Backflow Usher Receipt / 逆流引座回执机制

Backflow Usher Receipt is the mechanism that turns a reversed-flow carrier into playable state.

It targets a narrow gap left after egress, roll-call, promise, and recap content: a late carrier can arrive with real proof, but that proof must not silently widen the old receipt into clean universal truth.

The primary carrier is Backflow Usher. The mechanism is valid for equivalent carriers only when they have a concrete body-state, proof bundle, identity/seal, merge risk, harmed reader, and future consumer.

Mechanic promise

A passing implementation must prove:

• a prior receipt exists or explicit absence is recorded;
• a reversed-flow carrier exists;
• a late subject or proof bundle exists;
• the route node or one-way scar is visible;
• identity/seal and private boundary are visible or explicitly absent;
• a merge claim is visible;
• the harmed reader if merged is named;
• the future reader or route that consumes the row is named;
• branches diverge by carrier state, receipt scope, cost, and future effect;
• default false merge is durable;
• no fixed turn, day/week, raw count, dashboard, or lens-health trigger exists.

Entry rule

entry_state_required:
  trigger_kind: state_pressure
  prior_receipt_present_or_explicit_absence: true
  prior_receipt_kind_visible: true
  reversed_flow_carrier_present: true
  late_subject_or_bundle_visible: true
  reversed_flow_node_visible_or_explicit_absence: true
  borrowed_or_sealed_identity_visible_or_explicit_absence: true
  boundary_or_promise_visible_or_explicit_absence: true
  merge_claim_present: true
  harmed_reader_if_merged_visible: true
  future_reader_or_route_consumes_backflow_state: true
  player_can_recruit_seal_credit_trade_quarantine_refuse_or_default: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_missing_or_receipt_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The mechanism fails if eligibility comes from a fixed sequence position, chapter quota, raw missing count, raw receipt count, generic post-broadcast cleanup, dashboard state, lens health, or generic friendship.

State model

逆流引座账本 stores the state row.

state_model:
  prior_receipt_lock:
    prior_receipt_id_or_absence: <receipt id or explicit_absence>
    prior_receipt_kind: live_floor_egress | missing_roll_call | capacity_notice | fan_oxygen | route_asset_custody | public_recap | equivalent
    prior_receipt_claim: safe_exit | present | served | released | escorted | public_all_clear | lawful_only_presence | sponsor_manifest_presence | equivalent
    receipt_holder: producer | safety_marshal | archive | inspector | sponsor | fan_delegate | access_operator | broadcast_reality | equivalent
  carrier_lock:
    carrier: storyteller.character.cen_hui_backflow_usher.v1 | equivalent
    carrier_state_before: unseen | offered | retained | recruited | sealed | exposed | traded | quarantined | hostile | captured | missed | recovery_only
    reversed_flow_node: stage_threshold | service_corridor_chain | fan_oxygen_gate | ward_air_room | archive_counter_seven | white_glove_checkpoint | sponsor_bridge_booth | equivalent
    carried_subject_or_bundle: named_character | sealed_witness | access_caption_reader | fan_delegate | proof_bundle | route_asset_pouch | oxygen_mask | edit_checksum | equivalent
    borrowed_or_sealed_identity: public_name | sealed_name | alias | borrowed_wristband | payroll_token | lawful_seal | explicit_absence | equivalent
    boundary_or_promise: private_only | sealed_name_only | lawful_only | handler_only | public_credit_allowed | disputed | explicit_absence | equivalent
  merge_risk_lock:
    merge_claim: late_receipt_fixes_all | backflow_proves_safe_exit | sealed_name_as_public_presence | public_credit_as_consent | sponsor_manifest_absorbs_late_row | recap_uses_backflow_cleanly | equivalent
    harmed_reader_if_merged: sealed_subject | fan_public | access_caption_reader | archive | lawful_reader | sponsor | route_asset_reader | confidant_character | future_audience | equivalent
    omitted_scar_if_merged: one_way_scar | deferred_flow | unserved_notice | identity_gap | condition_unknown | promise_scope | proof_contamination | public_false_memory | equivalent
  future_reader_lock:
    future_reader_or_route: roll_call_recheck | public_recap | access_caption_class | fan_oxygen_audit | archive_custody | route_asset_reader | lawful_table | ending_scar_ledger | equivalent
    state_if_handled: recruited_scar_runner | sealed_present | public_credited | traded | quarantined | accepted_with_scar | equivalent
    state_if_ignored: false_backflow_merge | hostile_witness | captured_carrier | public_recap_correction_required | route_blocked | recovery_only | ending_scar | equivalent

The mechanism fails if these locks collapse into one attendance_fixed or proof_delivered flag.

