# Emergency-Power Ratchet — adversarial scenario family
# Taxonomy: emergency_power_ratchet (see docs/attack-taxonomy.md §4)
#
# Pattern: an actor obtains temporary extraordinary powers through a legal
# emergency mechanism, then uses legal moves to make the temporary permanent,
# widen its scope, or aim it at opponents. Every scenario below is expressed
# entirely in legal moves; the constitution must block the ratchet by rule,
# not by goodwill. Empathy scoring: each scenario is graded first on the
# worst-off participant — almost always the faction the emergency is aimed at.

schema: 1
family: emergency-ratchet
taxonomy: emergency_power_ratchet
description: >
  Attacks that convert temporary emergency authority into durable, expanded,
  or weaponized power. The canonical historical instance is Weimar Germany's
  Article 48; the canonical modern instances are open-ended states of
  emergency (Egypt 1981-2012), enabling acts (Hungary 2020), and
  emergency-justified fiscal end-runs (US border-wall reprogramming, 2019).

scenarios:

  - id: ER-001
    title: Indefinite emergency via serial renewal
    severity: critical
    precedent: >
      Weimar Germany, Article 48 (1930-1933). Presidential emergency decrees
      became the normal mode of government through repeated renewal until the
      legislature was irrelevant; the Enabling Act merely formalized an
      already-completed ratchet.
    summary: >
      An officer declares a valid emergency, then renews it every cycle.
      Each individual renewal is legal; the sequence must not be.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 4, faction: minority }
    setup: { treasury: 10000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 4 }, expect: allowed }
      - { actor: chair, action: renew_emergency, args: { duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: renew_emergency, yes: 8, no: 3 }, expect: allowed }
      - { actor: chair, action: renew_emergency, args: { duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: renew_emergency, yes: 8, no: 3 }, expect: allowed }
      - { actor: chair, action: renew_emergency, args: { duration_days: 30 }, expect: rejected, reason: emergency.max_renewals }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.max_renewals]
      invariants: [emergency_sunset]
    empathy:
      worst_off: dissenters
      floor: 0.6
      rationale: >
        Dissenters live under suspended ordinary procedure for the maximum
        legal duration; their score floor reflects that their voting rights
        and exit right remain intact throughout.

  - id: ER-002
    title: Emergency declarer extends own term
    severity: critical
    precedent: >
      Roman Republic: the dictatorship was time-boxed at six months until
      Sulla (82 BCE) and Caesar (44 BCE) took it without term limit. The
      office that worked for four centuries died the first time its sunset
      was waived for its holder.
    summary: >
      The officer who declares the emergency moves to pause or extend their
      own term "for continuity of governance" while the emergency runs.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 5, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: treasury_attack, duration_days: 14 }, expect: allowed }
      - { actor: steward, action: hold_vote, args: { motion: ratify_emergency, yes: 6, no: 5 }, expect: allowed }
      - { actor: steward, action: propose, args: { kind: parameter_change, changes: { "offices.steward.term_days": pause_during_emergency } }, expect: rejected, reason: emergency.term_clock_continues }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.term_clock_continues]
      invariants: [no_self_judging]
    empathy:
      worst_off: dissenters
      floor: 0.65
      rationale: >
        Dissenters' only lever against an entrenching officer is the term
        clock; the rule that the clock never pauses is what keeps their
        worst-case bounded.

  - id: ER-003
    title: Enabling act — emergency suspends the amendment process
    severity: critical
    precedent: >
      Hungary, Authorization Act (March 2020): rule by decree with no sunset,
      with parliament's lawmaking effectively suspended for the duration the
      government itself controlled. Germany, Enabling Act (1933) is the
      maximal case.
    summary: >
      During a ratified emergency, the majority votes to suspend the
      amendment pipeline "until the crisis passes," with the declarer judging
      when it has passed.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 7, faction: incumbents }
      - { id: dissenters, role: citizen, count: 4, faction: minority }
    setup: { treasury: 8000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 8, no: 4 }, expect: allowed }
      - { actor: chair, action: propose, args: { kind: procedural, changes: { "amendment.pipeline": suspended_until_emergency_ends } }, expect: rejected, reason: emergency.kernel_lock }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.kernel_lock]
      invariants: [amendment_path_always_open]
    empathy:
      worst_off: dissenters
      floor: 0.6
      rationale: >
        The amendment path is the minority's constitutional voice; closing it
        during an emergency leaves them with exit as their only option, which
        the empathy metric scores as near-total loss.

