US-EU Evergray War — Legislative Trail — Audit

The Ceuta operation of July 31st 2026 revealed a documented sequence:

April 2026: House Appropriations Committee formally describes Ceuta and Melilla as "located in Moroccan territory" and supports US mediation of their "future status."
July 15, 2026: The National Security, Department of State, and Related Programs Act passes the House 217-209. The accompanying committee report, 119-631, carries the Ceuta and Melilla language — inserted by Mario Díaz-Balart, Vice Chairman of the Appropriations Committee and a close ally of Secretary of State Rubio — alongside $40 million in military financing for Morocco. Sole Republican dissenter: Thomas Massie.
July 30–31, 2026: Some 72,000 people cross into Ceuta with Moroccan police direction, out of an estimated 80,000 who attempt it. At least 111 dead, a count that took five weeks to settle: 57 in initial reporting, 72 confirmed by 2 August, 86 in later reporting, and finally some 100 in and around Ceuta waters with 11 more at Fnideq.
July 31, 2026: US State Department blames Spain, offers to assist "other European allies considering similar options."
August 1, 2026: The State Department raises its Ceuta travel advisory to Level 3, "reconsider travel."

What the report language is, and is not. A committee report is not statute. Report 119-631 carries no force of law, and official US policy continues to treat Ceuta and Melilla as Spanish. Anyone citing this entry as evidence that Washington has formally reassigned Spanish territory is overreading it, and this audit does not make that claim. What the language does is establish, on the record and in a document attached to an appropriations bill that did pass, that a sovereignty question exists and that a named ally of the Secretary of State chose to put it there two weeks before the crossing. The significance is the sequence and the timing, not the legal effect.

This sequence constitutes the first documented case of American legislative preparation, followed by a third-party hybrid operation, followed by American diplomatic cover — all targeting the same EU member state government. Whether the coordination was explicit or structural is a question of evidence not yet fully resolved. See the full analysis: Ceuta: The First Evergray Battle.

The attribution problem, stated against this audit's own interest. The premise that Morocco directed the crossing is contested by serious analysts, and this entry should name them rather than concede the point in the abstract. Riccardo Fabiani of the International Crisis Group argues the event is by its nature impossible to pin on a single actor or state — "you cannot confidently say there was involvement by a state, it's plausible deniability" — which is a description of the design, but also a description of why the design works. Ignacio Cembrero's linking of Moroccan Pegasus surveillance in Spain to the July 30th crossing remains, as NPR reported on 16 August, a lone voice. Morocco's formal status as a Spanish ally makes attribution harder still, and the honest reading is that definitive proof of state direction may never surface. That does not dissolve the documented sequence above, none of which depends on proving Moroccan intent. It does mean the charge rests on timing and on the record, not on a smoking gun.

Falsifiable prediction (August 4, 2026): The Ceuta event will be followed by at least one further incident in which documented American diplomatic or legislative action precedes or enables pressure on an EU member state government through hybrid means. The pattern, once established, will repeat. The actors — Morocco as instrument, Washington as enabler — will use the Ceuta template again against Sánchez or against another centre-left European government Washington has identified as a target.

First review — 21 August 2026: not resolved. Seventeen days is too short to test a pattern claim, and nothing in that window meets the prediction's stated terms. Four candidates were considered and rejected. Latvia stopped 28 migrants from Belarus on 21 August after finding a tunnel — genuine hybrid pressure on an EU member state, but with no American precursor; the Belarus track is independent and long predates Ceuta. Rubio sanctioned ICC President Tomoko Akane and Deputy Prosecutor Abdoulaye Seye on 19 August under Executive Order 14203 — direct American action, but through no third-party instrument, and no EU national was targeted. The tightening of US Cuba policy has exposed Spanish companies to secondary sanctions, adding a second pressure track on the Sánchez government, but applied directly by Washington rather than through a proxy. And the second Ceuta wave of 15 August involved the same actors in the same theatre with no fresh American precursor on the record. The prediction stays open. The next meaningful checkpoint is the first instance involving a member state other than Spain, or a documented American precursor attached to a non-migration instrument.

