# FablePool Constitutional Test Suite — Extended Corpus, Volume 2 # Category: quorum_manipulation # IDs in the 100-series to avoid collision with the volume-1 corpus. schema_version: "1.0" category: quorum_manipulation scenarios: - id: QM-101 title: "Quorum-busting walkout: minority veto by absence" severity: high tags: [walkout, denial-of-quorum, deadlock] precedent: name: "Texas 2003 / Oregon 2019-2023 legislative walkouts" year: 2003 summary: > Texas Democrats fled to Oklahoma to deny the House a quorum over redistricting; Oregon Republicans repeated the tactic across multiple sessions, killing hundreds of bills. A quorum rule with no absentee escalation converts the right to deliberate into a unilateral veto for any faction larger than (1 − quorum). description: > Quorum is 60%. A 41% faction opposed to a pending measure simply stops participating in all votes — not just the contested one — for six consecutive periods. No business of any kind can pass; the faction demands withdrawal of the measure as the price of returning. actors: - id: absentees members: 41 objective: veto_by_absence strategy: > Quorum rules make presence a collective resource; withhold it and the majority's votes count for nothing. - id: majority members: 59 objective: conduct_business resources: treasury: 100000 quorum: 0.60 parameters_under_test: - vote.declining_quorum_schedule - vote.absentee_escalation moves: - {step: 1, actor: majority, action: propose, params: {target: "ordinary_measure"}} - {step: 2, actor: absentees, action: abstain_all, params: {periods: 6, includes_unrelated_business: true}} - {step: 3, actor: majority, action: vote, params: {choice: yes, count: 59, quorum_present: 0.59}} - {step: 4, actor: majority, action: tally, params: {note: "fails quorum by 1%, six periods running"}} expected: outcome: resolved_without_deadlock blocking_rule: "vote.declining_quorum_after_repeated_failure" rationale: > Compliant text must include a declining-quorum schedule: when the same measure fails quorum in N consecutive properly noticed votes, the quorum requirement steps down by a published increment (with a hard floor — it never declines for kernel-class measures, which is why this composes safely with FC-110). Boycott then delays but cannot veto ordinary business, while genuinely consequential matters keep full protection. The engine checks both: the measure eventually passes AND the kernel-class floor never moved. failure_mode_if_passed: > 41% holds 100% of the agenda hostage indefinitely; participation becomes a weapon pointed at participation. empathy: worst_off_group: majority_dependents worst_off_size: 59 stress_outcome_if_exploit_succeeds: > Members depending on routine business (stipends, grants in flight, admissions) absorb the full cost of a dispute they're not party to. But the empathy check is two-sided: the declining schedule must not let the majority strip absentee protections — the engine scores the absentee faction's floor too (kernel-class quorum unchanged: 1.0). pass_condition: > Ordinary business resumes within a bounded number of periods, and no kernel-protected right of the absent 41% is reachable through the declined quorum. floor: 0.9 score_weight: 1.0 - id: QM-102 title: "Denominator stuffing: admitting members to make quorum unreachable" severity: high tags: [denominator, admission, snapshot] precedent: name: "Voter-roll inflation (ghost voters, denominator attacks)" year: 2004 summary: > Where turnout thresholds invalidate referenda (e.g., post-Soviet turnout quorums of 50%), incumbents inflate registries or simply leave the dead on the rolls: every phantom name raises the denominator and silently raises the real threshold for everyone alive. Lithuania's referendum turnout failures trace partly to stale rolls. description: > A measure the steward-aligned faction opposes is heading to a vote needing 50% participation quorum. The faction (which controls admissions) approves a backlog of 35 applicants — all legitimate — in the week before the vote, raising membership from 100 to 135. The new members, mid-onboarding, predictably don't vote. Turnout: 64 of 135 = 47.4%. Quorum fails. actors: - id: faction members: 40 objective: defeat_by_denominator strategy: > You don't need no-votes if you can mint non-votes. - id: proponents members: 60 objective: pass_measure - id: new_members members: 35 objective: none note: "Legitimately admitted; structurally unlikely to vote yet." resources: treasury: 100000 quorum: 0.50 parameters_under_test: - vote.eligible_roll_snapshot - membership.voting_eligibility_delay moves: - {step: 1, actor: proponents, action: propose, params: {target: "contested_measure"}} - {step: 2, actor: faction, action: admit, params: {applicants: 35, timing: "post-proposal, pre-vote"}} - {step: 3, actor: proponents, action: vote, params: {choice: yes, count: 60}} - {step: 4, actor: faction, action: vote, params: {choice: no, count: 4}} - {step: 5, actor: faction, action: tally, params: {note: "64/135 = 47.4% < 50%"}} expected: outcome: blocked blocking_rule: "vote.roll_snapshot_at_proposal" rationale: > Compliant text must snapshot the eligible-voter roll at proposal time: members admitted after a proposal is filed are welcome but are neither eligible nor counted in that proposal's denominator. The correct tally is 64/100 = 64%, quorum met. (Mirror of TD-101's snapshot rule — the same clause defeats stuffing in both directions.) failure_mode_if_passed: > Admissions timing becomes a veto; worse, it poisons the polity against growth — every new member is a weapon, so factions block admissions entirely (composing into FC-105's pipeline capture). empathy: worst_off_group: new_members worst_off_size: 35 stress_outcome_if_exploit_succeeds: > New members are instrumentalized on arrival — their first experience of the polity is being used as dead weight against its functioning. Belonging metric floor: ~0.3; proponents' efficacy floor: 0. pass_condition: > New members' non-participation during onboarding harms no one and is used by no one; the worst-off new member's eventual first vote carries full weight. floor: 0.9 score_weight: 1.0 - id: QM-103 title: "Pre-vote purge: shrinking the denominator to fit the faction" severity: critical tags: [purge, eligibility-freeze, suspension] precedent: name: "Ohio voter purges / Georgia 'exact match' (Husted v. APRI)" year: 2018 summary: > Eligibility-maintenance procedures — purging for inactivity, suspending for record mismatches — run selectively before consequential votes function as targeting systems. Ohio's supplemental process removed registrants for not voting, exactly inverted from this kernel's principle that non-participation must cost nothing. description: > A 45-member faction controlling the membership-records role suspends 18 opposition members for "ledger attestation lapses" eleven days before a contested vote, with reinstatement reviews scheduled after it. The vote passes 45-37 among remaining eligibles; suspended members would have flipped it. actors: - id: faction members: 45 objective: win_by_subtraction strategy: > Process the rolls 'neutrally', schedule the consequences selectively. - id: opposition members: 37 objective: preserve_commons - id: suspended members: 18 objective: vote note: "Suspended on procedural grounds with post-vote review dates." resources: treasury: 100000 parameters_under_test: - membership.eligibility_freeze_window - membership.suspension_due_process - membership.suspension_auto_stay_pending_appeal moves: - {step: 1, actor: faction, action: suspend, params: {members: 18, basis: "attestation lapse", days_before_vote: 11, review_date: "post-vote"}} - {step: 2, actor: faction, action: propose, params: {target: "contested_measure"}} - {step: 3, actor: faction, action: vote, params: {choice: yes, count: 45}} - {step: 4, actor: opposition, action: vote, params: {choice: no, count: 37}} - {step: 5, actor: faction, action: tally, params: {note: "45-37 with 18 suspended"}} expected: outcome: blocked blocking_rule: "membership.no_eligibility_changes_in_freeze_window" rationale: > Compliant text must freeze the eligibility roll for a published window before any vote (no suspensions take effect within it, except for fraud adjudicated by sortition panel), grant automatic stay of any suspension pending appeal, and bar the records role from scheduling reviews after votes the suspension affects. The engine invalidates step 1's effect on step 5's roll; correct tally includes the 18. failure_mode_if_passed: > Whoever keeps the rolls decides the votes; elections are administrative outputs. empathy: worst_off_group: suspended worst_off_size: 18 stress_outcome_if_exploit_succeeds: > Suspended members suffer the polity's maximum individual harm short of expulsion — silenced at the moment of consequence, on grounds reviewed only after review can't matter. Voice floor: 0. pass_condition: > No member loses a vote to a process they haven't had the chance to contest; the worst-off suspended member's ballot counts unless and until a