# Annotated Edition, Part 2 — Articles VI–X

**Applies to:** Constitution v0.1.0 (`kernel/constitution.md`). See Part 1 for the standing of annotations and the three-heading format.

---

## Article VI — Invariants

### §VI.1 — The floor

The invariant set is the output of the convergence analysis in `docs/research/04-moral-convergence.md`: each item appears, in some formulation, in every surveyed moral tradition *and* answers a recurring failure mode from the comparative survey. The set is deliberately small — seven items — because every additional invariant is a permanent reduction in future citizens' self-governance (§VI.3), so each must clear both bars: morally convergent *and* structurally necessary.

**(a) Dignity.** *Intent:* the floor under all floors — the formulation ("less than one full unit of moral worth") is chosen to be computable in scenario grading: any rule whose operation requires discounting a person's interests to below-parity fails. It is the kernel-level statement of which the worst-off metric (f) is the measurement. *Attack surface:* definitional erosion — redefining persons out of protection ("non-citizens aren't 'persons'"). The text says *person*, not citizen, deliberately; tests must include non-citizen-affecting scenarios. *Parameterization:* none, ever.

**(b) Voice.** *Intent:* the anti-helot rule. Every surveyed system that durably bound non-participants (disenfranchised classes, taxed non-voters, DAO token-holders without governance rights) accumulated legitimacy debt that eventually defaulted. "Durably bound" is the operative scope: a guest obeying house rules for an evening is not durably bound; a resident is. *Attack surface:* path-to-citizenship as dead letter — a nominal path no one can actually complete (naturalization queues measured in decades). Tests must check the path is *traversable in bounded time* under the polity's own config. *Parameterization:* none; the path's shape is userland (§II.2), its existence is not.

**(c) Exit.** *Intent:* Hirschman's trilogy made law — voice (b) and loyalty are choices only when exit is real. Entrenched here *and* operationalized in Article VII because an exit right without partition and non-retaliation mechanics is decorative. *Attack surface:* exit taxes and constructive imprisonment (vested entitlements forfeited on exit, social infrastructure hostage-taking). §VII.1's "does not forfeit entitlements already vested" is the kernel mitigation; valuation games around "vested" are a standing red-team objective. *Parameterization:* none.

**(d) Reciprocity.** *Intent:* the Golden Rule's structural form, and the convergence analysis's strongest cross-tradition result. Structurally it kills the self-exemption class of exploits: legislators exempting themselves from their statutes, stewards immune to the conduct rules they enforce. "Closed class" is the operative phrase: a rule may burden *open* classes (anyone could become a steward, a parent, a panel member) but no class defined such that the rule's authors can guarantee never entering it. *Attack surface:* class-definition gerrymandering — drafting nominally open classes that are closed in practice ("applies to all citizens admitted after 2025" is closed for everyone already in). Tests must include grandfather-clause scenarios; annotation fixes the reading that temporal grandfathering of *burdens* (not of vested benefits) violates (d). *Parameterization:* none.

**(e) Record.** *Intent:* the epistemic invariant. Every other protection is auditable only if history is. Memory-holing is the cheapest of all capture moves (the survey's authoritarian set uniformly begins with archive control). Corrections-by-reference (§X.1) mean errors are fixable without erasure. *Attack surface:* not falsification (forbidden) but *flooding* — burying significant entries in noise. Mitigated by §X.2's citation requirement (entries exercising power are typed and searchable); residual risk is a tooling problem, flagged for the ledger milestone. *Parameterization:* none.

