Card Schema Ingestion Audit / 卡牌结构入库审计线

Card Schema Ingestion Audit is the pressure storyline for the moment when a card enters a schedule, on-screen ritual, route, archive board, or future reader with a declared family that may not match the way the player wants to use it.

卡牌数据结构 already defines schedule, character, scene, resource, secret, thought, and blackout card shapes. The remaining playable gap is ingestion: a card can look useful, but the game still needs to prove whether its fields legally support the slot, route, and reader that now want to consume it.

This storyline makes a miscast card row playable instead of letting it become quiet metadata. A resource card cannot silently become a sacrifice proof, a secret cannot silently become a narrative slot, a blackout card cannot be laundered as a clean schedule, and a character card cannot stand in for consent, scene access, or public mandate without a visible schema decision.

State-triggered entry

Open this storyline only when all of the following are true:

trigger_kind: state_pressure
incoming_card_row_present: true
declared_card_family_visible: true
requested_slot_or_reader_visible: true
schema_mismatch_or_explicit_absence_visible: true
carrier_or_owner_visible_or_explicit_absence: true
future_reader_or_route_consumes_schema_state: true
no_fixed_turn_trigger: true
no_fixed_day_or_week_trigger: true
no_raw_card_count_trigger: true
no_dashboard_or_lens_health_trigger: true

Valid entry surfaces include a schedule contract trying to accept an off-family row, an on-screen ritual using a card in a slot it does not declare, a route asset loading a proof card as a person-state, a blackout scar being sold as a schedule, a secret being treated as public narrative, or a resource/sacrifice row carrying no cost owner.

Content pack

• 卡牌结构入库审计机制 defines the state machine, schema row, branch contract, and default pressure.
• 卡牌结构入库案卷 records the source card, declared family, observed fields, requested use, mismatch, carrier, proof bridge, selected response, state after, and future route effect.
• 卡牌结构入库复核 is the assignable management rite that certifies, narrows, converts, splits, quarantines, waives, or defaults the card row.
• 结构错投默认 fires or arms when the game accepts a false schema claim without visible inputs.

Storyline spine

Beat 1 - A card row enters a future-facing surface

The player attempts to use a card inside a schedule, on-screen ritual, route reader, proof board, archive queue, public receipt, or recovery package.

The card must name its declared family:

• schedule
• character
• scene
• resource
• secret
• thought
• blackout
• equivalent custom family
• explicit absence

Beat 2 - Requested use exposes the mismatch

The requested slot or reader asks for a different family, missing field, stronger carrier, public proof, or route-consumable state.

Common collisions:

• resource oxygen is treated as paid sacrifice without a cost owner;
• secret evidence is treated as public narrative without a reader;
• blackout scar is offered as a clean schedule row;
• character contact is treated as consent or route asset custody;
• scene access is treated as mirror right authority;
• thought card is treated as proof;
• schedule card is used as proof of future release after its countdown or blackout state changed.

Beat 3 - The docket names the schema row

The player receives or updates 卡牌结构入库案卷.

The docket must record the declared family, observed fields, requested use, required family or slot, mismatch kind, carrier or owner, proof bridge, handler or reader, selected response, state after, and future route effect.

Beat 4 - The review chooses the visible handling

Run 卡牌结构入库复核.

The player can certify the declared schema, narrow the schema scope, convert with receipt, split the card faces, quarantine a miscast row, waive with debt, or let the row default.

Beat 5 - Future readers consume the scar

A successful branch may unlock a route, but never as a universal clean conversion. The result must preserve which future reader consumes the schema state and what became costlier, narrower, split, quarantined, or recovery-only.

Branch families

certify_declared_schema

The card is used exactly as its declared family allows.

relief_any: [slot_legality_confirmed, schedule_or_ritual_can_continue, route_reader_accepts_scope]
cost_any: [off_family_use_blocked, alternate_reader_delayed, proof_burden_remains]
future_effect_any: [declared_family_locked, clean_laundering_blocked, current_route_only]

narrow_schema_scope

The card can be used, but only for a narrower slot, reader, or route.

relief_any: [partial_slot_use_allowed, route_pressure_reduced]
cost_any: [broad_route_blocked, later_reader_requires_addendum, handler_burden_up]
future_effect_any: [narrow_reader_only, addendum_required, route_costlier]

convert_with_receipt

The card changes usable family only after a visible receipt names owner, bridge, and cost.

relief_any: [requested_slot_filled, proof_bridge_created, schedule_pressure_down]
cost_any: [conversion_debt_up, source_family_scarred, public_or_lawful_reader_can_reopen]
future_effect_any: [converted_with_receipt, source_family_claim_preserved, future_audit_required]

split_card_faces

The card keeps more than one face: public/hidden, lawful/public, schedule/blackout, character/asset, or proof/narrative.

relief_any: [two_reader_surfaces_preserved, contradiction_visible]
cost_any: [custody_debt_up, archive_or_editor_burden_up, future_reader_split_required]
future_effect_any: [split_custody, public_only_or_lawful_only, later_reconciliation_required]

quarantine_miscast_card

The card is removed from the current slot until the missing family, field, owner, or proof bridge is supplied.

relief_any: [false_schema_claim_blocked, future_fraud_cost_down]
cost_any: [route_delayed, schedule_pressure_up, replacement_needed]
future_effect_any: [quarantine_required, replacement_route_required, recovery_only_until_rebuilt]

schema_waiver_with_debt

Management, sponsor, editor, archive, or lawful reader allows a mismatched card row to proceed with an explicit waiver and future claim.

relief_any: [immediate_airing_or_route_unblocked, pressure_temporarily_down]
cost_any: [sponsor_capture_up, edit_debt_up, archive_debt_up, future_reader_can_collect]
future_effect_any: [waived_with_debt, sponsor_only_costlier, audit_reopen_required]

schema_miscast_default

The game accepts a card as the wrong family without source row, mismatch, carrier, proof bridge, or future reader.

emitted_event: storyteller.event.schema_miscast_default.v1
future_effect_any:
  [route_blocked, false_schema_recovery, blackout_pressure_up, clean_laundering_blocked]

Non-goals

• Not a database validator.
• Not a generic type-system note.
• Not a reason to block all improvisation.
• Not valid if the requested use, mismatch, owner/carrier, and future reader are not visible.
• Not valid if a miscast card receives a clean universal conversion.