Second review — 27 August 2026: still not resolved, and this is the closest candidate yet. Morocco escalated sharply this week. At a royal palace ceremony on 24 August with King Mohammed VI present, the Minister of Islamic Affairs, Ahmed Toufiq, described a 15th-century imam as a symbol for Moroccans "to liberate the occupied cities" — direct, ministerial-level, state-choreographed language about Ceuta and Melilla, following Justice Minister Abdellatif Ouahbi's call the week before to formally discuss "the future of the two cities." This is a real hardening, not a repeat of July's ambiguity, and it draws cross-spectrum condemnation inside Spain — Vox's Abascal calling it "an act of war," Podemos independently reaching for "a hostile act of hybrid war," Sumar formally moving to strip Morocco's 2030 World Cup co-hosting status. Riccardo Fabiani, already on record in this entry, goes further this time: he reads the timing as Morocco signalling to Washington and Israel — "we've done what you implicitly told us to do, we've humiliated Spain" — and states that recent remarks from US and Israeli officials broaching Ceuta and Melilla made the issue "low-hanging fruit" for Rabat.

That is the strongest analytical statement yet connecting American signalling to Moroccan escalation. It is still not a documented American precursor in the sense this entry requires. Fabiani's "recent remarks from U.S. and Israeli officials" are not named, dated, or sourced to a specific document the way Report 119-631 was — this is an expert's informed inference about signalling, not a committee report, a bill, or an official statement this audit can cite and date. Held to the same standard applied to the four rejected candidates on 21 August, this does not clear the bar. It also fails the stated next-checkpoint conditions on both counts: the target is still Spain, not a different member state, and the instrument is still the Ceuta/Melilla territorial question, not a new non-migration lever. What this review adds is a second, named, credentialed voice — Jorge Dezcallar, former Spanish ambassador to Morocco and former head of Spanish intelligence, warning that "Rabat confuses concessions with weakness" — strengthening the underlying pattern case without supplying the specific documented American action the prediction requires. The prediction remains open. The next meaningful checkpoint is unchanged: a member state other than Spain, or a named American document or statement precisely dated and tied to a non-migration instrument.

Third review — 1 September 2026: not resolved; the first candidate to meet both stated checkpoint conditions and fail the prediction anyway. On 26 August the State Department, with the Treasury, designated Autistici/Inventati — an Italy-based non-profit hosting collective founded in 2001 — a Specially Designated Global Terrorist under Executive Order 13224. The stated basis mixes a serious material-support allegation (services knowingly provided to the PKK) with a much looser one (Antifa cells, Hamas and Hizballah communiqués, and 2026 rail-infrastructure sabotage in France, Italy, Germany, and the Netherlands, reached through what a platform's users posted). For the first time since 4 August this is a named American document, precisely dated, aimed at an entity inside a member state other than Spain, carried on a non-migration instrument. Both checkpoint conditions as stated on 21 August are met. The prediction still fails, and it fails on its own terms rather than on a technicality: the target is a hosting collective, not a member state government; the instrument is overt sanctions law applied directly by Washington, not a deniable third-party proxy; and nothing about the action is hybrid. Held to the standard that rejected the ICC sanctions on 21 August — "direct American action, but through no third-party instrument" — this is the same category of event, with one difference worth logging: an entity inside the Union is now the target, where the ICC is not. That narrows the distance between two tracks that both now reach inside EU jurisdiction, one through a proxy and one directly, without merging them.

The checkpoint, restated more precisely. That an event can satisfy the 21 August checkpoint while failing the prediction is a fault in the checkpoint, not a finding, and it is corrected here against this audit's own interest — the tighter wording makes resolution harder, not easier. The next meaningful checkpoint is a documented American action, named and precisely dated, that precedes or enables pressure on an EU member state government through a deniable third-party instrument. A member state other than Spain and a non-migration lever remain necessary, but they are no longer sufficient on their own. See the analysis of the designation and of what answering a permanent threat with emergency instruments costs the answerer: What You Won't Give Up Is What You Are.

Fourth review — 7 September 2026: not resolved; for the first time the new evidence bears on the charge rather than on the prediction. Nothing in this window is a candidate under the prediction. Every development since 1 September is Spanish or Moroccan, and none carries an American precursor of any kind, so the checkpoint restated on 1 September is untouched and the prediction stays open on it. What the window delivers instead is movement on the attribution problem this entry logged on 4 August as possibly unresolvable — and a second question, about Madrid rather than Washington, that this entry has to decide what to do with.