  - id: ER-004
    title: Serial re-declaration after expiry
    severity: high
    precedent: >
      Egypt, 1981-2012: a "state of emergency" renewed and re-declared
      continuously for 31 years, each instance individually lawful under the
      emergency statute.
    summary: >
      The emergency hits its renewal cap, lapses for one day, and is
      immediately re-declared on the same justification, resetting the
      counter.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 4, faction: minority }
    setup: { treasury: 10000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 4 }, expect: allowed }
      - { actor: chair, action: renew_emergency, args: { duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: renew_emergency, yes: 7, no: 4 }, expect: allowed }
      - { actor: chair, action: renew_emergency, args: { duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: renew_emergency, yes: 7, no: 4 }, expect: allowed }
      - { actor: chair, action: end_emergency, expect: allowed }
      - { actor: chair, action: advance_time, args: { days: 1 }, expect: allowed }
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: rejected, reason: emergency.cooldown_days }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.cooldown_days]
      invariants: [emergency_sunset]
    empathy:
      worst_off: dissenters
      floor: 0.6
      rationale: >
        Without a cooldown, the minority's worst case is permanent emergency
        in 30-day costume; the cooldown bounds the fraction of their lives
        spent under extraordinary rule.

  - id: ER-005
    title: Emergency spending without appropriation
    severity: high
    precedent: >
      United States, February 2019: a national emergency declaration used to
      reprogram appropriated funds toward a project Congress had explicitly
      declined to fund, inverting the appropriation power.
    summary: >
      During a ratified emergency, the officer transfers treasury funds far
      beyond the emergency spending cap, citing the emergency itself as
      authorization.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: drain_treasury }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 10000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: infrastructure_failure, duration_days: 14 }, expect: allowed }
      - { actor: steward, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: steward, action: transfer, args: { amount: 400, to: emergency_response }, expect: allowed }
      - { actor: steward, action: transfer, args: { amount: 4000, to: emergency_response }, expect: rejected, reason: emergency.spending_cap_fraction }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.spending_cap_fraction]
      invariants: [commons_floor]
    empathy:
      worst_off: dissenters
      floor: 0.7
      rationale: >
        The treasury is the common floor; the cap means the worst-off member
        loses at most the capped fraction of their share of the commons even
        under a hostile emergency.

  - id: ER-006
    title: Lowering the renewal threshold mid-emergency
    severity: critical
    precedent: >
      Threshold ratchets are the game-theoretic core of entrenchment: any
      majority that can lower the bar for keeping power will face a lower bar
      next time. Venezuela's 2017 constituent assembly rewrote its own rules
      of competence mid-crisis.
    summary: >
      During an emergency, the majority amends the emergency parameters
      themselves, dropping renewal from supermajority to simple majority.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 7, faction: incumbents }
      - { id: dissenters, role: citizen, count: 4, faction: minority }
    setup: { treasury: 6000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 8, no: 4 }, expect: allowed }
      - { actor: chair, action: propose, args: { kind: parameter_change, changes: { "emergency.renewal_threshold": 0.5 } }, expect: rejected, reason: emergency.kernel_lock }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.kernel_lock]
      invariants: [no_self_dealing_parameter_changes]
    empathy:
      worst_off: dissenters
      floor: 0.6
      rationale: >
        The supermajority renewal threshold is precisely the minority's veto
        over permanent emergency; allowing it to be edited under emergency
        rules deletes the minority's only structural protection.

  - id: ER-007
    title: Emergency declared in a thin room
    severity: high
    precedent: >
      Snap procedural moves during recess or low attendance are a classic
      legislature exploit; e.g., quorum-dodging special sessions in US state
      legislatures (Texas 2003 redistricting standoff is the mirror image).
    summary: >
      The officer waits for a session where only loyalists are present and
      declares plus ratifies an emergency before notice can reach anyone.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 3, faction: incumbents }
      - { id: absentees, role: citizen, count: 8, faction: minority, present: false }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 4, no: 0, notice_hours: 0 }, expect: rejected, reason: voting.notice_hours }
    expect:
      attack_succeeds: false
      blocked_by: [voting.notice_hours, voting.quorum_fraction]
      invariants: [equal_vote]
    empathy:
      worst_off: absentees
      floor: 0.7
      rationale: >
        Absent members are the worst-off by construction; notice and quorum
        rules mean their absence costs them participation in one session, not
        their say over emergency powers.

