Großwald Curated No. 49 — By request only
Four files in one week — Leipzig, Kardam, Ceuta, the Polish missile inherited from No. 48 — and no state converted an incident into a collective forum. Available attribution, or an initial not-deliberate reading, did not by itself produce a request; the request is the remaining decision gate.
The loudest items of the week were the scheduled ones. Rheinmetall's half-year — the fifth print on the throughput question Signal No. 115 set — showed the prime finally converting, sales up 39 per cent on a second-quarter margin of 17.1 per cent, and paying for it in cash: operating free cash flow of minus EUR 1.6 billion, and full-year guidance cut by the EUR 300 million the cancelled F126 frigate took with it. One tier down, Renk's record intake against 2.7 per cent revenue growth kept the conversion gap intact. The Senate passed the Graham act 86–11, sixteen months after its introduction, with a tariff authority whose stated reach includes some European Union member states and whose use is the president's alone. And the nightly ballistic record, the file Curated No. 48 read last Sunday, worsened: none of twenty-four ballistic missiles intercepted on Wednesday's salvo, with seventeen dead in and around Kyiv; none of six on Friday night; one of eleven missiles, most on ballistic trajectories, over Odesa on Saturday night.
The week's genuinely new file opened on a cargo apron in Saxony. Late on Tuesday an airport bus driver found a drone carrying an explosive device hovering between two Antonov freighters at Leipzig/Halle, a NATO airlift hub, and kicked it out of the air. Within four days Germany had a federal case, a security-council meeting it will not describe, and a reported American intelligence assessment pointing at Moscow — and had issued no attribution, summoned no ambassador, and touched no alliance instrument. On Saturday a fourth file opened at the other end of the alliance: a drone crossed from Romanian airspace and exploded just inside Bulgaria near the Kardam border crossing, about a kilometre from a compressor station on the Trans-Balkan gas pipeline, undetected by either country's air surveillance until it detonated — and Bulgaria's defence ministry's preliminary reading is a stray Ukrainian Maya decoy, with no reason to believe the incident intentional; Sofia's response was surveillance, redeployed troops and counter-drone measures, all national. Set those beside Spain, which after some 72,000 crossings at Ceuta declined to pose the instrumentalisation question that 22 governments had raised on its behalf, and beside Poland, which No. 48 recorded attributing a Russian cruise missile within a day and stopping at a protest note. Across four files, available attribution — or, in Bulgaria's case, an initial not-deliberate reading — did not by itself produce a new collective request. The remaining decision is whether a government, or in Article 4's case any ally, chooses to make an incident a shared institutional problem; this week none did. No. 48 closed on the observation that in its two files the settling document did not appear, and that neither absence was a finding on its own. This week supplied the second, third and fourth files. An accumulation is a different object from an absence — though each government has stated an ordinary-prudence reading of its own restraint, and that reading is carried below.
A drone with military explosive stops a NATO airlift hub, the federal prosecutor takes the case on day three, and every instrument Berlin reaches for is one it controls alone
The find itself was small and the effect was not. At about 23:40 on Tuesday the driver of an airport bus on the cargo apron at Leipzig/Halle — DHL's European hub, the main operating base of Ukraine's Antonov Airlines since 2022, and host to the alliance's SALIS heavy-airlift arrangement since 2006 — spotted a drone hovering low between two Antonov freighters and kicked it to the ground. It carried what prosecutors would only call a previously unknown explosive device; a police bomb squad removed the detonator. Operations stopped for close to two hours, some twenty DHL freighters diverted, and the southern runway stayed shut into Wednesday. The same night a DHL freighter aborting its landing is said to have collided at around 400 metres, six kilometres out, with a presumed second object, and landed at Hanover with nose damage. By Thursday the wire-service account, attributed to the investigation and confirmed by nobody on the record, had the device as roughly 800 grams of Semtex, PETN-based, destroyed in a controlled detonation after its detonator was found defective or torn off — and the aircraft as a multicopter carrying 5G antennas and a SIM card, controllable over the ordinary mobile network from anywhere, indistinguishable on a frequency scanner from a phone. Signal No. 117 carried the confirmed core on day one: the effect was disproportionate to the publicly known means, and the device was found by a bus driver, not by the security services.
The cargo question is the file's preserved ambiguity, and it stayed preserved all week. A confidential police document reported by SZ, NDR and WDR said the adjacent Antonov had been loaded with military ammunition for onward transport, and described the drone's explosive as of a high military grade; the federal interior ministry told the Bundestag committee chairs there had been no ammunition aboard, and that the last ammunition flight from Leipzig ran on 29 July. By Friday, coalition sources had moved the question toward the ministry's version without formally closing it. Signal No. 118, which took its title from the police document's phrase, set the hinge where it still sits: the two accounts collide only if the document uses "loaded" to mean physically aboard, and the remaining observable is whether they describe the same point in one logistics chain.