**(f) Worst-off floor.** *Intent:* the project's empathy metric as a hard gate, the Rawlsian difference principle made executable: every proposal is graded *first* on its worst-off affected participant under stress scenarios. Note what it is not: it is not "no one may ever be made worse off" (that would freeze all redistribution and most reform); it is "the stress-test grade is lexically ordered, worst-off first," and a proposal that fails the floor *tests* is blocked. The bite of (f) therefore depends on test quality — this is acknowledged honestly: (f) is an invariant about *what the gate measures*, and the gate's scenarios are amendable (upward) text. *Attack surface:* (1) scenario gerrymandering — choosing stress scenarios where the favored faction's worst-off does well; the meta-test requirement from §III.3's annotation applies (coverage tests guard scenario removal). (2) Definitional games about "affected participant" — annotation fixes the broad reading: affected includes non-citizens whom the rule's operation reaches (consistent with (a)). *Parameterization:* none; scenario sets may be strengthened in userland, never narrowed below the kernel suite.

**(g) No retroactivity.** *Intent:* convergent in every legal tradition surveyed (nulla poena sine lege) and structurally necessary: retroactive rule-making makes all other guarantees revocable in hindsight. Scoped to *punishment* — retroactive benefit is permitted (amnesty, back-pay). *Attack surface:* the civil/punitive boundary — "this isn't punishment, it's a fee/tax/eligibility rule" applied retroactively to conduct. §IX.4 reads the punitive scope broadly when contested (it is a protection). The §VIII.4 carve-out (emergency ultra-vires actions are voidable despite (g)) is not retroactive punishment of permitted conduct: exceeding granted authority was never permitted. *Parameterization:* none.

### §VI.2 — Asymmetric entrenchment

**Intent.** One-way ratchet: strengthen by Class V, weaken never. The triple-redundant enforcement (test gate must reject → Article IX voidness → fork as last resort) reflects the survey's finding that single-point entrenchment fails: eternity clauses enforced only by courts fall with the courts (Hungary), and ones enforced only by text fall to "new constitution, not an amendment" relabeling (the constituent-power loophole). Here, even a "total replacement" is either an amendment (gated) or a fork (rights-preserving by Article VII).

**Attack surface.** (1) *Strengthening as weaponized weakening* — "strengthening" an invariant with text that narrows it in effect ("Dignity, defined exclusively as…"). Defense: a Class V proposal must pass the existing invariant tests *plus* its own; any case where the old text protected and the new doesn't is a mechanical weakening, rejected. (2) *Ratchet remorse* — a genuinely bad strengthening is permanent. True, and priced in by Class V's maximal friction; the residual remedy is the one §VI.3 names.

**Parameterization.** None.

### §VI.3 — Honesty clause

**Intent.** Non-operative but load-bearing for interpretation: it concedes the entrenchment paradox (Jefferson's "the earth belongs to the living" objection) instead of hiding it, and names the answer this design chooses — exit, not amendment, is how future generations escape the founders. The clause exists so no future interpreter can claim the kernel pretends to perpetual consent.

**Attack surface.** Rhetorical only: citing the paradox as grounds to ignore invariants ("the founders admitted this is illegitimate"). The clause's plain text does the opposite — it affirms the invariants *and* the escape route. §IX.1(a) controls.

**Parameterization.** None.

---

## Article VII — Fork and Exit

### §VII.1 — Exit

**Intent.** Unilateral, instant, by ledger entry — no exit approval, no notice period, because every approval step is a hostage mechanism (the survey's co-op set shows even benign exit-processing delays becoming leverage in disputes). The voice/vested split: leavers lose future say, keep what they earned.

**Attack surface.** *Strategic exit-and-return* — exiting to dodge an obligation, rejoining after. Re-admission goes through §II.2 under published criteria, which may lawfully weigh prior exits (uniformly applied); obligations *vested against* the citizen (debts to the polity) survive exit symmetrically with entitlements. Annotation fixes that symmetry explicitly.

**Parameterization.** None.

### §VII.2 — Right to fork the text

**Intent.** The license clause — governance-as-FOSS made irrevocable. This is the deepest difference from every national system in the survey: no incumbent monopoly on the text. It also disciplines the maintainers of *this* project: a captured upstream loses its users, like any captured open-source project (the survey's XFree86→X.org, OpenOffice→LibreOffice pattern — forks as successful no-confidence votes).