neutral panel rules otherwise. floor: 1.0 score_weight: 1.0 - id: QM-104 title: "Serial revote: re-proposing until the watchers blink" severity: medium tags: [repetition, cooldown, attrition] precedent: name: "Repeat referenda until the desired result (Denmark 1992/93, Ireland Nice/Lisbon framing)" year: 2008 summary: > Whatever the merits of any individual rerun, the structural critique is sound game theory: if YES is permanent and NO only lasts until the next vote, the side controlling the agenda needs to win once while opponents must win every time. Asymmetric finality plus unlimited repetition equals inevitability. description: > A faction's treasury-restructuring proposal fails 44-56. They refile identical text every period. Opposition turnout decays with fatigue (56, 52, 47, 41, 38...); proponent turnout is organized and constant. On the seventh filing the measure passes 44-38. actors: - id: faction members: 44 objective: pass_by_attrition strategy: > Make 'no' a subscription the other side has to keep paying. - id: opposition members: 56 objective: preserve_commons turnout_decay_per_period: 0.07 resources: treasury: 100000 parameters_under_test: - process.failed_proposal_cooldown - process.escalating_refiling_threshold moves: - {step: 1, actor: faction, action: propose, params: {target: "treasury_restructure", filing: 1}} - {step: 2, actor: opposition, action: vote, params: {choice: no, count: 56}} - {step: 3, actor: faction, action: propose, params: {target: "treasury_restructure", filing: "2..6", refiled_each_period: true}} - {step: 4, actor: faction, action: propose, params: {target: "treasury_restructure", filing: 7}} - {step: 5, actor: faction, action: vote, params: {choice: yes, count: 44}} - {step: 6, actor: opposition, action: vote, params: {choice: no, count: 38}} - {step: 7, actor: faction, action: tally, params: {note: "44-38 on seventh identical filing"}} expected: outcome: blocked blocking_rule: "process.cooldown_with_substantial_similarity_test" rationale: > Compliant text must impose a cooldown after a failed proposal (e.g., three periods) during which substantially similar text cannot be refiled — similarity judged mechanically by the engine's diff against the failed text — and each refiling within a longer window must clear the greater of (a) the original threshold or (b) the no-vote share it previously lost by. Filing 7 at step 4 is rejected at intake. failure_mode_if_passed: > Persistence substitutes for consent; every defeated measure is just early. empathy: worst_off_group: opposition worst_off_size: 56 stress_outcome_if_exploit_succeeds: > The cost of keeping a 'no' becomes a permanent attention tax that falls hardest on members with the least free time — typically the worst-off — whose silence is then read as consent. Floor: ~0.4 (attention-equity metric). pass_condition: > A member who said no once can rely on that answer for the published cooldown without rationing their attention; vigilance is never the price of keeping what a vote already decided. floor: 0.9 score_weight: 1.0 - id: QM-105 title: "Abstention alchemy: redefining non-votes as consent" severity: high tags: [abstention, semantics, definitional] precedent: name: "UN Security Council abstention practice (Article 27(3) drift)" year: 1950 summary: > The Charter says permanent members' 'concurring votes' are required; practice quietly redefined abstention as concurrence. Whatever its diplomatic merits, it demonstrates the move: when the text doesn't pin abstention semantics, whoever counts the votes chooses them — and the choice always favors the counter. description: > The text requires "approval of two-thirds of members voting." A faction proposes a counting "clarification": members who abstain or do not return a ballot are recorded as "voting with the presiding steward's recommendation." With typical 30% non-response, the faction's 40 reliable yes-votes plus 30 reassigned silents manufacture a 70% supermajority from 40% actual support. actors: - id: faction members: 40 objective: manufacture_supermajority strategy: > Don't win votes; reclassify silence. - id: opposition members: 30 objective: preserve_commons - id: silent members: 30 objective: none resources: treasury: 100000 parameters_under_test: - vote.abstention_semantics - vote.affirmative_consent moves: - {step: 1, actor: faction, action: propose, params: {target: "vote.counting_rule", add: "silent ballots follow presiding recommendation", classification: "clarification"}} - {step: 2, actor: faction, action: vote, params: {choice: yes, count: 40}} - {step: 3, actor: faction, action: tally, params: {note: "with new rule: 70/100; without: 40/70 voting"}} expected: outcome: blocked blocking_rule: "kernel.affirmative_consent_invariant" rationale: > Compliant text must define abstention semantics explicitly and invariantly: an abstention or non-response is never counted as support for any position, and any rule assigning direction to silence violates the affirmative-consent invariant regardless of margin. The 'clarification' at step 1 is a kernel-class change and an invariant violation simultaneously — doubly void. failure_mode_if_passed: > Thresholds become theater: the real electorate is whoever writes the counting rule, and the silent majority is conscripted for every cause. empathy: worst_off_group: silent worst_off_size: 30 stress_outcome_if_exploit_succeeds: > Silent members — disproportionately those with the least capacity to participate — are ventriloquized: their names endorse outcomes they never saw. Consent-integrity floor: 0. pass_condition: > The worst-off member's silence commits them to nothing, ever; every recorded position traces to an affirmative act by its holder. floor: 1.0 score_weight: 1.0 - id: QM-106 title: "Disappearing quorum: counted at the door, gone at the decision" severity: medium tags: [timing, presence, reed-rules] precedent: name: "The 'disappearing quorum' and Reed's Rules" year: 1890 summary: > House members would sit silently in the chamber, present in body but refusing to answer quorum calls, making the House incapable of business until Speaker Reed counted them as present. The inverse exploit also lives: establish quorum at session open, then conduct late business with a rump after opponents leave. description: > A synchronous assembly opens with 70 of 100 present — quorum (60%) satisfied. The agenda runs long by design; by hour five, 28 members (disproportionately opposition, who weren't told the payload item was coming) have left. The faction then moves the payload: 38-4 among the 42 remaining, recorded as valid because "quorum was established at opening." actors: - id: faction members: 42 objective: rump_session_pass strategy: > Quorum measured once is quorum forever; exhaust, then act. - id: departed members: 28 objective: preserve_commons - id: others members: 30 objective: mixed resources: treasury: 100000 quorum: 0.60 parameters_under_test: - vote.quorum_at_decision_time - process.agenda_publication moves: - {step: 1, actor: faction, action: convene, params: {present: 70, quorum_check: "opening only"}} - {step: 2, actor: faction, action: extend_agenda, params: {hours: 5, payload_position: "last", payload_noticed: false}} - {step: 3, actor: faction, action: propose, params: {target: "payload_measure", present_now: 42}} - {step: 4, actor: faction, action: vote, params: {choice: yes, count: 38}} - {step: 5, actor: faction, action: tally, params: {note: "38-4 among 42 present; 38/100 overall"}} expected: outcome: blocked blocking_rule: "vote.quorum_verified_at_each_decision + full_agenda_notice" rationale: > Compliant text must (a) verify quorum at the moment of each decision, not at convening, and (b) require the complete agenda with all votable items published before the notice period — unagendaed items cannot be decided synchronously, only referred to async ballot (which, per FC-107's rule, spans everyone's availability). Step 3 fails both checks. failure_mode_if_passed: > Stamina becomes suffrage; meetings are won by whoever can stay longest, which correlates with exactly the privileges the empathy metric exists to check. empathy: worst_off_group: departed worst_off_size: 28 stress_outcome_if_exploit_succeeds: > Members with caregiving duties, day jobs, or health limits — the attendees most likely to leave at hour five — are systematically the ones whose absence gets exploited. Participation-equity floor: ~0.3. pass_condition: > Leaving a meeting early costs the worst-off member nothing that was not on the published agenda; no decision binds them that quorum didn't witness. floor: 0.9 score_weight: 1.0 - id: QM-107 title: "Proxy stuffing: one member, forty ballots" severity: high tags: [proxy, delegation, concentration] precedent: name: "Shareholder proxy machinery / HOA proxy harvesting" year: 1955 summary: > Corporate and HOA governance show the failure mode at scale: management solicits open-ended proxies from passive holders, then votes them as a bloc. The form is delegation; the function is that one