Witness Carrier Double-Spend Default / 见证承载双花默认
Witness Carrier Double-Spend Default fires or arms when a named witness, delegate, handler, editor, lawful officer, pirate relay, or receipt carrier is reused as if a previous service created clean capacity for every later reader.
The default is not a timer. It is the moment a sponsor, management table, lawful reader, archive reader, public table, route claimant, or broadcast reality consumes a carrier’s prior service as universal consent, proof, or callback satisfaction.
Trigger condition
trigger:
trigger_kind: state_pressure
discharge_receipt_present_or_required: true
previous_service_visible_or_explicit_absence: true
proposed_next_use_visible: true
original_scope_limit_hidden_or_overwritten: true
carrier_consent_to_reuse_absent_coerced_or_false: true
no_valid_discharge_review_selected: true
future_reader_or_route_consumes_false_reuse: true
no_fixed_turn_trigger: true
no_fixed_day_or_week_trigger: true
no_raw_witness_count_trigger: true
no_dashboard_or_lens_health_trigger: trueThe event must not be scheduled by fixed timing, chapter position, raw witness count, dashboard state, lens health, or generic escalation.
Required payload
witness_carrier_double_spend_payload:
source_service:
source_row_id: <row id or explicit_absence>
source_surface: oxygen_haircut_witness | callback_carrier_collision | fan_delegate_mandate | consent_debt_transfer | handler_burden | equivalent
original_owed_reader: <reader or explicit_absence>
original_service: <service or explicit_absence>
promised_limit_or_absence: <scope or explicit_absence>
carrier:
carrier_id: <named carrier or explicit_absence>
carrier_state_before: protected | paid | public_receipt_carrier | lawful_only | sponsor_bought | editor_masked | pirate_amplified | hostile | captured | absent | overdrawn | equivalent
protection_or_payment_state: protected | paid | escrowed | unpaid | exposed | sponsor_clause | pirate_risk | explicit_absence | equivalent
overwrite:
next_row_id: <row id or explicit_absence>
next_reader: <reader>
false_reuse_claim: witness_spoke_for_all | delegate_reused_for_all | prior_receipt_clean_for_all | lawful_annex_clean_for_public | pirate_relay_as_lawful_mandate | mask_as_public_consent | paid_once_so_available | equivalent
default_narrator: sponsor | management_table | archive | lawful_reader | public_table | route_claimant | broadcast_reality | equivalent
hidden_or_overwritten_reader: <reader>
hidden_or_overwritten_limit: <scope or explicit_absence>
aftermath:
carrier_state_after: hostile | captured | burned | absent | overdrawn | quarantined | false_clean | recovery_only | equivalent
consent_or_service_state_after: false_clean_reuse | sponsor_only | lawful_only | public_only | masked_false_public | pirate_misfiled | blocked | recovery_only | equivalent
future_reader_or_route_effect: callback_required | discharge_required | contradiction_pending | blocked | hostile | costlier | recovery_only | equivalentThe payload is invalid if it records only witness upset, staff fatigue, public anger, or route blocked without naming the previous service, proposed next use, false reuse claim, narrator, hidden reader/limit, and future effect.
Default branches
Paid-once reuse
The carrier was protected or paid once and management treats that payment as future availability.
counter_deltas:
witness_discharge_debt: +1
witness_retaliation_risk: +1
handler_burden: +1
future_reader_effect: discharge_required | hostile | recovery_onlyPublic receipt overreach
A public receipt is reused as if it represented fan public, lawful reader, sponsor, archive, and route asset at once.
counter_deltas:
public_receipt_distrust: +1
fan_oxygen_resentment: +1
broadcast_reality_drift: +1
future_reader_effect: public_only | contradiction_pending | callback_requiredLawful annex overreach
A lawful escrow or annex releases one scope, then another reader cites it as public or sponsor consent.
counter_deltas:
lawful_annex_debt: +1
hidden_reader_hostility: +1
archive_debt: +1
future_reader_effect: lawful_only | annex_required | costlierMask or pirate overreach
An edit mask or pirate relay protected the carrier, then a desk cites it as clean mandate proof.
counter_deltas:
archive_debt: +1
public_receipt_distrust: +1
inspection_heat: +1
future_reader_effect: masked_false_public | pirate_misfiled | recovery_onlySponsor capture reuse
Sponsor settlement buys a carrier’s testimony once and then claims future representation.
counter_deltas:
sponsor_stop_loss_pressure: -1
contract_capture: +1
mandate_reuse_pressure: +1
future_reader_effect: sponsor_only | hostile_witness | sponsor_unwind_requiredState after event
The event must leave one or more durable states:
witness_carrier.false_clean_reusewitness_carrier.double_spentwitness_carrier.hostilewitness_carrier.capturedwitness_carrier.burnedwitness_carrier.quarantinedwitness_carrier.recovery_onlyfuture_reader.discharge_requiredowed_reader.reuse_rebuttal_armed
Recovery hooks
A later route may repair the default only by reopening discharge with a visible scar:
- late discharge receipt;
- renewed limited mandate;
- lawful annex naming the reader and scope;
- substitute witness assignment;
- public deferred-service bulletin;
- sponsor unwind;
- protected refusal receipt;
- quarantine with recovery-only scar.
Recovery cannot erase that the carrier was once double-spent.
Non-goals
- Not a generic failure event.
- Not a hidden fatigue roll.
- Not a timer expiry.
- Not valid if it does not name the previous service, proposed next use, false reuse claim, hidden reader or limit, and future-reader effect.