Manual Transfer Switch Custody / 手动切换钥匙羁押机制

Manual Transfer Switch Custody is the mechanism that keeps an emergency-power priority decision from teleporting into physical truth.

An emergency power ledger may correctly choose oxygen_pumps, archive_cabinet, security_doors, stage_lights, or cutroom as the protected surface. That choice is incomplete until the transfer object is visible: key, breaker tag, manual throw, override seal, switch-room witness, generator handoff slip, locked panel, or explicit absence.

Mechanic contract

A valid switch row records:

manual_transfer_switch_state:
  source_power_row:
    source_card: storyteller.card.emergency_power_ledger.v1 | equivalent
    power_source: <generator battery grid bridge route asset or explicit_absence>
    intended_powered_surface: <surface>
    shed_or_degraded_surface_from_priority: <surface or explicit_absence>
  transfer_object:
    object_kind: transfer_key | breaker_tag | override_seal | switch_room_witness | generator_handoff_slip | locked_panel | explicit_absence | equivalent
    object_state: held | missing | locked | stale | disputed | sponsor_held | security_held | ward_held | archive_held | borrowed_claimant_held | explicit_absence
    holder_or_absence: <holder or explicit_absence>
    operator_or_absence: <operator or explicit_absence>
    witness_or_seal_or_absence: <witness seal proof or explicit_absence>
  throw_claim:
    intended_surface: <surface>
    actual_or_disputed_thrown_surface: <surface or explicit_absence>
    harmed_reader_or_absence: <reader or explicit_absence>
    future_reader_or_route: <reader route slot custody object or route asset>

The mechanism fails if implementation records only power routed, generator online, switch used, or operator assigned.

Entry requirements

Open this mechanism when all are true:

1. a source emergency-power or blackout state needs a physical transfer;
2. the transfer object or explicit absence can be named;
3. holder or operator state can affect the intended powered surface;
4. a future reader can consume whether the throw was certified, witnessed, overridden, stale, or false;
5. the player can certify, assign, witness, split, delay, quarantine, accept override, or default;
6. no trigger depends on turn number, day/week interval, raw power count, dashboard health, or lens health.

Branch contract

Certify switch throw

The player binds transfer object, operator, witness/seal, intended surface, and actual throw.

Relief: intended power route becomes legible.

Cost: inspection heat, delay, holder exposure, or facility pressure rises.

Future: later reader accepts with switch scope.

Staffed operator throw

The player assigns a named operator, runner, floor captain, technician, or explicit absence.

Relief: physical execution risk falls.

Cost: operator risk, payroll, handler burden, crew load, or witness exposure rises.

Future: operator state becomes callable by later power, stage, facility, or custody content.

Public witness throw

The player makes the throw visible through fan/public witness, lawful observer, archive clerk, or floor log.

Relief: private override and false switch logs become harder.

Cost: sponsor retaliation, public anxiety, inspection heat, or witness exposure rises.

Future: public-only or addendum-required route.

Split or delayed throw

The player delays or sequences transfer between incompatible powered surfaces.

Relief: two routes remain partially viable.

Cost: degraded power, route delay, source ambiguity, or blackout risk rises.

Future: split-required, contradiction-pending, or costlier.

Accept override

The player accepts a holder’s switch priority.

Relief: one urgent surface stays powered.

Cost: sponsor capture, security lock, ward-only priority, archive-only priority, or borrowed-claim maturity rises.

Future: sponsor-only, lawful-only, public-only, captured, or recovery-only.

Quarantine panel

The player blocks use of a disputed switch row.

Relief: false switch proof is blocked.

Cost: current route delays, facility access pressure rises, or schedule scars.

Future: recovery-only until panel audit or release condition.

False switch default

The player hides holder state, misses operator/witness, trusts a stale tag, or lets a faction file the throw.

Relief: short-term pressure may drop.

Cost: wrong surface powered, hidden holder, blackout fold, route capture, or public distrust.

Future: 伪切换默认 records durable scar.

Counter and state surfaces

Every branch must mutate at least three values:

• relief: switch_legibility, intended_surface_powered, false_switch_risk_down, operator_assignment_clarity;
• cost: switch_holder_exposure, inspection_heat, facility_access_pressure, crew_load, sponsor_capture, public_anxiety, blackout_risk;
• future: switch_scope_required, operator_called_later, public_addendum_required, override_unwind_required, panel_recovery_only, route_costlier.

Default rule

伪切换默认 fires or arms when transfer object, holder, operator, witness/seal, actual thrown surface, or future reader is missing without explicit absence.

The default cannot be a warning banner. It must record who filed the switch result and how future power, facility, stage, custody, or blackout play changes.

Non-goals

• Not a universal equipment system.
• Not a lockpick puzzle.
• Not an inventory key.
• Not a replacement for Emergency Power Priority.
• Not valid unless holder state and actual throw change future playable state.