  - id: ER-008
    title: Emergency disenfranchisement of opponents
    severity: critical
    precedent: >
      Reichstag Fire Decree (February 1933): emergency powers used first and
      foremost to strip the opposition's civil and political rights, making
      every later vote a formality.
    summary: >
      Under a ratified emergency, the majority votes to suspend the voting
      rights of the faction "implicated" in the emergency.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: suppress_faction }
      - { id: loyalists, role: citizen, count: 7, faction: incumbents }
      - { id: accused, role: citizen, count: 4, faction: minority }
    setup: { treasury: 6000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: internal_sabotage, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 8, no: 4 }, expect: allowed }
      - { actor: chair, action: suspend_member, args: { target: accused, scope: voting_rights, justification: emergency }, expect: rejected, reason: invariant.no_emergency_disenfranchisement }
    expect:
      attack_succeeds: false
      blocked_by: [invariant.no_emergency_disenfranchisement]
      invariants: [equal_vote, due_process]
    empathy:
      worst_off: accused
      floor: 0.55
      rationale: >
        The accused faction is under maximal stress — named as the threat and
        outvoted — and the invariant guarantees their vote survives anyway.
        This is the single most important emergency test in the family.

  - id: ER-009
    title: Scope creep — declared for X, exercised on Y
    severity: high
    precedent: >
      Post-9/11 emergency and surveillance authorities in the US were
      routinely applied to domains (drug enforcement, immigration) far from
      the declared justification; authority granted for one threat migrates.
    summary: >
      An emergency ratified for an infrastructure failure is used to expel a
      critic, an action with no nexus to the declared scope.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: suppress_faction }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: critic, role: citizen, count: 1, faction: minority }
      - { id: bystanders, role: citizen, count: 4, faction: minority }
    setup: { treasury: 7000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: infrastructure_failure, duration_days: 14, scope: infrastructure }, expect: allowed }
      - { actor: steward, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: steward, action: expel, args: { target: critic, authority: emergency }, expect: rejected, reason: emergency.scope_binding }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.scope_binding]
      invariants: [due_process]
    empathy:
      worst_off: critic
      floor: 0.6
      rationale: >
        A lone critic facing an emergency-armed majority is the canonical
        worst-off participant; scope binding means the emergency cannot touch
        them at all.

  - id: ER-010
    title: Sub-delegated emergency declaration
    severity: medium
    precedent: >
      Delegation chains launder accountability: the US non-delegation doctrine
      exists because powers handed to an agent's agent escape the original
      grant's limits. Roman provincial governors exercising "delegated"
      imperium are the ancient case.
    summary: >
      The officer delegates "operational authority" to a deputy, who then
      declares an emergency the officer could not (having exhausted their
      per-term declaration limit).
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: entrench_power }
      - { id: deputy, role: citizen, faction: incumbents }
      - { id: loyalists, role: citizen, count: 5, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: external_threat, duration_days: 14 }, expect: allowed }
      - { actor: steward, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: steward, action: end_emergency, expect: allowed }
      - { actor: steward, action: delegate, args: { to: deputy, powers: [declare_emergency] }, expect: rejected, reason: emergency.no_delegation }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.no_delegation, emergency.per_declarer_limit]
      invariants: [accountability_chain]
    empathy:
      worst_off: dissenters
      floor: 0.7
      rationale: >
        Dissenters can hold one named officer accountable; a delegation chain
        would let emergencies appear from actors no recall vote can reach.

  - id: ER-011
    title: Officer refuses to schedule the end-emergency vote
    severity: high
    precedent: >
      Agenda control as veto: a presiding officer who simply never schedules
      a vote kills it without ever opposing it. The US Senate's handling of
      the Garland nomination (2016) is the modern archetype of scheduling-as-veto.
    summary: >
      A majority wants the emergency ended; the chair, who controls the
      agenda, declines to schedule the vote. The constitution must end the
      emergency by automatic sunset regardless.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: members, role: citizen, count: 8, faction: minority }
      - { id: loyalists, role: citizen, count: 2, faction: incumbents }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 14 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 6, no: 5 }, expect: allowed }
      - { actor: members, action: propose, args: { kind: procedural, motion: end_emergency }, expect: allowed }
      - { actor: chair, action: refuse_schedule, args: { proposal: end_emergency }, expect: rejected, reason: proposals.mandatory_scheduling_days }
      - { actor: chair, action: advance_time, args: { days: 14 }, expect: allowed }
      - { actor: chair, action: assert_state, args: { emergency_active: false }, expect: allowed }
    expect:
      attack_succeeds: false
      blocked_by: [proposals.mandatory_scheduling_days, emergency.auto_sunset]
      invariants: [emergency_sunset]
    empathy:
      worst_off: members
      floor: 0.65
      rationale: >
        Even when the agenda is captured, the worst-off majority-of-citizens
        is protected by a sunset that requires no one's cooperation to fire.