Resolution rule

Run 逆流引座收容 before any future reader treats the late row as proof.

Valid branch families:

1. recruit_scar_runner — keeps the backflow scar usable as a future route asset with cost.
2. seal_witness — counts the late subject/proof without public naming.
3. public_credit — uses public proof to block false accounting while exposing the carrier.
4. trade_to_desk — gives the row to a desk and accepts capture/faction cost.
5. quarantine_route_scar — blocks contamination until identity/condition/proof matching catches up.
6. refuse_late_row — blocks clean use while preserving the conflict.
7. false_backflow_merge_default — fastest narrator merges the row into all-clear.

Every constructive branch must include relief, cost, and future reader effect.

Default rule

虚假逆流并账默认 must fire or arm when:

• no ledger row exists;
• the late carrier is hidden;
• prior receipt scope is hidden;
• identity/seal is missing or violated without state;
• private boundary is used as public consent;
• public credit is used as protection;
• a recap or manifest merges the late row into clean safety;
• a future route consumes the row without reading the one-way scar, omitted reader, or harmed reader.

Durable outcomes include false_backflow_merge, hostile_witness, captured_carrier, public_recap_correction_required, future_roll_call_challenge, route_blocked, recovery_only, or ending_scar.

Cross-system reads

• 直播现场通行瓶颈线 supplies the one-way scar and movement conflict.
• 漏点名复核线 reads whether the late subject is present, sealed, public, or still contested.
• 私约违背线 reads whether a sealed name was spent beyond boundary.
• 公开回顾捕获线 reads whether the backflow row was used as clean public memory.
• Route Assets and Custody reads whether 岑回 becomes a narrow future route asset, a captured carrier, or recovery-only.

Replay evidence expectation

mechanic_id: storyteller.mechanic.backflow_usher_receipt.v1
session_id: lens-cen-hui-backflow-usher-v1-<timestamp>
seed: <deterministic-seed>
entry_state:
  trigger_kind: state_pressure
  prior_receipt_id_or_absence: <id or explicit_absence>
  reversed_flow_carrier_present: true
  late_subject_or_bundle_visible: true
  merge_claim_present: true
  harmed_reader_if_merged_visible: true
  future_reader_or_route_consumes_backflow_state: true
  no_fixed_turn_trigger: true
offered:
  card: storyteller.card.backflow_usher_ledger.v1
  rite: storyteller.rite.backflow_usher_intake.v1
branch_result:
  selected_posture: recruit_scar_runner | seal_witness | public_credit | trade_to_desk | quarantine_route_scar | refuse_late_row | false_backflow_merge_default
  carrier_state_after: <state>
  backflow_state_after: <state>
  counter_deltas:
    relief: []
    cost: []
    future: []
default:
  event_seen_or_armed: storyteller.event.false_backflow_merge_default.v1 | explicit_absence
assertions:
  - entry_is_state_triggered
  - prior_receipt_and_late_carrier_are_visible
  - identity_boundary_merge_risk_harmed_reader_and_future_reader_are_visible
  - branch_outcomes_diverge
  - every_success_has_relief_cost_and_future_effect
  - default_false_merge_mutates_future_play
  - no_universal_all_clear
  - no_fixed_turn_day_week_raw_count_dashboard_or_lens_health_trigger

Non-goals

• Not generic evacuation.
• Not generic attendance.
• Not a free courier mechanism.
• Not a proof carryover duplicate; the focus is a reversed-flow person-state after a prior receipt.
• Not a PR recap mechanism; recap is only one reader.
• Not valid unless future play changes through carrier state, receipt scope, harmed reader, and route/reader effect.