Service Recipient Authority Drift / 送达受领权限漂移线

Service Recipient Authority Drift is the next concrete aftershock for the green caption / capacity / carrier / remedy mesh.

The current corpus can already prove finite capacity and excluded-claimant service through 容量告知送达队列线. It can also prove that a class representative, delegate, operator, or witness carrier may lose current authority through 集体代表委任漂移线. The remaining playable seam is later and more operational: a notice can be delivered to someone who is no longer authorized to receive it for the reader who will consume the result.

This line keeps the delivery attempt as history, but forces current recipient authority before service becomes route truth.

Why this is the strongest gap

Most recent green lenses prevent single rows from becoming universal clean proof. The unsolved cross-lens shortcut is different:

• the capacity notice was sent, therefore the excluded claimant was served;
• the class representative received it, therefore every cohort had notice;
• the access operator signed it, therefore caption readers cannot rebut;
• the sponsor desk accepted it, therefore public/fan readers were served;
• the lawful annex was filed, therefore public service is clean;
• the discharged witness or substitute carrier carried it, therefore the route can close.

Each source system may be locally valid, but the future reader still needs the recipient authority check. Without this line, the player can accidentally launder a stale representative, limited desk, proxy runner, or discharged carrier into service.

State-triggered entry

Open only when all of these are visible:

entry_state_required:
  trigger_kind: state_pressure
  source_service_row_present: true
  source_service_row_from_any:
    - capacity_notice_service
    - reader_rebuttal_notice
    - access_caption_class
    - excluded_counterreceipt
    - remedy_reinstatement_bond
    - witness_carrier_discharge
    - substitute_carrier_requisition
    - equivalent
  service_purpose_visible: true
  intended_reader_visible: true
  affected_cohorts_visible_or_explicit_absence: true
  selected_recipient_or_explicit_absence_visible: true
  authority_source_row_or_explicit_absence_visible: true
  authority_scope_visible_or_explicit_absence: true
  authority_state_at_service_visible: true
  service_claim_visible: true
  omitted_or_deferred_readers_visible_or_explicit_absence: true
  future_reader_or_route_consumes_service_state: true
  player_can_verify_reserve_split_substitute_publicize_escrow_quarantine_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_notice_count_trigger: true
  no_raw_claimant_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The storyline fails if entry comes from fixed turn number, fixed day/week interval, chapter quota, raw notice count, raw claimant count, generic legal review, dashboard state, or lens-health state.

Bound content pack

• 送达受领权限漂移机制 defines delivery proof, recipient authority, branch states, default capture, and replay evidence.
• 送达受领权限案卷 records the source service row, intended reader, chosen recipient, authority source, proof, omitted readers, and future route effect.
• 送达受领权限复核 lets the player verify, re-serve, split, substitute, publish, escrow, quarantine, or default.
• 无权限受领送达默认 fires or arms when a receipt is spent as service without current recipient authority.

Storyline spine

Beat 1 — A service row exists

A prior branch creates a notice, callback, counterreceipt, addendum, remedy, or route packet. The row may come from capacity service, access caption class, reader rebuttal, excluded counterreceipt, remedy reinstatement, witness carrier discharge, or substitute carrier requisition.

Beat 2 — The service has a recipient

Someone accepted, signed, carried, stamped, relayed, or was absent from the service. The recipient may be a class representative, fan delegate, access operator, witness carrier, lawful clerk, sponsor desk, archive desk, proxy runner, route asset handler, or explicit absence.

Beat 3 — Authority is not automatically current

The recipient’s authority may be stale, limited, withdrawn, discharged, substituted, captured, hostile, absent, proxy-only, lawful-only, sponsor-only, public-only, or disputed.

Beat 4 — Authority review

Run 送达受领权限复核. The review asks whether the service is valid for a named scope, must be re-served, split, substituted, published, escrowed, quarantined, or defaulted.

Beat 5 — Future play consumes the new service state

The result must mutate a future reader or route: reservice, callback, addendum, public-only scope, lawful-only scope, sponsor-only scope, route delay, blocked route, hostile claimant, recovery-only state, contradiction pending, or costlier future route.