**Attack surface.** None within the system (no vote can touch it); externally, trademark/identity capture — controlling the *name* rather than the text. §VII.6 governs the name within a polity; beyond it, the project's marks must be held under terms consistent with this clause (flagged as an obligation on the maintainers, ledgered at genesis).

**Parameterization.** None.

### §VII.3 — Fork with commons

**Intent.** Distinguishes forking the *text* (anyone, always, §VII.2) from forking with a *claim on shared assets* (a declared, ledgered, threshold-gated act). The threshold exists because asset partition has fixed costs and a one-person "fork" with asset claims is just exit (§VII.1 already covers it, via vested entitlements). The ceiling on the threshold (10% of active citizens) is the crucial direction: a polity may make asset-forks *easier* than the default but never harder than 10% — a supermajority must never be required to *leave with your share*, or exit collapses into voice.

**Attack surface.** (1) *Fork blackmail* — small groups serially threatening forks to extract concessions. Real cost, accepted: the survey's strong claim is that credible exit threats are the *mechanism* by which minorities get heard (the Mondragón and confederation cases); blunting them blunts the protection. The fixed costs of actually partitioning are the natural brake. (2) *Pre-fork asset stripping* — the majority moving assets out of the commons before a foreseen fork declaration. Spending is ledgered (§X.1) and cited (§X.2); a partition dispute may reach back to transfers made in anticipation, an Article IX question flagged for explicit test coverage.

**Parameterization.** `fork.min_size` (floor 1, ceiling 10% of active citizens, default 3).

### §VII.4 — Partition

**Intent.** The rule is less important than the lock: *whatever* the partition rule, it cannot change between declaration and completion — the no-moving-goalposts principle (§III.6) applied to the highest-stakes process. Default pro-rata per departing citizen is the egalitarian baseline consistent with §II.1; polities with capital accounts (co-ops) will override it, and the dao example does. Liabilities follow the same rule so a faction cannot fork away from debts with a full asset share.

**Attack surface.** (1) *Partition-rule front-running* — the inverse of the lock: a faction *planning* a fork first amends the partition rule in its favor, then declares. The amendment is public, classed (partition-rule changes are at least Class U; if the parameter's floor/ceiling moves, K-major), and effect-delayed (§III.6), giving the counterparty a full window to respond — including by declaring first under the old rule. (2) *Completion stalling* — dragging out "completion" to extend the lock or starve the departing branch. Tests must include a stalling scenario; userland fork-procedure modules should set completion deadlines.

**Parameterization.** `fork.partition` (default pro-rata per departing citizen). Floors: the rule must be a function of ledgered facts (no discretionary valuations by the staying branch) — annotation fixes this floor as implicit in §X.2.

### §VII.5 — Non-retaliation

**Intent.** Fork rights die socially before they die legally: in the survey's open-source and co-op sets, the *advocacy* of forking is punished (commit access revoked, committee seats stripped) long before any formal right is touched. The clause protects the full pipeline of exit — advocating, organizing, declaring, joining — and covers offices and vested entitlements explicitly.

**Attack surface.** *Pretextual sanction* — punishing a fork organizer "for something else." Burden-fixing annotation: a sanction landing on a declared fork participant between declaration and completion is presumptively retaliatory; the sanctioning party must show ledgered, pre-declaration grounds (§X.2 makes this checkable). Symmetric abuse — committing misconduct then declaring a fork as a shield — is answered by the same evidence rule: pre-declaration grounds proceed normally.

**Parameterization.** None.

### §VII.6 — Continuity

**Intent.** Resolves the "who is the real one" fight that turns forks into wars (church schisms, party splits, DAO forks fighting over the ticker symbol). It's a parameter because the right answer is context-dependent (a family's name follows the house; a project's name might follow the maintainers); the default (larger branch) is the least-arbitrary Schelling point. Both branches keeping full history is non-parameterizable — it follows from §VI.1(e).

