False Transfer Switch Default / 伪切换默认

False Transfer Switch Default fires or arms when a power-priority decision is treated as physically executed without a valid transfer object, holder, operator, witness/seal, actual thrown surface, or future reader.

It is the switch-room default, not a random blackout. It records who filed the throw, which surface actually received power or stayed unproven, and which future route inherits the mismatch.

Fires or arms when

• a source emergency-power row is cited as if the switch was thrown;
• transfer object is hidden, stale, missing, or held by an unrecorded faction;
• holder, operator, witness, or seal is missing without explicit absence;
• intended powered surface differs from actual thrown surface and the mismatch is hidden;
• sponsor/security/ward/archive/borrowed-source override is filed as clean player priority;
• stale breaker tag or old dispatch controls the panel;
• no future reader consumes the switch scar.

Payload

event_id: storyteller.event.false_transfer_switch_default.v1
source_switch_ledger: storyteller.card.manual_transfer_switch_ledger.v1 | explicit_absence
source_power_row:
  source_card: storyteller.card.emergency_power_ledger.v1 | equivalent | explicit_absence
  intended_powered_surface: <surface or explicit_absence>
  priority_claim: <claim or explicit_absence>
transfer_failure:
  transfer_object_or_absence: transfer_key | breaker_tag | override_seal | switch_room_witness | generator_handoff_slip | locked_panel | explicit_absence | equivalent
  failure_kind: hidden_holder | missing_operator | missing_witness | stale_tag | wrong_surface_thrown | override_filed_clean | borrowed_claim_hidden | no_future_reader | equivalent
  holder_or_absence: <holder or explicit_absence>
  operator_or_absence: <operator or explicit_absence>
  witness_or_seal_or_absence: <witness seal proof or explicit_absence>
  default_actor: sponsor_security | security_grid | ward_reserve | archive_clerk | stage_manager | borrowed_source_claimant | generator_governor | producer_absence | equivalent
switch_result:
  intended_surface: <surface or explicit_absence>
  actual_or_default_thrown_surface: <surface or explicit_absence>
  harmed_reader_or_absence: <reader or explicit_absence>
  false_switch_claim: priority_executed | oxygen_powered_clean | archive_powered_clean | stage_lights_clean | doors_locked_clean | borrowed_power_clean | panel_quarantined_clean | equivalent
state_after:
  transfer_state_after: false_logged | hidden_holder | stale_tag | wrong_surface_powered | captured | blocked | recovery_only | contradiction_pending
  future_route_effect: blocked | hostile | costlier | public_addendum_required | override_unwind_required | panel_audit_required | recovery_only | contradiction_pending
counter_deltas:
  relief: []
  cost: []
  future: []

Consequence contract

A valid default must mutate at least three surfaces:

• switch or holder state;
• powered surface or harmed reader state;
• future route effect;
• plus one pressure cost such as blackout risk, inspection heat, facility access pressure, public anxiety, sponsor capture, crew hazard, archive debt, or route asset pressure.

The default fails if it is only a warning, mood loss, or generic risk increment.

Recovery hooks

Recovery is allowed, but the scar remains:

• late panel audit;
• operator protection;
• public witness addendum;
• override unwind;
• borrowed-generator release;
• facility reroute to switch room;
• low-power correction slot;
• recovery-only branch.

Recovery cannot retroactively make the original switch log universal proof of correct priority.