Mirror Right Boundary Audit / 镜权边界审计线

Mirror Right Boundary Audit is the storyline for the moment a schedule contract tries to spend one mirror-right family as if it granted every kind of reality authority.

四种镜权与权限边界 already defines the four core rights: near_right, exit_right, staging_right, and naming_right. Nearby storylines already handle channel legality, slot contract scope, preemption, and territorial relay. This storyline fills the narrower gap: the player must prove that the operation requested by the schedule contract matches the right family it actually carries.

Playable question

When a contract grants one right family, what stops the desk from overusing it?

The player can:

• certify that the requested operation matches the granted right;
• narrow the operation to the right that is actually present;
• retrofit the missing right with debt;
• split the contract into separate right tables;
• substitute a non-right cost such as public receipt, lawful annex, sponsor carveout, or route delay;
• quarantine the operation until a valid right exists;
• let overreach default into false universal authority.

The source contract remains real. The branch decides which operation it may carry and which future reader inherits the boundary scar.

State-triggered entry

Open this storyline only from state pressure:

entry_state_required:
  trigger_kind: state_pressure
  schedule_contract_present: true
  requested_right_use_visible: true
  granted_right_family_visible: true
  required_right_family_visible: true
  right_family_mismatch_visible: true
  protected_boundary_or_absence_visible: true
  future_reader_consumes_boundary_state: true
  player_can_certify_narrow_retrofit_split_substitute_quarantine_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_right_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

Valid entry sources include a staging contract trying to rename a faction, a naming contract trying to rewrite a physical fact, a near-right contract trying to delete a protected person, an exit-right contract trying to build a memorial facility, or any combined contract where one missing family is being treated as implied.

Bound content pack

• 四种镜权与权限边界 defines the four right families and their forbidden overreach.
• 镜权边界案卷 records the source contract, granted rights, requested operation, missing family, protected boundary, and future reader.
• 镜权边界听证 resolves certify, narrow, retrofit, split, substitute, quarantine, or default postures.
• 镜权越界默认 hardens false universal authority when the boundary is hidden.
• Mirror Right Boundary Audit Lens observes entry, docket shape, branch divergence, and durable default.

Storyline spine

Beat 1 - Contract asks for the wrong power

A contract, slot, route asset, sponsor package, facility order, memorial scene, exit request, intimacy gate, naming desk, or blacklist asks to perform an operation that belongs to a different right family than the contract carries.

The mismatch must be visible. A generic permission problem is not enough.

Beat 2 - Docket separates granted and required rights

Create Mirror Right Boundary Docket. It must name the source contract, granted right family, requested operation, required right family, missing or mismatched right, protected boundary, attempted reader, and future route effect.

mirror_right_boundary_row:
  source_contract_id: <stable contract id>
  granted_right_family:
    - near_right | exit_right | staging_right | naming_right
  requested_operation: approach_bind | remove_exit | build_stage | rename_claim | edit_silence | route_unlock | equivalent
  required_right_family:
    - near_right | exit_right | staging_right | naming_right
  right_family_mismatch: missing_required_right | stale_right | wrong_grade | implied_combo | hidden_boundary | explicit_absence
  protected_boundary_or_absence: person_boundary | exit_protection | facility_cost | identity_fact | public_name | route_asset_scope | explicit_absence
  attempted_reader: sponsor | lawful_reader | public_table | archive | fan_public | route_asset | broadcast_reality | equivalent
  future_reader_or_route: <reader route rite ending or explicit_absence>

Beat 3 - Hearing prices the boundary

Run Mirror Right Boundary Hearing. A branch cannot say approved unless it proves the requested operation matches the granted right or pays for the missing right.

Beat 4 - Future reader consumes the scar

The result must change later play. A narrowed near-right can keep a relationship scene but block deletion. A retrofitted staging right can build a facility but attach sponsor debt. A split table can allow public naming while lawful exit remains barred. A quarantine can delay the route but prevent false authority.

Beat 5 - Overreach default hardens

If the contract is used as a universal permission stamp, Mirror Right Overreach Default fires or arms. It records the false right claim, capturing reader, hidden boundary, boundary state after, and future reader effect.

Branch map

Branch	Immediate relief	Cost/scar	Future state
Certify matching right	operation proceeds inside scope	boundary and future reader are narrowed	bound_with_scope
Narrow to granted right	false use is blocked	route delay, sponsor/public pressure	narrowed_to_existing_right
Retrofit missing right	operation unlocks	contract capture, license cost, audit heat	retrofitted_with_debt
Split rights table	incompatible readers stay visible	ambiguity, correction cost, handler burden	split_rights_required
Substitute non-right cost	current pressure falls without pretending right exists	public receipt, lawful annex, sponsor carveout, route delay	substitute_surface_required
Quarantine operation	false universal authority blocked	schedule pressure, route delay, archive debt	quarantined_or_recovery_only
Overreach default	fastest desk may proceed	false universal authority, hostile/costlier future	overreach_default_armed

Missability and recovery

The storyline is missed when an implementation lets one right family silently cover another: near-right becomes body control, exit-right deletes a protected target without narrative scar, staging-right creates resources without project cost, or naming-right rewrites physical facts.

Recovery requires visible scar: late right retrofit, public correction, lawful annex, sponsor unwind, split table, route delay, recovery-only route, or explicit admission that the operation never had the needed right.

Replay evidence expectation

storyline_id: storyteller.storyline.mirror_right_boundary_audit.v1
session_id: lens-mirror-right-boundary-audit-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  schedule_contract_present: true
  requested_right_use_visible: true
  granted_right_family_visible: true
  required_right_family_visible: true
  right_family_mismatch_visible: true
  future_reader_consumes_boundary_state: true
offered:
  card: storyteller.card.mirror_right_boundary_docket.v1
  rite: storyteller.rite.mirror_right_boundary_hearing.v1
branch_result:
  selected_posture: certify_matching_right | narrow_to_granted_right | retrofit_missing_right | split_rights_table | substitute_non_right_cost | quarantine_operation | mirror_right_overreach_default
  boundary_state_after: <state>
  future_reader_effect: <effect>
  event_seen_or_armed: storyteller.event.mirror_right_overreach_default.v1 | none
  counter_deltas:
    relief: []
    cost: []
    future: []

Non-goals

• Not a replacement for broadcast legality conversion.
• Not a territorial relay duplicate.
• Not a general rights encyclopedia.
• Not a fixed-turn license audit.
• Not valid if one mirror right satisfies near, exit, staging, and naming operations at once.