Branch map

Branch	Immediate relief	Cost/scar	Future state
Verify current recipient	service works for named reader and scope	proof upkeep, callback/addendum pressure	served-named-scope, costlier
Re-serve named reader	authority gap is cured for one reader	service delay, sponsor/management pressure	reservice-complete, route-delay
Split service	public/lawful/sponsor/archive/fan scopes stop overwriting each other	proof maintenance, cohort confusion	split-required, public-only, lawful-only
Substitute recipient	stale recipient is not used as current authority	substitute legitimacy risk, carrier exposure	substitute-required, audit-required
Publicize authority gap	hidden drift becomes visible	inspection heat, public distrust, sponsor retaliation	addendum-required, contradiction-pending
Escrow service	unsafe service paused without erasing delivery proof	archive debt, lawful-only routing, route delay	escrowed, lawful-only, blocked
Quarantine service	false universal service is blocked	current route block, recovery cost	quarantine-required, recovery-only
Unauthorized service default	fastest desk gets temporary closure	false service hardens; omitted reader becomes hostile	false-served, hostile, blocked

No branch may make one service recipient clean for public, lawful, sponsor, archive, fan oxygen, access caption, route asset, management report, and broadcast reality at once.

Character and desk hooks

• Shen Luo can sponsor-route service, but must leave sponsor-only capture and omitted-reader cost.
• Yu Lan can publish the authority gap, preserving public truth while increasing exposure and inspection heat.
• Han Yanshuang can move service into lawful annex or escrow, creating lawful-only safety and public delay.
• Baiya can preserve checksum or mask a carrier, but masked service is not public consent.
• A fan delegate, caption operator, proxy runner, discharged witness, or substitute carrier can receive service only for their current scope.

Handlers do not solve the line by prestige. They fill assignment slots or explicit absence.

Counter contract

Every constructive branch mutates relief, cost, and future state.

counter_deltas_required:
  relief: at_least_one
  cost: at_least_one
  future_reader_or_route_effect: at_least_one

Expected surfaces include service_legibility, recipient_authority_integrity, claimant_notice_protection, route_asset_truthfulness, service_delay, cohort_fracture, sponsor_stop_loss_pressure, lawful_annex_debt, archive_debt, proxy_runner_exposure, access_operator_exposure, inspection_heat, reservice_required, callback_required, public_addendum_required, future_route_cost, and broadcast_reality_drift.

Missability and recovery

The line is missed when a future route consumes a service row without checking recipient authority.

Missed states:

• service_recipient_stale;
• recipient_authority_hidden;
• omitted_reader_erased;
• operator_signature_as_universal_service;
• sponsor_notice_as_public_service;
• lawful_annex_as_public_service;
• proxy_receipt_as_consent;
• false_served_reader;
• recovery_only_service.

Recovery requires visible scar: late re-service, split service notice, substitute recipient appointment, public authority-gap addendum, lawful/archive escrow, service quarantine, or recovery-only route.

Replay evidence expectation

storyline_id: storyteller.storyline.service_recipient_authority_drift.v1
session_id: lens-service-recipient-authority-drift-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  source_service_row_present: true
  intended_reader_visible: true
  selected_recipient_or_explicit_absence_visible: true
  authority_state_at_service_visible: true
  service_claim_visible: true
  future_reader_or_route_consumes_service_state: true
  no_fixed_turn_trigger: true
offered:
  card: storyteller.card.service_recipient_authority_docket.v1
  rite: storyteller.rite.service_recipient_authority_review.v1
branch_runs:
  constructive:
    selected_posture: verify_current_recipient | re-serve_named_reader | split_service | substitute_recipient | publicize_authority_gap | escrow_service | quarantine_service
    service_state_after: <state>
    recipient_state_after: <state>
    omitted_or_deferred_readers_after: []
    future_reader_or_route_effect: <effect>
    counter_deltas:
      relief: []
      cost: []
      future: []
  default:
    event_seen_or_armed: storyteller.event.unauthorized_recipient_service_default.v1
    false_service_claim: <claim>
    omitted_or_deferred_reader: <reader>
    future_reader_or_route_effect: <effect>
assertions:
  - entry_is_state_triggered
  - service_row_preserved_as_history
  - recipient_authority_checked_before_consumption
  - omitted_reader_survives_or_costs
  - every_success_has_relief_cost_and_future_effect
  - default_names_false_service_claim
  - no_universal_service_recipient
  - future_reader_consumes_result
  - no_fixed_turn_day_week_raw_count_dashboard_or_lens_health_trigger

Non-goals

• Not a fresh capacity notice queue.
• Not another class certification page.
• Not a witness-carrier discharge duplicate.
• Not generic legal governance.
• Not raw count expansion.
• Not valid unless a future reader tries to spend service through a recipient whose authority must be checked.