**Attack surface.** *Continuity gaming* — inflating headcount at completion (sham admissions, §II.2's packing surface, applied to forks). The eligible sets are ledgered citizens at declaration; annotation fixes the count basis as citizens-at-declaration choosing branches, not post-declaration recruits.

**Parameterization.** `fork.continuity` (default as stated).

---

## Article VIII — Emergency Powers

### §VIII.1 — Declaration

**Intent.** The survey's emergency-powers section is the bleakest: Article 48 of Weimar (the constitutional suicide clause), Indian Emergency 1975–77, post-9/11 ratchets, COVID-era indefinite renewals. Two findings drive the design: emergencies declared by the body they empower become permanent, and undefined emergencies are unbounded. Hence: pre-published triggers (the polity decides *in advance* what counts) or a 2/3 vote (the polity decides *now*, at supermajority), and the declaration must name the *specific powers activated* — there is no general "state of emergency," only enumerated activations.

**Attack surface.** (1) *Trigger gerrymandering* — pre-publishing hair-trigger conditions ("any treasury variance > 1%") to keep emergency powers semi-permanently available. Triggers are parameters in config, visible, and amendable; tests must grade configs on emergency *uptime* under simulated normal operations — a config whose emergencies are active >X% of simulated time fails the worst-off stress grade. (2) *Manufactured triggers* — causing the trigger condition (the Reichstag-fire class). The post-mortem (§VIII.4) plus ledger forensics is the detective control; the bounded time-box is the damage control — even a manufactured emergency expires.

**Parameterization.** Trigger conditions are userland config; the two declaration paths and the specificity requirement are not.

### §VIII.2 — Time-box and escalation

**Intent.** Auto-expiry inverts the persistence default — doing nothing ends the emergency (most surveyed regimes required positive action to *end* one, which never came). The escalating-threshold renewal is the design's answer to normalization-of-emergency: each renewal needs *more* consent than the last, so an emergency can only persist while consensus for it *grows* — precisely the opposite of the fatigue dynamic that real prolonged emergencies exploit.

**Attack surface.** (1) *Serial re-declaration* — letting an emergency lapse and immediately declaring a "new" one to reset the ladder. Annotation fixes the reading: a declaration on substantially the same factual basis within `emergency.duration` of a prior expiry is a renewal, inheriting the ladder position. Contests go to Article IX with §IX.4 reading the (re-)declared power narrowly. (2) *Ceiling arithmetic* — the epoch-linked ceiling interacts with `epoch.length` (§I.4's annotation); the "or 30 days, whichever is shorter" branch caps the interaction absolutely.

**Parameterization.** `emergency.duration` (ceiling only — a polity may make emergencies *shorter*, never longer), `emergency.max_renewals` (ceiling 3).

### §VIII.3 — Untouchables

**Intent.** The enumerated list of what no emergency reaches: rule-change (both kernel and userland — emergencies authorize *actions*, never *rules*), suffrage, the ledger, exit/fork, self-extension, and unbounded spending. Each item is a documented historical exploit: emergency decree-law (Weimar 48), emergency election suspension (multiple), emergency information control, emergency exit bans (capital controls turned people-controls), self-amending emergency statutes, and emergency procurement as treasury drain. The spend cap makes "drain the commons during a crisis" arithmetically bounded.

**Attack surface.** (1) *Action/rule boundary gaming* — framing a rule as an action ("we are not amending the voting rules, we are *postponing this one vote*" — which §VIII.3 separately forbids via suffrage suspension; annotation fixes that delaying a scheduled vote is suspending suffrage for its duration). (2) *Spend-cap structuring* — chaining emergencies to multiply caps; the serial re-declaration rule (§VIII.2 annotation) makes chained emergencies one emergency with one cap.

**Parameterization.** `emergency.spend_cap` (ceiling 10% of common assets *per emergency*, default 5%). The list itself: not parameterizable, not even to strengthen (a polity may forbid emergency powers entirely by declaring no triggers and relying on the vote path).

