state_change_required:
  witness_id_or_absence: <witness or explicit_absence>
  witness_state_before: protected | recruited | retained | suppressed | captured | hostile | disappeared | public_shelter | audit_protected | masked_by_edit | explicit_absence | equivalent
  state_change_source: reprisal | counterproof | lawful_pressure | sponsor_capture | public_contradiction | edit_checksum | archive_order | route_asset_claim | caption_context_update | operator_dissent | equivalent
  new_statement_state: upheld | narrowed | corrected | retracted | contradicted | coerced_silence | unavailable | hostile_counterstatement | explicit_absence | equivalent
  proof_gap_or_absence: context_missing | caption_context_gap | service_gap | chain_gap | coercion_gap | source_scope_gap | explicit_absence

The mechanism fails if a witness becomes captured, hostile, disappeared, retracted, or narrowed but future proof reuse remains clean by default.

Ledger creation rule

Create or update 证词翻供账本 whenever:

• old testimony remains route-relevant;
• witness or carrier state changes;
• new reliance reader differs from, exceeds, or depends on the old acceptance;
• omitted or harmed reader is present or explicitly absent;
• a route could be unlocked, blocked, or made costlier by the changed statement.

The ledger row is not optional flavor. It is the object future readers consume.

Rehearing branch contract

证词可靠性复听 must make branch outcomes non-equivalent.

Branch	Relief	Cost	Future effect
Corroborate	route keeps proof basis	witness exposure, annex/archive debt, handler burden	upheld_with_scar, costlier
Narrow scope	one reader can rely	omitted reader hostility, source ambiguity	public_only, lawful_only, sponsor_only, caption_only, split_required
Publish correction	later readers are not misled	sponsor/inspection/public pressure	correction_required, public_audit_required
Protect recantation	coercion or capture is blocked	witness safety debt, delay, handler burden	witness_protection_required, lawful_bridge_required
Substitute proof	route continues on new basis	substitute scar, ambiguity, archive debt	proof_substitution_scar, recheck_required
Quarantine reliance	false proof reuse blocked	route delay, schedule/fan/sponsor pressure	blocked, quarantined, recovery_only_if_ignored
Default clean reuse	immediate burden drops	false-clean proof hardens	hostile, blocked, recovery_only

Every non-default branch must mutate at least one relief surface, one cost surface, and one future reader or route effect.

Future reader consumption

A valid implementation must prove that a future reader consumes the row before accepting route progress.

future_consumption_required:
  future_reader_or_route_present: true
  consumed_recantation_state_any:
    - upheld_with_scar
    - scope_narrowed
    - correction_required
    - witness_protection_required
    - proof_substitution_scar
    - quarantined
    - false_clean_reuse
    - blocked
    - hostile
    - recovery_only
  route_effect_after_read: <effect>

The mechanism fails if a route unlocks from the old witness proof while ignoring the ledger.

Counter and state deltas

Valid relief deltas include:

• testimony_reliability_up
• route_access_preserved
• false_clean_reuse_blocked
• public_receipt_legitimacy_up
• broadcast_reality_drift_down
• witness_coercion_risk_down

Valid cost deltas include:

• source_ambiguity_up
• witness_safety_debt_up
• witness_exposure_up
• omitted_reader_hostility_up
• access_caption_pressure_up
• sponsor_stop_loss_pressure_up
• inspection_heat_up
• lawful_annex_debt_up
• archive_debt_up
• route_asset_pressure_up
• future_route_costlier
• recovery_only_pressure_up

Failure conditions

The mechanism fails if:

• accepted testimony remains clean after witness state changes;
• the ledger omits source proof, old reader, witness state, new statement state, reliance reader, harmed reader, proof gap, and future route effect;
• the rehearing is resolved by generic authority, money, affection, or public mood;
• default changes only flavor;
• future readers do not consume the recantation row;
• recovery erases the old scar;
• entry depends on fixed timing, raw counts, dashboard state, or lens health.

Non-goals

• Not generic witness safety.
• Not initial testimony gathering.
• Not a universal appeal system.
• Not a relationship mechanic.
• Not a new bulk witness catalog.
• Not satisfied by page existence; it must be observable through ledger, rehearing, default, and future route mutation.