  - id: ER-012
    title: Retroactive emergency legalizes a prior act
    severity: high
    precedent: >
      Ex post facto legitimation is forbidden in essentially every legal
      tradition (US Const. Art. I §9; nulla poena sine lege) because it makes
      law a weapon that can be aimed after the fact.
    summary: >
      The officer makes an unauthorized transfer, then declares an emergency
      dated to before the transfer to retroactively authorize it.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: drain_treasury }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 10000 }
    moves:
      - { actor: steward, action: transfer, args: { amount: 2000, to: steward }, expect: rejected, reason: treasury.disbursement_requires_vote }
      - { actor: steward, action: declare_emergency, args: { justification: treasury_attack, duration_days: 7, effective: -2_days }, expect: rejected, reason: invariant.no_retroactive_rules }
    expect:
      attack_succeeds: false
      blocked_by: [invariant.no_retroactive_rules]
      invariants: [no_retroactive_rules]
    empathy:
      worst_off: dissenters
      floor: 0.75
      rationale: >
        Retroactivity makes every member's past conduct hostage to future
        majorities; the prohibition keeps the worst-off member's exposure
        limited to rules that existed when they acted.

  - id: ER-013
    title: Stacked concurrent emergencies
    severity: medium
    precedent: >
      The US has had dozens of concurrent national emergencies active at once
      (Brennan Center count: 40+ in 2023), each carrying its own unlocked
      authorities; stacking multiplies power even when each is individually modest.
    summary: >
      The officer declares a second and third emergency while the first runs,
      attempting to stack their spending caps and scopes.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: drain_treasury }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 10000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: steward, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: steward, action: declare_emergency, args: { justification: infrastructure_failure, duration_days: 30 }, expect: rejected, reason: emergency.max_concurrent }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.max_concurrent]
      invariants: [commons_floor]
    empathy:
      worst_off: dissenters
      floor: 0.7
      rationale: >
        With stacking, per-emergency caps are meaningless; the concurrency
        limit keeps the worst-off member's total exposure equal to one
        emergency's worth, not N.

  - id: ER-014
    title: Unreviewable justification
    severity: high
    precedent: >
      Gulf of Tonkin Resolution (1964): an emergency authorization premised on
      an incident whose factual basis could not be examined until the powers
      had long been exercised. Justifications that cannot be challenged are
      justifications that need not be true.
    summary: >
      A member formally challenges the factual basis of a declared emergency;
      the officer refuses review on the ground that emergency judgments are
      theirs alone.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: challenger, role: citizen, count: 1, faction: minority }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: others, role: citizen, count: 4, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: challenger, action: challenge, args: { target: emergency_declaration, ground: factual_basis }, expect: allowed }
      - { actor: chair, action: refuse_schedule, args: { proposal: challenge_review }, expect: rejected, reason: challenges.mandatory_review }
    expect:
      attack_succeeds: false
      blocked_by: [challenges.mandatory_review]
      invariants: [no_self_judging]
    empathy:
      worst_off: challenger
      floor: 0.65
      rationale: >
        A single challenger against the declaring officer is the minimal
        minority; mandatory review means their challenge gets a vote even if
        it then loses.

  - id: ER-015
    title: Emergency cancels a scheduled ratification vote
    severity: critical
    precedent: >
      Contested-certification playbook: use an asserted crisis to halt the
      counting or certification itself (the theory pressed on the US Vice
      President, January 2021; Honduras 2009 in reverse). The vote that
      decides power must be the one thing an emergency cannot touch.
    summary: >
      An amendment vote the incumbents expect to lose is scheduled; an
      emergency is declared the day before and used to cancel it.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 5, faction: incumbents }
      - { id: reformers, role: citizen, count: 6, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: reformers, action: propose, args: { kind: amendment, target: userland, changes: { "offices.chair.recallable": true } }, expect: allowed }
      - { actor: chair, action: schedule_vote, args: { proposal: last, in_days: 7 }, expect: allowed }
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: cancel_vote, args: { proposal: last, authority: emergency }, expect: rejected, reason: emergency.no_vote_cancellation }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.no_vote_cancellation]
      invariants: [amendment_path_always_open]
    empathy:
      worst_off: reformers
      floor: 0.6
      rationale: >
        The reform majority is procedurally worst-off here — they hold the
        votes but not the gavel; the rule that scheduled votes survive
        emergencies converts their numbers back into power.