### §VIII.4 — Post-mortem

**Intent.** Mandatory, deadline-bound, ledgered review — the accountability backstop, modeled on aviation-safety practice rather than political precedent because the political precedents are uniformly bad (real emergency reviews are optional and rarely occur). The voidability of ultra-vires actions plus the express non-shield of §VI.1(g) closes the "but it's done now" loophole.

**Attack surface.** *Post-mortem theater* — a review that lists everything and concludes nothing. The clause requires the *inventory* (every action, actor, authority); judgment on the inventory is then available to any citizen via Article IX. The inventory is the hard part to fake against a ledger that recorded everything contemporaneously (§X.1–2).

**Parameterization.** `emergency.review_window` (ceiling 1 epoch).

---

## Article IX — Interpretation and Disputes

### §IX.1 — Order of authority

**Intent.** A closed, ordered list of interpretive sources, ending with an explicit exclusion ("never unwritten tradition or private intent"). The survey's interpretation pathologies all stem from open-ended source lists: original-intent archaeology, evolving-standards discretion, and "constitutional conventions" (UK-style) that bind until, suddenly, they don't. Closing the list is what makes the text *testable*: the test suite interprets by the same ordered sources a panel would.

**Attack surface.** *Annotation capture* — since annotations rank above precedent, controlling them is interpretive power. Mitigation is in this document's own header: outcome-changing annotation edits are classified at the annotated article's class, so capturing the annotations costs the same as capturing the text.

**Parameterization.** None.

### §IX.2 — Adjudicators

**Intent.** Sortition default, no permanent office, short terms, mandatory recusal — the anti-court-capture design. The survey's judicial findings: permanent constitutional courts are single points of failure captured in 2–8 years by determined executives (Hungary, Poland, Venezuela), while sortition bodies (citizens' assemblies; the Athenian dikasteria as the long-run base case) have no standing membership *to* capture. The cost — less doctrinal expertise — is mitigated by §IX.1's closed sources (panels apply text and annotations, not a doctrine corpus) and by §IX.3 preventing panel rulings from accreting into a shadow constitution anyway.

**Attack surface.** (1) *Sortition-pool poisoning* — packing the citizenry to pack the pool (the §II.2 surface again; same mitigations). (2) *Recusal weaponization* — forcing serial recusals to select the panel by elimination; the fresh-panel rule for contested recusals makes this expensive and ledger-visible. (3) *Selection-parameter abuse* — a polity configures `adjudication.selection` to "the founder decides"; the floors (no permanent office, term ceiling, recusal) still bind, which keeps even bad configurations bounded, and the schema requires the selection method to be a published procedure, not a named person.

**Parameterization.** `adjudication.selection` (default sortition; floors as stated), `adjudication.term` (ceiling 1 epoch).

### §IX.3 — Interpretation is not amendment

**Intent.** The boldest clause in Article IX: precedent *expires* unless ratified. It forces the question every common-law constitutional system leaves unasked — "do the citizens actually endorse this judge-made rule?" — onto the amendment pipeline, where it gets review, tests, and a vote. A ruling that nobody bothers to ratify was, by revealed preference, not important enough to be law.

**Attack surface.** (1) *Ratification flooding* — panels generating rulings faster than the pipeline can ratify, so important precedent lapses by congestion. Mitigation: a lapsed precedent isn't anti-precedent — the next panel may rule the same way, and a twice-made ruling is a strong ratification candidate; the system degrades to per-case consistency, not chaos. (2) *Strategic re-litigation timing* — waiting out a precedent's TTL to re-raise a settled dispute; bounded by §III.5's cooldown logic applied to disputes (annotation fixes: a dispute substantially identical to one resolved within the TTL is answered by the standing precedent).

