Witness Carrier Double-Spend Default / 见证承载双花默认

Witness Carrier Double-Spend Default fires or arms when a named witness, delegate, handler, editor, lawful officer, pirate relay, or receipt carrier is reused as if a previous service created clean capacity for every later reader.

The default is not a timer. It is the moment a sponsor, management table, lawful reader, archive reader, public table, route claimant, or broadcast reality consumes a carrier’s prior service as universal consent, proof, or callback satisfaction.

Trigger condition

trigger:
  trigger_kind: state_pressure
  discharge_receipt_present_or_required: true
  previous_service_visible_or_explicit_absence: true
  proposed_next_use_visible: true
  original_scope_limit_hidden_or_overwritten: true
  carrier_consent_to_reuse_absent_coerced_or_false: true
  no_valid_discharge_review_selected: true
  future_reader_or_route_consumes_false_reuse: true
  no_fixed_turn_trigger: true
  no_fixed_day_or_week_trigger: true
  no_raw_witness_count_trigger: true
  no_dashboard_or_lens_health_trigger: true

The event must not be scheduled by fixed timing, chapter position, raw witness count, dashboard state, lens health, or generic escalation.

Required payload

witness_carrier_double_spend_payload:
  source_service:
    source_row_id: <row id or explicit_absence>
    source_surface: oxygen_haircut_witness | callback_carrier_collision | fan_delegate_mandate | consent_debt_transfer | handler_burden | equivalent
    original_owed_reader: <reader or explicit_absence>
    original_service: <service or explicit_absence>
    promised_limit_or_absence: <scope or explicit_absence>
  carrier:
    carrier_id: <named carrier or explicit_absence>
    carrier_state_before: protected | paid | public_receipt_carrier | lawful_only | sponsor_bought | editor_masked | pirate_amplified | hostile | captured | absent | overdrawn | equivalent
    protection_or_payment_state: protected | paid | escrowed | unpaid | exposed | sponsor_clause | pirate_risk | explicit_absence | equivalent
  overwrite:
    next_row_id: <row id or explicit_absence>
    next_reader: <reader>
    false_reuse_claim: witness_spoke_for_all | delegate_reused_for_all | prior_receipt_clean_for_all | lawful_annex_clean_for_public | pirate_relay_as_lawful_mandate | mask_as_public_consent | paid_once_so_available | equivalent
    default_narrator: sponsor | management_table | archive | lawful_reader | public_table | route_claimant | broadcast_reality | equivalent
    hidden_or_overwritten_reader: <reader>
    hidden_or_overwritten_limit: <scope or explicit_absence>
  aftermath:
    carrier_state_after: hostile | captured | burned | absent | overdrawn | quarantined | false_clean | recovery_only | equivalent
    consent_or_service_state_after: false_clean_reuse | sponsor_only | lawful_only | public_only | masked_false_public | pirate_misfiled | blocked | recovery_only | equivalent
    future_reader_or_route_effect: callback_required | discharge_required | contradiction_pending | blocked | hostile | costlier | recovery_only | equivalent

The payload is invalid if it records only witness upset, staff fatigue, public anger, or route blocked without naming the previous service, proposed next use, false reuse claim, narrator, hidden reader/limit, and future effect.

Default branches

The carrier was protected or paid once and management treats that payment as future availability.

counter_deltas:
  witness_discharge_debt: +1
  witness_retaliation_risk: +1
  handler_burden: +1
future_reader_effect: discharge_required | hostile | recovery_only

Public receipt overreach

A public receipt is reused as if it represented fan public, lawful reader, sponsor, archive, and route asset at once.

counter_deltas:
  public_receipt_distrust: +1
  fan_oxygen_resentment: +1
  broadcast_reality_drift: +1
future_reader_effect: public_only | contradiction_pending | callback_required

Lawful annex overreach

A lawful escrow or annex releases one scope, then another reader cites it as public or sponsor consent.

counter_deltas:
  lawful_annex_debt: +1
  hidden_reader_hostility: +1
  archive_debt: +1
future_reader_effect: lawful_only | annex_required | costlier

Mask or pirate overreach

An edit mask or pirate relay protected the carrier, then a desk cites it as clean mandate proof.

counter_deltas:
  archive_debt: +1
  public_receipt_distrust: +1
  inspection_heat: +1
future_reader_effect: masked_false_public | pirate_misfiled | recovery_only

Sponsor settlement buys a carrier’s testimony once and then claims future representation.

counter_deltas:
  sponsor_stop_loss_pressure: -1
  contract_capture: +1
  mandate_reuse_pressure: +1
future_reader_effect: sponsor_only | hostile_witness | sponsor_unwind_required

State after event

The event must leave one or more durable states:

  • witness_carrier.false_clean_reuse
  • witness_carrier.double_spent
  • witness_carrier.hostile
  • witness_carrier.captured
  • witness_carrier.burned
  • witness_carrier.quarantined
  • witness_carrier.recovery_only
  • future_reader.discharge_required
  • owed_reader.reuse_rebuttal_armed

Recovery hooks

A later route may repair the default only by reopening discharge with a visible scar:

  • late discharge receipt;
  • renewed limited mandate;
  • lawful annex naming the reader and scope;
  • substitute witness assignment;
  • public deferred-service bulletin;
  • sponsor unwind;
  • protected refusal receipt;
  • quarantine with recovery-only scar.

Recovery cannot erase that the carrier was once double-spent.

Non-goals

  • Not a generic failure event.
  • Not a hidden fatigue roll.
  • Not a timer expiry.
  • Not valid if it does not name the previous service, proposed next use, false reuse claim, hidden reader or limit, and future-reader effect.