Cue Execution Idempotency Ledger / 提示执行幂等账本机制

This mechanism answers one narrow question: has the named physical cue instance already executed?

Displayed initials are never an execution key. The ledger follows source layer, caller key, semantic phase, timecode, cue instance, and physical actuation receipt. It does not decide identity, authority, consent, rigging clearance, ownership, blame, or broadcast permission.

State machine

cue_execution_idempotency:
  cue_instance: F-27 / recovery cycle R6
  valid_transition: UNSEEN -> PREPARED -> EXECUTED
  prepared_consumes_execution_epoch: false
  executed_consumes_execution_epoch: true
  hold_resets_execution_epoch: false
  caller_handoff_resets_execution_epoch: false
  recovery_import_resets_execution_epoch: false
  second_execution_in_same_epoch_allowed: false
  current_physical_execution_receipt_count: 1

Only an EXECUTED row linked to a physical receipt can consume an epoch. A standby mark can be genuine without authorizing or recording movement. A later scan cannot make a consumed cue pending merely by dropping the receipt.

Stable keys

call_row_key:
  - source_artifact_id
  - source_layer_or_revision
  - cue_instance
  - cue_phase
  - caller_key
  - call_sequence
 
at_most_once_key:
  - performance_or_recovery_cycle
  - cue_instance
  - physical_target
  - execution_epoch
 
forbidden_key_fields:
  - caller_initials_display
  - glyph_shape
  - scan_order_without_source_layer

RN is a display field shared by Rowan Neri and Rhea Noll. It may help a human locate a row. It cannot distinguish people, phase, or consumption state.

Required source tuple

Field	CS-09 value	Why it is required
source bundle	CS-09 white, yellow, and blue layers	preserves paper role and copy direction
cue instance	F-27 / R6	binds every row to one execution epoch
white mark	Rowan Neri / RN / PREPARED / 21:14:07	proves standby without movement
yellow mark	Rhea Noll / RN / EXECUTED / 21:17:42	proves the call phase
handoff roster	RN-A then RN-B	distinguishes two callers sharing initials
timecode	standby, hold, release, go, rail moving	orders semantic transitions
ingest trace	two EXECUTE:F-27:RN tokens	exposes the lossy join
rail receipt	one brake release and one movement	proves the epoch was consumed once
future route	R6 recovery and later cue readers	names the surfaces that might replay it

Exact assignment contract

CS-09 Cue Execution Idempotency Review requires eight exact cards in the current hand and eight exact one-ID slots:

Slot	Exact card
docket	storyteller.card.cue_sheet_initials_afteruse_docket.v1
white_master	storyteller.card.cue_initials_white_master.v1
yellow_carbon	storyteller.card.cue_initials_yellow_carbon.v1
caller_roster	storyteller.card.cue_initials_shared_roster.v1
timecode	storyteller.card.cue_initials_headset_timecode.v1
automation_ingest	storyteller.card.cue_initials_automation_ingest.v1
execution_receipt	storyteller.card.cue_initials_rail_execution_receipt.v1
recovery_route	storyteller.card.cue_initials_recovery_route.v1

Wrong IDs, tag aliases, duplicate cards, missing slots, catalog-only cards, cards absent from the current hand, virtual placeholders, omitted choice, and invalid choice all fail. Each option repeats the exact slot map. The rite is non-repeatable: a completed operation cannot be resolved again.

Collision rule

The blue recovery importer commits three losses:

1. it removes the white/yellow layer distinction;
2. it removes PREPARED versus EXECUTED;
3. it removes the one physical actuation receipt.

It then joins on cue plus RN. The result is two machine tokens with no way to tell that one is a standby record and the other has already consumed the epoch.

The repair must change at least one operational surface: chronology binding, queue state, caller key, state schema, physical evidence, bus routing, restart gate, or second-actuation state. A generic reader restriction does not repair the collision.

Branch contract

branches:
  bind_single_execution_chronology:
    state_after: single_execution_chronology_bound
    future_effect: cue_instance_checksum_required
  cancel_queued_duplicate_pulse:
    state_after: duplicate_pulse_cancelled_execution_unproven
    future_effect: manual_execution_readback_required
  rekey_callers_and_reissue_bundle:
    state_after: unique_caller_keys_reissued
    future_effect: unique_operator_key_required
  split_prepared_and_executed_registers:
    state_after: prepared_executed_registers_split
    future_effect: state_transition_schema_required
  lift_and_separate_carbon_layers:
    state_after: carbon_layers_lifted_trace_consumed
    future_effect: new_source_stack_required
  divert_duplicate_pulse_to_dry_run_sink:
    state_after: duplicate_pulse_diverted_to_sink
    future_effect: dry_run_sink_attestation_required
  manual_rail_recall_before_restart:
    state_after: manual_rail_recall_completed
    future_effect: operator_witness_before_restart_required
  accept_duplicate_execution_default:
    state_after: duplicate_execution_pending
    future_effect: duplicate_execution_default_pending

Destructive evidence rule

The pressure strata can be chemically lifted to distinguish copy-through from direct writing. This produces strong chronology but consumes the original carbon relationship. The branch must therefore increase chronology integrity while decreasing source-layer integrity, increasing trace loss, and requiring a new source stack. A photograph of the separated layers is evidence of the result, not a restoration of the original stack.

Dry-run rule

A duplicate token may be diverted into an isolated sink to reproduce the automation fault. The sink must not be connected to F-27’s physical bus. Later readers must carry an attestation distinguishing simulated receipt from physical actuation; otherwise the sink creates a new false execution count.

Default rule

Accepting both RN tokens arms CS-09 Duplicate Cue Hardening. Both outcomes preserve an irreversible double-execution scar:

• the interlock stops the second movement after measurable partial travel, leaving a set discontinuity and dual receipts;
• the scenery completes its second travel and the aired recovery becomes double-fired canon requiring a version fork.

Neither outcome may collapse to a generic recovery-only state.

Authority boundary

authority_boundary:
  provesExecutionChronologyForNamedCueInstanceOnly: true
  grantsCallerAuthorship: false
  grantsCurrentCallerAuthority: false
  grantsPerformerConsent: false
  grantsRiggingSafetyClearance: false
  grantsEditReusePermission: false
  grantsSponsorClearance: false
  grantsArchiveOwnership: false
  grantsUniversalBroadcastPermission: false