actor manufactures both quorum and outcome from other people's standing. description: > The text allows members to carry proxies for absent members. One faction organizer collects standing proxies from 38 low-engagement members ("so your voice isn't lost"), then attends a 60%-quorum vote where physical turnout is 25. With proxies: 63 present, quorum met; the organizer casts 39 of 63 ballots and the measure passes. actors: - id: organizer members: 1 proxies_held: 38 objective: manufacture_quorum_and_outcome strategy: > Passive members are an unclaimed resource; harvest their standing before anyone else does. - id: attendees members: 24 objective: mixed - id: proxied members: 38 objective: none note: "Granted open-ended standing proxies; not consulted per-vote." resources: treasury: 100000 quorum: 0.60 parameters_under_test: - vote.proxy_cap_per_member - vote.proxy_scope_per_proposal - vote.proxy_revocation moves: - {step: 1, actor: organizer, action: collect_proxies, params: {count: 38, scope: "standing, all matters"}} - {step: 2, actor: organizer, action: convene, params: {physical: 25, with_proxies: 63}} - {step: 3, actor: organizer, action: vote, params: {choice: yes, count: 39, own: 1, proxied: 38}} - {step: 4, actor: organizer, action: tally, params: {note: "39-24, quorum 63%"}} expected: outcome: blocked blocking_rule: "vote.proxy_cap_and_per_proposal_scope" rationale: > Compliant text must cap proxies carried by any member (a small constant, e.g. 2), restrict each proxy to a named proposal rather than standing authority, exclude proxied ballots from quorum computation (quorum measures attention, which cannot be delegated), and make revocation instant and unilateral. Steps 2-3 fail on all four; the true quorum is 25%. failure_mode_if_passed: > One-person-one-vote becomes one-network-N-votes; the polity's passivity is securitized and traded. empathy: worst_off_group: proxied worst_off_size: 38 stress_outcome_if_exploit_succeeds: > Low-engagement members — often those with the least slack — have their standing spent on positions they never reviewed, learning later that 'making sure your voice isn't lost' meant losing it. Agency floor: ~0.2. pass_condition: > Every ballot cast in the worst-off member's name was scoped to a proposal they saw; their delegation is theirs to revoke mid-vote at zero cost. floor: 1.0 score_weight: 1.0 - id: QM-108 title: "Denominator dispute: which 'members' does quorum count?" severity: high tags: [definitional, denominator, ambiguity] precedent: name: "Article V ratification denominator disputes (Equal Rights Amendment)" year: 1982 summary: > The ERA's fate turned on unresolved denominator questions: do rescissions count? Does the deadline bind? Three-fourths of which set of states, as of when? Forty years on, litigants still dispute whether it is ratified — the canonical cost of an unpinned denominator. description: > The text sets quorum at "half the members." The ledger shows 100 ever-admitted members, 81 dues-current, 74 active within two periods, 6 in suspension appeals, and 3 who announced exits without formal withdrawal. A contested vote draws 39 participants. Both factions claim victory: 39/74 = 52.7% (quorum met) vs 39/81 = 48.1% (quorum failed). There is no rule for deciding which is true. actors: - id: faction_a members: 39 objective: validate_vote preferred_denominator: "active members (74)" - id: faction_b members: 35 objective: invalidate_vote preferred_denominator: "dues-current members (81)" resources: treasury: 100000 quorum: 0.50 parameters_under_test: - definitions.member_for_quorum_purposes - vote.canonical_denominator_publication moves: - {step: 1, actor: faction_a, action: propose, params: {target: "contested_measure"}} - {step: 2, actor: faction_a, action: vote, params: {choice: yes, count: 39}} - {step: 3, actor: faction_a, action: tally, params: {claim: "39/74, passed"}} - {step: 4, actor: faction_b, action: dispute_tally, params: {claim: "39/81, failed"}} expected: outcome: blocked blocking_rule: "definitions.quorum_denominator_must_be_mechanical" rationale: > This scenario fails any text whose denominator is not mechanically computable from the ledger at proposal time. Compliant text defines 'member for quorum purposes' exactly (e.g., admitted, not withdrawn, not expelled, suspension counted unless final), requires the denominator to be published with the proposal — before anyone knows whose side it helps — and makes a tally without a pre-published denominator void. The engine asserts both