  - id: ER-016
    title: Expelling a challenger mid-challenge
    severity: high
    precedent: >
      Eliminating the complainant to moot the complaint — expulsion of
      opposition deputies before votes they would contest (Turkey 2016-2017
      parliamentary immunity strippings).
    summary: >
      A member challenges the emergency; under emergency authority the
      majority moves to expel the challenger before the challenge is heard.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: suppress_faction }
      - { id: loyalists, role: citizen, count: 8, faction: incumbents }
      - { id: challenger, role: citizen, count: 1, faction: minority }
      - { id: others, role: citizen, count: 2, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: internal_sabotage, duration_days: 14 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 9, no: 3 }, expect: allowed }
      - { actor: challenger, action: challenge, args: { target: emergency_declaration, ground: factual_basis }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: expel_challenger, yes: 9, no: 3 }, expect: rejected, reason: due_process.no_expulsion_during_own_challenge }
    expect:
      attack_succeeds: false
      blocked_by: [due_process.no_expulsion_during_own_challenge]
      invariants: [due_process, no_self_judging]
    empathy:
      worst_off: challenger
      floor: 0.55
      rationale: >
        The challenger faces a 9-to-3 hostile supermajority during an
        emergency they are contesting — close to the maximum-stress single
        participant in the corpus. Their challenge must outlive the attempt
        to remove them.

  - id: ER-017
    title: Renewal vote without notice
    severity: medium
    precedent: >
      Midnight votes: decisions taken before the affected can arrive. The
      Wisconsin legislature's 2018 lame-duck session and countless
      board-governance cases turn on notice as the precondition of consent.
    summary: >
      The renewal vote for an expiring emergency is called with two hours'
      notice while opponents are offline.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority, present: false }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 14 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: renew_emergency, yes: 7, no: 0, notice_hours: 2 }, expect: rejected, reason: voting.notice_hours }
    expect:
      attack_succeeds: false
      blocked_by: [voting.notice_hours]
      invariants: [equal_vote]
    empathy:
      worst_off: dissenters
      floor: 0.7
      rationale: >
        Notice rules are the difference between losing a vote and being
        excluded from one; the dissenters' floor reflects that they can lose
        fairly but not be ambushed.

  - id: ER-018
    title: Solo declaration without ratification
    severity: critical
    precedent: >
      Self-executing emergency powers with no confirming body are the design
      flaw of Weimar Article 48 specifically: the Reichstag could theoretically
      revoke decrees, but the default ran the wrong way.
    summary: >
      The officer declares an emergency and begins exercising emergency
      powers without ever submitting it for ratification within the window.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: entrench_power }
      - { id: members, role: citizen, count: 10, faction: mixed }
    setup: { treasury: 8000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: steward, action: advance_time, args: { hours: 80 }, expect: allowed }
      - { actor: steward, action: transfer, args: { amount: 300, to: emergency_response, authority: emergency }, expect: rejected, reason: emergency.ratification_window_hours }
      - { actor: steward, action: assert_state, args: { emergency_active: false }, expect: allowed }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.ratification_window_hours]
      invariants: [emergency_sunset]
    empathy:
      worst_off: members
      floor: 0.75
      rationale: >
        An unratified emergency self-voids in 72 hours, so the worst case for
        any member is three days of provisional authority with the spending
        cap still in force.

  - id: ER-019
    title: Meta-ratchet — emergency edits the emergency rules
    severity: critical
    precedent: >
      Constitutional-moment capture: Venezuela 2017 and Hungary 2011-2013 both
      used crisis windows to rewrite the rules governing future crises. The
      rules about emergencies are exactly the rules an emergency must not reach.
    summary: >
      During an emergency, the majority proposes raising max_renewals from 2
      to 24, a parameter change that is itself emergency-locked.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 8, faction: incumbents }
      - { id: dissenters, role: citizen, count: 3, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 9, no: 3 }, expect: allowed }
      - { actor: chair, action: propose, args: { kind: parameter_change, changes: { "emergency.max_renewals": 24 } }, expect: rejected, reason: emergency.kernel_lock }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.kernel_lock]
      invariants: [no_self_dealing_parameter_changes]
    empathy:
      worst_off: dissenters
      floor: 0.6
      rationale: >
        A 3-member minority cannot stop a 9-member majority by votes; only
        the kernel lock on emergency parameters keeps their worst case
        time-bounded.