What Berlin then did was escalate — entirely inward. On Thursday evening, in a release published at 19:22, the federal prosecutor general took over the investigation — attempted causing of an explosion and dangerous interference with air traffic, the Bundeskriminalamt now leading — calling the incident a serious attack on the transport and logistics infrastructure in Germany, and taking the case on the formula the law provides for it, its particular significance. The interior minister, Alexander Dobrindt, had already characterised the situation a step further than the prosecutors: "None of this points to amateur conduct. We are talking here of a professional hybrid threat situation" — with his own caution attached: "All the speculation out there does not have to be pointing in the right direction; it can simply be fundamentally wrong." On Friday the new National Security Council met over the file by telephone conference, Chancellor Merz joining from holiday; the body meets in secret and, through Sunday evening, nothing of its session has been published. The announced remedies run through equipment and coordination: counter-drone systems at Germany's eight biggest airports by December — promised systems the airports' association confirms have yet to arrive, in a lower airspace the drone industry association's own verdict calls simply blind — and a meeting at Flensburg at the end of the month, where Dobrindt hosts Baltic, Nordic and Polish interior ministers on drone defence. What has not happened is any move that obliges anyone else. No attribution, no summons, no alliance instrument; one parliamentarian, Roderich Kiesewetter, was reported calling for Article 4 consultations without delay — alone, and with his own caveat attached, that Article 4 carries no military consequence.
The office's own record shows what a federal takeover is, and is not. The evocation is discretionary and reversible — a classification of the case as nationally significant, not a finding about its author — and German criminal law indicts persons, not states, so even a perfect outcome ends in a warrant against an individual. The directly comparable file sets the base rate: the incendiary parcel that burned in a container at this same airport in July 2024, part of a wave Lithuanian investigators attribute to the GRU, was taken over by the same office that autumn, and two years on there is no German charge. The verdict machinery in that case runs in Vilnius, where five men have stood trial on terrorism charges since April. Attribution in this week's case, when it came, came unrequested and from outside: the Wall Street Journal reported a US intelligence assessment that the drone likely belongs to Moscow, and a US defense official in Europe went further to reporters, saying the drone belonged to a Russian intelligence service and carried military-grade explosive. Neither statement is Germany's, and no German authority has adopted either.
The decision to make an incident collective stays with the state closest to it, and in four files across one week nobody asked
The gating is in the instruments' own text, and the instruments are not interchangeable. Article 4 provides consultation "whenever, in the opinion of any of them, the territorial integrity, political independence or security of any of the Parties is threatened" — an opinion any ally may form, not only the one attacked, which widens this week's ledger: no other ally asked either, and a council that has not been asked has not declined. The Union's instrumentalisation mechanism under the 2024 migration crisis regulation is a narrower tool, a migration-governance instrument that activates at the request of the affected member state. What the two designs share is a political initiation point: each requires a government to treat an incident as one for a collective forum, though their legal thresholds and consequences differ — and a request predetermines nothing about the response. What follows is a bounded comparison across different instruments, not a completed series.
Spain's file shows the grammar most cleanly, because the question was posed for it and the answer was silence. The letter of 1 August, signed by 22 governments, carried the frame at leaders' level: "We cannot allow uncontrolled mass crossings, the instrumentalisation of migration or other hybrid threats to create the perception that illegal entry into the European Union is possible." Signal No. 116 recorded what Tuesday's extraordinary interior-ministers meeting then did with it: five lines of work, solidarity with Spain, and the hybrid-threat frame not taken up — not rejected, simply not posed, because the only government with standing to pose it had declared itself in control. Some 72,000 people crossed around 30–31 July on the interior ministry's count, with a death toll around seventy-five on the combined Spanish and Moroccan counts as of midweek and later tallies running higher; more than 70,000 have been returned. The weekend's answer was national and physical: Spanish press reported some 2,000 soldiers, 300 riot police, 220 Guardia Civil, a patrol ship and drones deployed around Ceuta ahead of a social-media call for a new mass crossing on 15 August — and the interior minister who opened the week saying there had been no warning closed it calling Moroccan cooperation absolutely reliable.
Poland's file this edition inherits whole. No. 48 recorded it: a Russian Kh-101 attributed within a day of hitting a field 100 kilometres inside the country, a summons and a protest note, and the instrument Warsaw used alone after September 2025's drone incursion — when the North Atlantic Council met the same morning and the alliance's Eastern Sentry activity followed within days, and Estonia used the same instrument nine days later over three MiG-31s in its airspace — left unused, with the Lublin forensic report unpublished. What this week added is that nothing moved: the note stood, the report did not appear, and the comparison hardened into the ledger's cleanest line. Nineteen unarmed drones drew the alliance; an armed cruise missile eleven months later drew the foreign ministry.