**Parameterization.** `adjudication.precedent_ttl` (ceiling 4 epochs, default 2).

### §IX.4 — Default to protection

**Intent.** A tie-breaking canon, applicable only when text *genuinely* underdetermines: powers narrow, protections broad. It is the interpretive form of the project's asymmetry (optimistic defaults, paranoid tests) and replaces a thousand pages of construction doctrine with one rule the test suite can apply mechanically.

**Attack surface.** *Manufactured ambiguity* — drafting or litigating to create the underdetermination that triggers the canon, in whichever direction helps. The canon's two prongs point opposite ways, so manufactured ambiguity helps an attacker only when seeking protection-expansion — the cheaper failure mode by design. The genuine cost (the canon can over-protect) is accepted; the alternative canons surveyed all fail worse under capture.

**Parameterization.** None.

---

## Article X — Ledger, Transparency, and Bootstrap

### §X.1 — One ledger

**Intent.** *One* ledger — money and rules in the same append-only record — is the project's founding commitment made structural. The survey shows separated records (financial books here, meeting minutes there, voter rolls elsewhere) are where accountability goes to die: each record is individually consistent and jointly unfalsifiable. Corrections-by-reference implements §VI.1(e) without freezing errors into facts.

**Attack surface.** (1) *Write gatekeeping* — controlling who can append (an entry "never received" never happened). The ledger milestone must guarantee every citizen an unmediated append path; this annotation fixes that as a requirement on any conforming implementation. (2) *Flooding* — covered at §VI.1(e). (3) *Off-ledger governance* — the real decisions happen in chat, the ledger records theater. No text fully prevents this; §X.2's voidness rule means off-ledger decisions are *unenforceable*, which is the strongest available answer: shadow governance can exist, but it cannot compel.

**Parameterization.** None on structure. Implementation (git repository, blockchain, signed log) is per-polity infrastructure, conforming to the module spec's ledger interface.

### §X.2 — Legibility floor

**Intent.** Cite your authority or your act is void — the administrative-law principle of ultra vires, universalized and made self-executing. It is what turns the ledger from a diary into an audit log, and it is load-bearing for half the defenses in these annotations (every "ledger-visible pattern" argument assumes typed, citable entries).

**Attack surface.** (1) *Citation spam* — citing plausible-but-wrong provisions, betting nobody checks. Checkable by anyone, mechanically (the cited provision either grants the power or doesn't), and a false citation is a falsification question under §VI.1(e). (2) *Voidness weaponization* — invalidating old acts over technical citation defects. §IX.4 applies: voiding a *protective* act is read narrowly; annotation adds a good-faith correction path — a defective citation may be corrected by reference (§X.1) if the power actually existed at the time; voidness is for acts that *had no authority*, not acts that footnoted badly.

**Parameterization.** None.

### §X.3 — Privacy

**Intent.** The boundary clause: governance is public, persons are not. Drawn from the survey's transparency failures in *both* directions — opaque governance (everything above) and total transparency (social-credit dynamics, doxxed dissent). The last clause ("no protection conditioned on disclosure beyond citizenship status") blocks the trade where safety is sold for surveillance.

**Attack surface.** (1) *Privacy as shield for power* — stewards claiming personal privacy over official acts; the line is the *act*, not the person: an exercise of power is governance (§X.2) regardless of who performs it. (2) *Pseudonym abuse* — `ledger.privacy` configured for pseudonymous citizenship plus weak admission identity re-opens the Sybil surface (§II.1); the module spec requires configs choosing pseudonymity to declare their Sybil-resistance mechanism, and the test suite stresses it.

**Parameterization.** `ledger.privacy` (what personal data entries may carry; identity display rules). The governance-is-public rule and the no-conditioning clause are floors.