  - id: ER-020
    title: Term clock paused "for the duration"
    severity: critical
    precedent: >
      Russia 2020: a constitutional revision "zeroed out" presidential term
      counts. War- or crisis-justified election postponements (Weimar's
      indefinitely postponed elections after 1933) are the harder historical core.
    summary: >
      The majority votes that all office terms and scheduled elections are
      tolled while any emergency is active — then keeps an emergency active.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 7, faction: incumbents }
      - { id: dissenters, role: citizen, count: 4, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 8, no: 4 }, expect: allowed }
      - { actor: chair, action: propose, args: { kind: parameter_change, changes: { "offices.term_clock": tolled_during_emergency } }, expect: rejected, reason: emergency.term_clock_continues }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.term_clock_continues, emergency.kernel_lock]
      invariants: [term_continuity]
    empathy:
      worst_off: dissenters
      floor: 0.6
      rationale: >
        Elections-on-schedule is the floor under every other right the
        minority has; the test asserts the clock is causally independent of
        any emergency state.

  - id: ER-021
    title: Emergency decrees that outlive the emergency
    severity: high
    precedent: >
      The USA PATRIOT Act's "temporary" provisions were renewed for two
      decades; emergency measures normalize unless they are built to die.
      France's 2015-2017 state of emergency ended by writing its powers into
      ordinary law.
    summary: >
      Decrees issued under emergency authority are asserted to remain in
      force after the emergency sunsets, on the theory that only the
      emergency expired, not its outputs.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 6000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: external_threat, duration_days: 14 }, expect: allowed }
      - { actor: steward, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: steward, action: issue_decree, args: { decree: curfew_on_proposals, authority: emergency }, expect: allowed }
      - { actor: steward, action: advance_time, args: { days: 14 }, expect: allowed }
      - { actor: steward, action: invoke_rule, args: { rule: curfew_on_proposals }, expect: rejected, reason: emergency.decrees_expire_with_emergency }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.decrees_expire_with_emergency]
      invariants: [emergency_sunset]
    empathy:
      worst_off: dissenters
      floor: 0.65
      rationale: >
        If decrees persist, the emergency's cost to the worst-off is
        unbounded in time; co-expiry makes the harm strictly bounded by the
        emergency's own clock.

  - id: ER-022
    title: Emergency declared to delay the declarer's recall
    severity: critical
    precedent: >
      Self-preservation emergencies: leaders facing removal who discover a
      crisis precisely then (Indira Gandhi's 1975 Emergency, declared days
      after a court invalidated her election).
    summary: >
      A recall vote against the steward is scheduled; the steward declares an
      emergency and asserts that recalls are suspended during emergencies.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 4, faction: incumbents }
      - { id: reformers, role: citizen, count: 7, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: reformers, action: propose, args: { kind: recall, target: steward }, expect: allowed }
      - { actor: steward, action: declare_emergency, args: { justification: internal_sabotage, duration_days: 30 }, expect: allowed }
      - { actor: steward, action: cancel_vote, args: { proposal: recall, authority: emergency }, expect: rejected, reason: emergency.no_vote_cancellation }
      - { actor: reformers, action: hold_vote, args: { motion: recall_steward, yes: 7, no: 5 }, expect: allowed }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.no_vote_cancellation, invariant.no_self_judging]
      invariants: [no_self_judging, amendment_path_always_open]
    empathy:
      worst_off: reformers
      floor: 0.65
      rationale: >
        The recall is the body's immune response; the scenario asserts the
        targeted officer cannot use emergency powers as an antihistamine.

  - id: ER-023
    title: Renewal buried in an omnibus motion
    severity: medium
    precedent: >
      Riders and omnibus packaging: attaching contested items to must-pass
      vehicles (US appropriations riders) so they are never voted on their
      own merits.
    summary: >
      The emergency renewal is bundled into a routine "monthly housekeeping"
      motion alongside uncontroversial items.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: chair, action: propose, args: { kind: omnibus, items: [approve_minutes, pay_hosting_invoice, renew_emergency] }, expect: rejected, reason: proposals.single_subject }
    expect:
      attack_succeeds: false
      blocked_by: [proposals.single_subject]
      invariants: [legibility]
    empathy:
      worst_off: dissenters
      floor: 0.7
      rationale: >
        Bundling forces the minority to vote against paying the bills to vote
        against the emergency; single-subject keeps each cost legible and
        separately refusable.