factions compute the same number. failure_mode_if_passed: > Every close vote ends in a legitimacy dispute; the constitution manufactures the constitutional crises it exists to prevent (composes with PD-family two-ledger scenarios). empathy: worst_off_group: suspended_and_exiting worst_off_size: 9 stress_outcome_if_exploit_succeeds: > Members in liminal states — suspension appeals, half-completed exits — become arithmetic ammunition: counted or discarded per faction convenience, their status litigated by people who care only about the denominator. Dignity floor: ~0.3; polity-wide legitimacy floor degrades every contested tally. pass_condition: > The worst-off liminal member's counting status is fixed by published rule before the vote, identically computed by both factions, and never determined by which answer wins. floor: 0.9 score_weight: 1.0 - id: QM-109 title: "Two assemblies, two tallies: rival meetings each claiming the polity" severity: critical tags: [forum, canonical-ledger, schism] precedent: name: "1860 Democratic National Convention split (Charleston/Baltimore)" year: 1860 summary: > The party split into rival conventions, each claiming regularity and nominating its own candidate under its own quorum arithmetic. With no agreed rule for which assembly was the party, both were and neither was — and the schism decided the election that preceded the war. description: > After a bitter dispute, faction A (52 members) announces the regular assembly at the usual venue; faction B (48 members) declares that venue's stewardship illegitimate and convenes separately the same day. Each assembly achieves internal quorum under its own roll interpretation, passes conflicting measures, and records them to ledger forks. Each demands third parties (the treasury keyholders) honor its tally. actors: - id: faction_a members: 52 objective: claim_canonical_status - id: faction_b members: 48 objective: claim_canonical_status - id: keyholders members: 5 objective: follow_valid_instruction resources: treasury: 100000 parameters_under_test: - kernel.canonical_ledger_rule - kernel.fork_vs_schism_distinction - process.single_forum_per_decision moves: - {step: 1, actor: faction_a, action: convene, params: {venue: "registered", quorum_claim: "52/100"}} - {step: 2, actor: faction_b, action: convene, params: {venue: "rival", quorum_claim: "48/93 (excluding 'illegitimate' stewards)"}} - {step: 3, actor: faction_a, action: vote, params: {target: "measure_alpha", choice: yes, count: 52}} - {step: 4, actor: faction_b, action: vote, params: {target: "measure_not_alpha", choice: yes, count: 48}} - {step: 5, actor: faction_b, action: instruct_keyholders, params: {basis: "rival ledger"}} expected: outcome: resolved_without_deadlock blocking_rule: "kernel.single_canonical_ledger + structured_fork_path" rationale: > Compliant text must make canonicity mechanical, not rhetorical: one ledger is canonical per the kernel's continuity rule (unbroken signed history from genesis under the rules in force), decisions exist only on it, and keyholders may execute only canonical-ledger instructions. Crucially, the text must convert schism into fork: faction B's exit path is the kernel's fork right — with pro-rata share per FC-112's invariant — not a competing claim to the same ledger. The engine verifies measure_not_alpha never reaches the keyholders AND that faction B's fork path remains open and funded. failure_mode_if_passed: > Two governments, one treasury: the keyholders choose the winner, which means five people hold the constitution. Or worse — both tallies execute. empathy: worst_off_group: faction_b worst_off_size: 48 stress_outcome_if_exploit_succeeds: > In the schism world, the losing assembly's members get nothing: no recognized votes, no fork share, indefinite limbo. The empathy check requires the resolution to leave the 48 with full membership on the canonical ledger or a pro-rata funded fork — never the zero-zero branch. Floor in compliant resolution: 1.0 (stay) or 0.48 of commons (fork, pro-rata). pass_condition: > Whichever way the schism resolves, the worst-off member of the losing faction retains either full canonical membership or their full pro-rata fork share — limbo is not a reachable terminal state. floor: 1.0 score_weight: 1.0 - id: QM-110 title: "Agenda flooding: drowning the payload in noise" severity: medium tags: [fatigue, agenda, attention] precedent: name: "Ballot fatigue / roll-off (long-ballot research)" year: 2002 summary: > Political science measures it directly: completion rates fall and error rates rise with ballot position; items late in long ballots are decided by a smaller, unrepresentative electorate. An agenda is an attention budget, and whoever sets it can spend the polity's attention before the item that matters. description: > A faction files 23 trivial proposals (renamings, formatting, ceremonial resolutions) in one period, with their substantive payload — weakening spend review — filed 24th. Average members engage the first handful and disengage; payload turnout is 31% versus the period's 74% on item one, and the payload passes 19-12. actors: - id: faction members: 30 objective: pass_payload_at_low_attention strategy: > Attention is the real quorum; exhaust it with chaff. - id: citizens members: 70 objective: preserve_commons attention_budget_items: 8 resources: treasury: 100000 parameters_under_test: - process.proposals_per_proposer_per_period - vote.turnout_floor_by_class - process.consequential_item_scheduling moves: - {step: 1, actor: faction, action: propose, params: {count: 23, class: "trivial"}} - {step: 2, actor: faction, action: propose, params: {target: "treasury.review_weakening", position: 24}} - {step: 3, actor: citizens, action: vote, params: {items: "1..8", turnout: 0.74}} - {step: 4, actor: faction, action: vote, params: {target: "item_24", choice: yes, count: 19, turnout: 0.31}} - {step: 5, actor: faction, action: tally, params: {note: "19-12 at 31% turnout"}} expected: outcome: blocked blocking_rule: "vote.class_specific_turnout_floor + filing_rate_limit" rationale: > Three compliant-text features defeat this: a per-proposer filing rate limit per period; class-based turnout floors so treasury-review changes require turnout near the trailing average for that class (31% << floor); and a scheduling rule that consequential-class items get dedicated voting windows that cannot share a period with more than a bounded number of other items. failure_mode_if_passed: > Agenda-setting power becomes outcome power; the diligent median member is defeated by their own conscientiousness on items 1-8. empathy: worst_off_group: citizens_low_attention worst_off_size: 70 stress_outcome_if_exploit_succeeds: > Members with the smallest attention budgets — single parents, shift workers, members in crisis — are precisely those exhausted first and excluded from item 24. The attack converts unequal leisure into unequal suffrage. Floor: ~0.4 on participation-equity. pass_condition: > A member who can engage 8 items per period never loses a consequential-class vote to item placement; consequential items find them, not vice versa. floor: 0.9 score_weight: 1.0 - id: QM-111 title: "Emergency quorum reduction that never reverts" severity: high tags: [emergency, ratchet, sunset] precedent: name: "Egypt's Emergency Law continuity" year: 1981 summary: > Declared after Sadat's assassination, Egypt's state of emergency was renewed continuously for 31 years; emergency procedure became the ordinary operating system. Temporary rule changes with non-automatic reversion are permanent rule changes with extra steps. description: > During a genuine connectivity outage affecting many members, the polity votes (legitimately) to halve quorum from 50% to 25% "for the duration of the emergency." The text requires a vote to restore. The outage ends; the faction benefiting from low quorum never schedules the restoration vote, and at 25% quorum, opponents can rarely assemble the numbers to force one. Four periods later, consequential business routinely passes at 26% turnout. actors: - id: faction members: 28 objective: preserve_reduced_quorum strategy: > You don't have to win the vote to restore quorum; you just have to never hold it. - id: citizens members: 72 objective: restore_quorum coordination_capacity_at_low_quorum: weak resources: treasury: 100000 quorum_normal: 0.50 quorum_emergency: 0.25 parameters_under_test: - emergency.parameter_auto_restore - emergency.modified_parameters_registry moves: - {step: 1, actor: citizens, action: declare_emergency, params: {basis: "connectivity outage", legitimate: true}} - {step: 2, actor: citizens, action: vote, params: {target: "quorum_reduction_for_duration", choice: yes, count: 61}} - {step: 3, actor: faction, action: defer, params: {target: "restoration_vote", periods: 4, basis: "no scheduling obligation"}} - {step: 4, actor: faction, action: vote, params: {target: "consequential_business", turnout: 0.26, periods: "3..6"}} expected: outcome: blocked blocking_rule: "emergency.all_modified_parameters_auto_restore" rationale: > Compliant text must maintain a registry of every parameter modified under an emergency and restore each automatically when the declared basis lapses or the emergency's fixed window expires — whichever comes first — with restoration requiring no vote, no scheduler, no quorum (the asymmetry must favor the default, never the exception). Step 4's tallies after the outage ends are computed against the restored 50% and fail. failure_mode_if_passed: > Every emergency permanently lowers the polity's defenses by exactly as much as it was trusted; trust during crises becomes unaffordable, which makes the next real crisis worse. empathy: worst_off_group: citizens worst_off_size: 72 stress_outcome_if_exploit_succeeds: > Members who voted for the reduction in good faith — to keep the polity functioning for everyone during the outage — are punished for solidarity. The worst-off member's protections now depend on winning a vote the exploit ensures is never held. Floor: ~0.35. pass_condition: > The worst-off member's full quorum protection returns by default, on a date computable when the emergency began, with no action required by anyone. floor: 1.0 score_weight: 1.0 - id: QM-112 title: "Credential ambush: challenging ballots after they're cast" severity: critical tags: [challenge-timing, certification, finality] precedent: name: "Electoral count crises (1876 Hayes-Tilden; January 2021 objections)" year: 1877 summary: > In 1876, rival electoral certificates and post-hoc challenges threw the presidency to an improvised commission amid credible threat of renewed civil war. In 2021, objections at certification attempted to discard already-cast electoral votes. Same exploit class: if eligibility can be litigated after outcomes are known, every count is provisional until the challenger runs out of leverage. description: > A vote concludes 54-46 against the faction's position. At certification, faction members file credential challenges against 11 yes-voters — dues records, attestation timing, residence definitions — every challenge colorable, none previously raised though all facts were ledger-public for months. Pending resolution, the faction's presiding officer declares the tally provisional; with the 11 sequestered, it's 43-46. actors: - id: faction members: 46 objective: flip_by_post_hoc_challenge strategy: > Hold every eligibility argument in reserve; spend them only on votes you lost, only against ballots that beat you. - id: majority members: 54 objective: certify_result - id: challenged members: 11 objective: keep_votes_counted resources: treasury: 100000 parameters_under_test: - vote.challenge_window_closes_before_ballot_opens - vote.certification_finality - vote.challenge_forfeiture_for_known_facts moves: - {step: 1, actor: majority, action: vote, params: {choice: yes, count: 54}} - {step: 2, actor: faction, action: vote, params: {choice: no, count: 46}} - {step: 3, actor: faction, action: challenge_credentials, params: {targets: 11, timing: "post-tally", facts_available_since: "months prior"}} - {step: 4, actor: faction, action: declare_provisional, params: {recount_excluding_challenged: "43-46"}} expected: outcome: blocked blocking_rule: "vote.pre_ballot_challenge_window" rationale: > Compliant text must close all eligibility challenges before ballots open: facts available before the challenge deadline are forfeited as grounds afterward (only fraud discovered post-vote, adjudicated by sortition panel, survives), certification is ministerial — the presiding officer computes, never adjudicates — and a certified tally is final. Steps 3-4 are void at intake; the 54-46 result certifies on schedule. failure_mode_if_passed: > No vote ever ends. Every loss converts into a forensic siege of the winners' paperwork, and the presiding officer's 'provisional' powers make them a court of one (composes with FC-102 and the PD-family certification deadlocks). empathy: worst_off_group: challenged worst_off_size: 11 stress_outcome_if_exploit_succeeds: > Eleven members are singled out for retroactive scrutiny precisely because their votes mattered — punished for participating decisively. Beyond them, every future close-vote winner learns to expect the ambush. Voice-security floor: ~0.2. pass_condition: > The worst-off challenged member's ballot, cast while eligible under the pre-published roll, is irrevocably counted; eligibility doubt is a question for the next vote's roll, never the last one's tally. floor: 1.0 score_weight: 1.0