CS-09 Cue Execution Idempotency Review / CS-09 提示执行幂等复核

Entry pressure

The rite opens when CS-09 exposes two RN marks, the blue R6 scan emits two EXECUTE:F-27 tokens, and rail telemetry proves that F-27 already moved once. It must finish before the second recovery pulse reaches the physical bus.

It is state-triggered, not tied to a fixed turn, day, initial count, or dashboard score.

Exact inputs

All eight cards must be present in the current hand and assigned to their exact slots:

Slot	Exact card	Operational function
docket	storyteller.card.cue_sheet_initials_afteruse_docket.v1	binds the collision
white_master	storyteller.card.cue_initials_white_master.v1	PREPARED mark
yellow_carbon	storyteller.card.cue_initials_yellow_carbon.v1	EXECUTED mark and pressure layer
caller_roster	storyteller.card.cue_initials_shared_roster.v1	RN-A / RN-B handoff
timecode	storyteller.card.cue_initials_headset_timecode.v1	orders standby, hold, go, movement
automation_ingest	storyteller.card.cue_initials_automation_ingest.v1	exposes duplicate tokens
execution_receipt	storyteller.card.cue_initials_rail_execution_receipt.v1	proves one physical actuation
recovery_route	storyteller.card.cue_initials_recovery_route.v1	names the queued second pulse and future readers

No selected-branch card exists. Branch choice is an explicit gameplay choice, not pseudo-evidence.

Enforcement

• exact one-ID slot accepts;
• all eight have.card conditions;
• assigned cards must be in the current hand;
• omitted or invalid choices fail;
• every branch repeats the exact slot-to-card map;
• the rite is non-repeatable and closes after one success.

Resolution branches

1. Bind single execution chronology — preserve both marks, attach one physical receipt, and issue a cue-instance checksum.
2. Cancel queued duplicate pulse — stop the imminent movement while accepting recurring manual readback because chronology remains unbound.
3. Rekey callers and reissue bundle — move future rows to RN-A and RN-B while preserving the old stack as disputed evidence.
4. Split prepared and executed registers — migrate automation so standby cannot enter the execution token stream.
5. Lift and separate carbon layers — gain strong pressure-order proof by consuming the original carbon relationship.
6. Divert duplicate pulse to dry-run sink — reproduce the fault without moving the rail, with persistent simulated-versus-physical attestation.
7. Manual rail recall before restart — make physical position and operator readback the restart gate.
8. Accept duplicate execution default — admit both tokens to the physical bus and arm the double-fire event.

Every branch emits one named execution state, one named future effect, relief, cost, and at least three real counter deltas.

At-most-once invariant

F-27_R6:
  allowed: UNSEEN -> PREPARED -> EXECUTED
  hold_resets: false
  handoff_resets: false
  recovery_import_resets: false
  second_execution_same_epoch: forbidden

The constructive branches keep physical execution count at one. A deliberate future refire would need a new inspected execution epoch; this rite does not silently create one.

Destructive branch

The carbon-lift branch must simultaneously:

• increase chronology integrity;
• decrease source-layer integrity;
• increase evidence-trace loss;
• require a new source stack.

If all four effects are not visible, the branch has hidden its tradeoff.

Default arm

accept_duplicate_execution_default sets cue_sheet_initials.default_pending and duplicate_execution_pending. CS-09 Duplicate Cue Hardening then wins the eligible-event queue at priority 95 and closes after either outcome.

Authority boundary

This rite resolves execution state only. It never grants caller identity or authority, authorship, performer consent, rigging safety clearance, edit permission, sponsor clearance, archive ownership, blame, or universal broadcast permission.

Runtime source

game-content/storyteller/rites/cue-sheet-initials-afteruse-review.json5