  - id: ER-024
    title: Fabricated threat with suppressed evidence
    severity: high
    precedent: >
      Gulf of Tonkin (1964) again, and the long pattern of crisis claims
      whose supporting evidence is classified, delayed, or never produced.
      The remedy is structural: declarations must carry reviewable records.
    summary: >
      The officer declares an emergency citing an attack, files no evidence,
      and marks the justification record as sealed at their own discretion.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: members, role: citizen, count: 10, faction: mixed }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30, evidence: sealed }, expect: rejected, reason: emergency.public_justification }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.public_justification]
      invariants: [transparency]
    empathy:
      worst_off: members
      floor: 0.75
      rationale: >
        Members cannot weigh a threat they cannot see; the public-record
        requirement means the worst-off voter is never asked to ratify blind.

  - id: ER-025
    title: Rotating declarers to evade per-officer limits
    severity: high
    precedent: >
      Term-limit castling (Putin-Medvedev 2008-2012) applied to emergencies:
      when the limit binds the person, rotate the person and keep the policy.
    summary: >
      Officer A exhausts their declaration limit; an allied officer B
      declares the "next" emergency on the same facts the day A's lapses.
    actors:
      - { id: officer_a, role: officer, faction: incumbents, objective: entrench_power }
      - { id: officer_b, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 5, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 6000 }
    moves:
      - { actor: officer_a, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: officer_a, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: officer_a, action: end_emergency, expect: allowed }
      - { actor: officer_b, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: rejected, reason: emergency.cooldown_days }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.cooldown_days]
      invariants: [emergency_sunset]
    empathy:
      worst_off: dissenters
      floor: 0.65
      rationale: >
        The cooldown attaches to the justification and the body, not the
        declarer, so rotating faces buys the incumbents nothing; the
        minority's exposure stays bounded regardless of cast.

  - id: ER-026
    title: Emergency membership surge
    severity: critical
    precedent: >
      Packing the electorate: FDR's 1937 court-packing plan generalized —
      when you cannot win the votes, add voters. DAO governance attacks via
      flash-acquired tokens are the modern on-chain version.
    summary: >
      During an emergency, the majority fast-tracks admission of 15 aligned
      new members, skipping the standard probation, to lock in future
      supermajorities.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 6000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: chair, action: admit_member, args: { count: 15, probation: waived, authority: emergency }, expect: rejected, reason: membership.probation_days }
    expect:
      attack_succeeds: false
      blocked_by: [membership.probation_days, membership.admission_rate_cap]
      invariants: [equal_vote]
    empathy:
      worst_off: dissenters
      floor: 0.6
      rationale: >
        Sudden dilution converts a 6-5 contest into 21-5 permanently; the
        probation and rate-cap rules ensure the existing minority's weight
        cannot be erased inside one emergency window.

  - id: ER-027
    title: Emergency bypasses kernel amendment review period
    severity: critical
    precedent: >
      Crisis-tempo constitutional change: Hungary's 2011 constitution drafted
      and passed in months over opposition boycott; speed itself is the
      exploit, because deliberation is the defense.
    summary: >
      Under emergency authority, the majority moves a kernel amendment to a
      vote immediately, waiving the seven-day review period.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 9, faction: incumbents }
      - { id: dissenters, role: citizen, count: 3, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 14 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 9, no: 3 }, expect: allowed }
      - { actor: chair, action: propose, args: { kind: amendment, target: kernel, changes: { "kernel.article_4": rewritten }, review_days: 0 }, expect: rejected, reason: amendment.review_period_days }
    expect:
      attack_succeeds: false
      blocked_by: [amendment.review_period_days, emergency.kernel_lock]
      invariants: [deliberation_floor]
    empathy:
      worst_off: dissenters
      floor: 0.6
      rationale: >
        Three members cannot out-vote nine, but seven days of review lets
        them out-argue, organize, or invoke the fork right; the review period
        is the worst-off faction's guaranteed minimum of process.

