@ AA6YQ comments below
[KC1BMD]: Yes, it seems the way to absolutely protect the amp in my situation (or the transceiver if I run barefoot with amp in standby) would be to control the switch electronically. I had thought a possible way might be for Commander to detect whether the powered off radio was connected (e.g. no ability to connect to or receive data from it's CI-V address) and then block any Commander data-com from the secondary CAT port (and maybe Net Serv port) in that case. Another more direct way could be to grey out the radio button so the powered off radio can't be selected.
@ "Preventing user error from causing equipment damage" is way outside the envelope for DXLab.
You mentioned: + There is nothing anywhere in Commander's documentation stating that it can detect that the selected Primary transceiver has been powered down and automatically select a Primary transceiver that is powered up. I would not expect to see that in a user guide/help documentation but only in a software internal or external specification document, which a user is not likely to have access to.
@ What would be the point of providing a capability that is not documented?
@ I use a spare Ameritron RCS-8V antenna switch to select the RF input to my amplifier. Relays controlled by Commander route RF from one transceiver or the other to my amplifier.
@ If you want automatic amplifier input selection to consider the power-on state of each radio, incorporate "power on" signals from each transceiver in the relay control logic. Be aware that "power on" signals can glitch or briefly oscillate during transitions between "power off" and "power on".