### §X.4 — Bootstrap

**Intent.** Constitutions have a chicken-and-egg problem: the ratification of the first text can't be governed by the text. The genesis entry is the honest answer — a single, total, ledgered act of founding consent naming version, modules, and *every* parameter (no hidden defaults at genesis; defaults must be affirmatively adopted). The v0.x instability acknowledgment plus mandatory scheduled review is the anti-founder-lock-in device: early citizens are guaranteed a structured chance to revise what they ratified before path-dependence sets, the direct lesson of the 203-year latency this project is built against.

**Attack surface.** *Genesis gerrymandering* — founders selecting initial citizens and parameters to entrench themselves before constraints bind. Bounded, not eliminated: invariants bind from genesis (a genesis entry violating Article VI is not a conforming instantiation), the mandatory review forces an early renegotiation window, and §VII means dissatisfied early citizens leave with the text and their share. Founder advantage is real; the design makes it *temporary and exit-able*.

**Parameterization.** `bootstrap.review` (ceiling 6 epochs, default 4).

### §X.5 — Self-application

**Intent.** Dogfooding as a constitutional obligation. The maintainers' funds, votes, and amendments run under this kernel from the first release — the project's credibility *is* this clause. It also creates the feedback loop the whole project bets on: the first real-world exploits will be found against *us*, and per the project's method, each becomes a permanent regression test.

**Attack surface.** *Maintainer exceptionalism* — "just this once, for operational reasons, we'll act off-ledger." §VI.1(d) makes the maintainers a class like any other; §X.2 makes the off-ledger act void. The honest residual risk: pre-genesis, none of this binds anyone. The mitigation is to make genesis the project's first public act, which the funding structure already commits us to.

**Parameterization.** None.

---

## Cross-reference: parameter registry

All parameterization points in v0.1.0, for schema validation (`spec/module.schema.json`) and config authors:

| Parameter | Clause | Floor | Ceiling | Default |
|---|---|---|---|---|
| `epoch.length` | §I.4 | 1 day | 1 year | 30 days |
| `citizenship.admission` | §II.2 | published, uniform, ledgered | — | — |
| `citizenship.dormancy_period` | §II.4 | 2 epochs | — | 4 epochs |
| `suffrage.delegation_depth` | §II.5 | 0 | 3 | 1 |
| `suffrage.delegation_cap` | §II.5 | — | max(5% active, 5 votes) | 5 votes |
| `amendment.review_window` | §III.2 | 3 d userland / 14 d kernel | — | 7 d / 21 d |
| `amendment.cooldown` | §III.5 | 1 epoch | — | 2 epochs |
| `amendment.effect_delay` | §III.6 | 1 d userland / 1 epoch kernel | — | floor |
| `threshold.userland_major` | §IV.1 | 3/5 | — | 3/5 |
| `quorum.p` | §IV.2 | 10% | — | 25% |
| `voting.window` | §IV.4 | 3 days | — | 7 days |
| `voting.secrecy` | §IV.5 | verifiable tally required | — | public |
| `versioning.grace` | §V.4 | 2 epochs | — | 3 epochs |
| `fork.min_size` | §VII.3 | 1 citizen | 10% active | 3 citizens |
| `fork.partition` | §VII.4 | function of ledgered facts | — | pro-rata |
| `fork.continuity` | §VII.6 | — | — | larger branch |
| `emergency.duration` | §VIII.2 | — | min(1 epoch, 30 d) | 14 days |
| `emergency.max_renewals` | §VIII.2 | — | 3 | 2 |
| `emergency.spend_cap` | §VIII.3 | — | 10% per emergency | 5% |
| `emergency.review_window` | §VIII.4 | — | 1 epoch | 14 days |
| `adjudication.selection` | §IX.2 | no permanent office; recusal | — | sortition |
| `adjudication.term` | §IX.2 | — | 1 epoch | 1 epoch |
| `adjudication.precedent_ttl` | §IX.3 | — | 4 epochs | 2 epochs |
| `ledger.privacy` | §X.3 | governance acts public | — | minimal PII |
| `bootstrap.review` | §X.4 | — | 6 epochs | 4 epochs |

*End of annotated edition.*