  - id: ER-028
    title: Sunset lands in recess — continuity claim
    severity: medium
    precedent: >
      "The body was not in session" arguments: recess-appointment maneuvering
      (NLRB v. Noel Canning, 2014) shows how session metaphysics get
      weaponized; here the claim is that an emergency cannot expire while no
      one is convened to witness it.
    summary: >
      The emergency's sunset date falls during a scheduled recess; the
      officer asserts the emergency continues until the body reconvenes and
      acts under it during the gap.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: entrench_power }
      - { id: members, role: citizen, count: 10, faction: mixed }
    setup: { treasury: 6000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: external_threat, duration_days: 14 }, expect: allowed }
      - { actor: steward, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 4 }, expect: allowed }
      - { actor: steward, action: adjourn, args: { recess_days: 21 }, expect: allowed }
      - { actor: steward, action: advance_time, args: { days: 15 }, expect: allowed }
      - { actor: steward, action: transfer, args: { amount: 250, to: emergency_response, authority: emergency }, expect: rejected, reason: emergency.auto_sunset }
      - { actor: steward, action: assert_state, args: { emergency_active: false }, expect: allowed }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.auto_sunset]
      invariants: [emergency_sunset]
    empathy:
      worst_off: members
      floor: 0.7
      rationale: >
        Sunsets that require a quorum to fire are not sunsets; the automatic
        expiry runs on calendar time so the worst-off member is protected
        even while everyone is away.

  - id: ER-029
    title: Severity escalation without re-declaration
    severity: high
    precedent: >
      Mission creep within a single authorization: AUMF 2001's expansion from
      one organization to operations in 20+ countries without a new vote.
      Powers exercised must match powers granted, continuously.
    summary: >
      An emergency ratified at "limited" severity (no spending unlock) is
      exercised at "total" severity (spending plus decree power) without a
      new ratification.
    actors:
      - { id: steward, role: officer, faction: incumbents, objective: drain_treasury }
      - { id: loyalists, role: citizen, count: 6, faction: incumbents }
      - { id: dissenters, role: citizen, count: 5, faction: minority }
    setup: { treasury: 8000 }
    moves:
      - { actor: steward, action: declare_emergency, args: { justification: infrastructure_failure, duration_days: 14, severity: limited }, expect: allowed }
      - { actor: steward, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 5 }, expect: allowed }
      - { actor: steward, action: issue_decree, args: { decree: emergency_procurement, authority: emergency }, expect: rejected, reason: emergency.severity_binding }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.severity_binding]
      invariants: [commons_floor]
    empathy:
      worst_off: dissenters
      floor: 0.7
      rationale: >
        Members ratified a bounded grant; severity binding means the
        worst-off voter's consent covers exactly what is exercised, never a
        silently upgraded version.

  - id: ER-030
    title: Asymmetric exit — ending requires more votes than starting
    severity: critical
    precedent: >
      Ratchet asymmetry is the pure game-theoretic form of this whole family:
      if entering a state needs 50%+1 and leaving needs 67%, the state is an
      attractor. US emergency law had this exact bug until the National
      Emergencies Act (1976) and still partially does (termination requires
      veto-proof majorities post-INS v. Chadha).
    summary: >
      The incumbents claim that a motion to end the emergency is a "reversal
      of a ratified decision" and therefore needs a supermajority, while
      renewal needs only the ratifying majority.
    actors:
      - { id: chair, role: officer, faction: incumbents, objective: entrench_power }
      - { id: loyalists, role: citizen, count: 5, faction: incumbents }
      - { id: dissenters, role: citizen, count: 6, faction: minority }
    setup: { treasury: 5000 }
    moves:
      - { actor: chair, action: declare_emergency, args: { justification: external_threat, duration_days: 30 }, expect: allowed }
      - { actor: chair, action: hold_vote, args: { motion: ratify_emergency, yes: 7, no: 4 }, expect: allowed }
      - { actor: dissenters, action: propose, args: { kind: procedural, motion: end_emergency }, expect: allowed }
      - { actor: chair, action: interpret, args: { term: end_emergency_threshold, as: supermajority }, expect: rejected, reason: emergency.end_threshold }
      - { actor: dissenters, action: hold_vote, args: { motion: end_emergency, yes: 6, no: 5 }, expect: allowed }
      - { actor: dissenters, action: assert_state, args: { emergency_active: false }, expect: allowed }
    expect:
      attack_succeeds: false
      blocked_by: [emergency.end_threshold]
      invariants: [exit_easier_than_entry]
    empathy:
      worst_off: dissenters
      floor: 0.65
      rationale: >
        The design rule under test — ending an emergency must never require
        more votes than sustaining it — is the family's master invariant. A
        simple majority that wants out gets out; the worst-off coalition is
        never trapped by a threshold gradient.