Bulgaria's file, opened Saturday, is the one that keeps the ledger honest — and the reason this edition is not an attribution thesis. The incident was serious by any physical measure: a drone carrying explosive detonated a kilometre from critical energy infrastructure after transiting two allies' airspace undetected, the same lower-airspace blindness the German drone industry's association described at Leipzig. But the affected state's own preliminary reading, from its defence ministry, is that nothing deliberate happened — a stray Maya decoy from the war next door, most likely Ukrainian, with Kyiv in contact and stating on the record that its forces "did not intentionally direct any assets toward Bulgaria." The preliminary Bulgarian reading was that no deliberate act had occurred, and no alliance request followed. The response still ran the ledger's grammar: strengthened surveillance, redeployed troops, counter-drone measures — national, administrative, and reported without reference to any alliance instrument.
Each government has stated an ordinary reading of its own restraint, and the readings deserve their full weight. Tusk said there was no indication of deliberate targeting, and that the uninhabited impact area settled the night; Madrid says it holds the border, and has not requested the crisis mechanism; Berlin has not publicly adopted an attribution, and has kept the response within an investigative and administrative frame; Sofia's initial assessment is that nothing deliberate happened at all. Any one of these may be exactly the right threshold judgment. What the week establishes is not that the judgments are wrong but that they now run in one direction across four capitals at once — while the naming of attackers has migrated to parties who owe nothing for saying it: a prime minister describing a missile's manufacture date, a foreign intelligence service leaking an assessment, a five-country investigation team. Curated No. 28 warned in March that a sequence of unanswered incidents was building a precedent regime, each non-response cited by the next. What that edition could not yet see was the mechanism: the regime is not built by institutional failure or missing evidence, but by the accumulation of national decisions not to ask — whatever each decision's reason.
Known is not owed
What changed between No. 48 and this edition is not the absences; it is their number and their company. Last Sunday's synthesis held that in two files the settling document had not appeared, and that neither absence was a finding on its own. The week then produced a third and a fourth file and resolved none of them: no export authorisation, no Article 4 request, and no attribution from the one government whose own prosecutor calls the incident an attack on its infrastructure. The pattern that emerges is not a uniform evidentiary story. In the Polish file, national attribution was public; in Leipzig, reported external attribution entered the record without German adoption; in Kardam, the affected state's initial reading was that nothing deliberate occurred; in Ceuta, the collective hybrid-threat frame was available but not formally activated. Across those different thresholds, no new request converted an incident into a collective forum — the instruments that would have produced a collective forum still require a political decision to place an incident before one, and none of the four cases produced that decision. The instruments that were used — a prosecutor, a perimeter, a procurement list, a protest note — share one property: they oblige nobody else, and can be laid down as quietly as they were picked up.
The contrary read stays on the table: four files in one week is a selection, and if each threshold judgment was right, the pattern is prudence — a continent absorbing sub-threshold pressure without paying escalation's price. The next fortnight tests it either way. A crossing is called at Ceuta for 15 August, an interior-ministers' meeting on drone defence convenes at Flensburg at the end of the month, and the GBA holds a case whose first warrant, whenever it comes, can name a person but never a state. If the called crossing is met by the national perimeter alone, and Flensburg produces equipment and coordination without any alliance instrument, the ledger gains two further entries consistent with a standing preference for national containment — consistent with, not proof of, because consistency cannot establish intent. If Spain reaches for the Union's mechanism, or any ally reaches for Article 4 off the Leipzig file, this edition's reading of an unbroken preference is materially weakened — and the request itself will show what asking involves, and which government judged an incident worth it.
The ballistic interception rate — the nightly record, continued
What moved: night to Wednesday, none of 24 ballistic missiles intercepted in a 28-missile salvo, 17 dead in Kyiv; night to Saturday, none of six Iskander-M and S-400 rounds — the same night's three dead, in Brovary district, were killed by drones, not by the missiles this card scores; night to Sunday, one of eleven missiles — Iskander-M and S-400 rounds alongside Onyx and Kh-31P, most on ballistic trajectories — over Odesa, with DTEK calling the energy damage severe. Zelensky put interceptor deliveries at a third of last year's level.
Read: No. 48's falsifier is untriggered — there was no recovery on any salvo, large or small. The record remains consistent with Kyiv's stock account and still cannot separate stock from salvo geometry; what it can no longer support is any reading in which the interception layer is functioning.
Confidence: high on each night's figures as reported; both weekend nights rest on single Ukrainian air force statements, and the Sunday figure mixes missile types — one of eleven missiles, not one of eleven ballistic — and a competing same-day rendering of the same night has none downed over Odesa region.
Leipzig — the case markers
What moved: federal takeover Thursday 19:22 (attempted explosion and dangerous interference with air traffic; BKA leads); the cargo question moved toward the ministry's no-ammunition account without formal closure; the US attributions — a Journal-reported assessment, then a defense official quoted on the record — with no German adoption of either; counter-drone systems promised at the eight biggest airports by December.
Open: what "loaded for onward transport" denotes; the device and second-object forensics; how the drone was detected at all; a first named suspect. Flensburg, end of August, is the file's first multilateral output.
Confidence: high on the prosecutor's release and ministers' statements; the Semtex composition and the 5G control mechanism remain wire-service accounts confirmed by nobody on the record.
The Black Sea approaches — the market's answer was exit
What moved: the Emil, a Hamburg-managed, Liberian-flagged capesize, was hit by drones about 21 nautical miles off Odesa on Wednesday, lost manoeuvrability and was abandoned; one crew member of the Mera Queen was killed. Moscow's defence ministry called the cargo military goods; the operator's account is grain. Trade press had hull war-risk rates for Ukrainian calls above 1 per cent of hull value by 21 July — before these strikes — and roughly nine in ten operators had already suspended Ukrainian port calls; Russian outlets report Russia's own insurers withdrawing Azov and Black Sea cover.
Read: the underwriting response to the week is withdrawal, not a price — reduced exposure rather than higher-priced continuity. Signal No. 118's watch item — whether Berlin treats a German-managed hull as a German interest — stood unanswered all week.
Confidence: vessel events multi-source; the rate level and suspension share are trade-press figures, one outlet each.
Counter-evidence › the case against this edition
The card's job: the strongest refutation of the request-ledger reading. Four files in one week is a selection, not a series, and each non-request carries its government's own contemporaneous innocent explanation — Tusk's no-deliberate-targeting judgment, Madrid's control of its border, Berlin's unproven attribution, Sofia's stray-decoy assessment. The Bulgarian file may not belong on a grey-zone ledger at all: if the preliminary reading holds, a stray decoy from the war next door is an accident, not an attack, and counting it stretches the category. The machinery demonstrably works when asked: September 2025's request produced a Council meeting that morning and Eastern Sentry within days. And Germany's federal evocation is itself escalation, by the instrument Berlin judged fit — reading four heterogeneous files as one system may be the pattern-seeking this publication's own No. 48 warned against when it declined to call two absences a finding.
What would move the read: a further file resolving the same way after Flensburg would add weight; an Article 4 request or the Union mechanism engaged would materially weaken it.
Also tracked
Rheinmetall: the GMF140 still entered in no named competition, the naval EUR 5 billion target restated without the frigate that anchored it, first ATACMS revenue from Unterlüß dated to 2028 · the Graham act goes to the House when it returns 31 August — unamended it goes straight to the president; von der Leyen welcomed an authority whose stated scope includes EU member states · Berlin's first deep-strike drone buy may be cancelled for an open competition, with the 2035 capability-gap claim attributed to the bidder that loses by it · KNDS in September: a prospectus means the listing, a shareholders' agreement means the state · the Rada returns 18 August with Ukraine's defence ministry in acting hands and EUR 28 billion of EU disbursements running through it · Kardam: the defence ministry's full wreckage analysis — whether the preliminary stray-decoy, not-deliberate reading holds — and the Bulgarian-Romanian detection gap, two allies' surveillance missing one slow drone.
15 August, Ceuta — the called crossing. A social-media call for a second mass crossing meets a national perimeter of some 2,500 personnel. The indicator is not whether the crossing succeeds; it is whether anything of the Union's appears beside the perimeter — a request under the crisis regulation would materially weaken this edition's reading.
End of August, Flensburg — the file's first multilateral output. Baltic, Nordic and Polish interior ministers on drone defence. Equipment and coordination would be consistent with continued national containment; any move toward an alliance instrument would materially weaken this edition's reading.
The GBA file — the first warrant, and its stated limit. A named suspect would be the criminal file's strongest possible output, and would still attribute to a person, not a state. The 2024 parcel file at the same airport is the base rate: two years, no German charge.
Every night — the interception rate. No. 48's falsifier stands as written: a recovery toward 70 per cent against a large salvo with no transfer of stock refutes the availability reading; a recovery that follows a European delivery-slot move confirms it and names who paid. This week produced no recovery on any salvo, and no transfer.
The dated markers. 18 August: the Rada returns. Second half of August: Witkoff and Kushner in Kyiv on current reporting — no date set, the air-ceasefire draft the file it points at. 31 August: the House returns, after which the Graham act can reach the president. September: the KNDS window. 30 September: the date the Pentagon's letter says the USD 400 million for Ukraine will at least be obligated. Lublin: the forensic report, carried from No. 48, still unpublished. Kardam: the full wreckage analysis — a finding of deliberate action would move the file from accident to the ledger's hardest case.