What moved, in this entry's favour. On 2 September the report of the Centro Nacional de Inmigración y Fronteras — 55 pages, 32 photographic exhibits and a nine-minute video annex, prepared for National Court judge María Tardón — leaked. It rejects spontaneity, finding "prior planning," "active guiding" of migrants toward the crossing points by uniformed Moroccan gendarmes and by plain-clothes personnel, and a Moroccan police response that was "to say the least, one of total permissiveness, with no serious attempt recorded to reduce, disperse, or move the crowd away from the border area." It describes a two-phase design — first to collapse border management, then to "eliminate Spain's response capacity" — and records that only about 10 per cent of those who crossed remained, some 70,000 of 72,000 returning to Morocco in orderly fashion, which it reads as migratory purpose serving as "formal cover." Tardón had instructed the investigating officers to report to her alone, not to their superiors or the Interior Ministry. This is not the smoking gun this entry said might never surface, and it should not be sold as one: a Spanish state document showing gendarmes directing crowds establishes permissiveness and direction on the ground, not an order from Rabat's political leadership, which is the claim Fabiani called irreducibly deniable and which remains so. But the distance between "no state fingerprints" and "state fingerprints without a signature at the top" is real, and it has closed in this entry's favour. Saying so plainly is the same obligation that produced the 4 August attribution paragraph.

What moved against it. On 6 August State Department spokesman Tommy Pigott said the United States "unequivocally supports Spain's sovereignty over Ceuta and Melilla," and that the committee report is not part of US law. That statement is a month old, this audit should have carried it before now, and it is added here rather than at the next convenient moment. It does not disturb the sequence — the report language, the $40 million, the 31 July statement blaming Spain and the 1 August travel advisory all stand on the record — but it is the clearest named, dated, official American disavowal available, and an entry that rejects candidates for want of a named and dated document has to log the ones that cut the other way. Alongside it: the European Commission has continued through this window to describe Morocco as a trusted partner.

What Madrid knew. The warnings are now on the record and they are specific. Per El Mundo, CNI reporting circa 21–22 July identified 30 July as a possible date; on 27 July the Army's Regimiento 32 de Guerra Electrónica notified CIFAS that Moroccan border agents had picked up a mass surge timed to the Throne Festival, rated very high in probability; CENIF warned of an extreme risk of collapse; and on the evening of 29 July the Guardia Civil reported at least 3,000 people massed and ready to swim. When the crossing began, five civil guards and four members of the underwater unit were at the frontier, with army reinforcements arriving late in the afternoon. Defence Minister Margarita Robles says the CNI warned; Interior Minister Fernando Grande-Marlaska says it did not, and told Congress on 28 August that the information available did not allow the true scale to be foreseen. Ángel Víctor Torres closed ranks with Marlaska; the PSOE's line is that both accounts "can be true at the same time." The government's strongest exculpatory document is a real one and belongs here: the Guardia Civil's own report to Tardón, delivered 4 September, states that prior warnings existed but that none anticipated the magnitude of what happened. Against it stands National Police director Francisco Pardo, who told Marlaska on 2 September that "there is no police report whatsoever" attributing planning or execution to Moroccan security forces — a statement the published excerpts of the CENIF report contradict. Izquierda Unida has called for Marlaska's resignation or Pardo's.

The asymmetry, which is a finding; the motive, which is not. On 31 August, on Cadena SER, Pedro Sánchez attributed the disinformation that fed the crossing to networks "linked to Russia and Israel, and to an ultra-right international," citing analysis by the European External Action Service, and named no Moroccan role; Gideon Sa'ar said he was "lying shamelessly" and Dmitry Peskov denied Russian involvement. In Congress on 3 September he conceded that Moroccan forces did not contain the crossing for a period of roughly ten hours, disclosed that ambassador Karima Benyaich had been summoned on 21 August over the "historic rights" statements, said relations "will not be the same," promised "total firmness" if state responsibility were established — and maintained that no solid evidence shows Morocco organised or executed it, arguing that the orderly return of some 70,000 people would have been impossible had Rabat planned the operation. What this entry can state without assigning a motive is that the standard of proof is not being applied evenly. The Russia and Israel attribution rests on EEAS analysis of amplification patterns. The Morocco non-attribution declines to act on a 55-page investigative report with 32 exhibits and a video annex, written by a Spanish state body and delivered to a National Court judge. Whatever one makes of either, the second is the harder evidentiary object, and it is the one being held at arm's length. Candidate explanations are available and none of them is established: the 2022 Western Sahara reversal is a sunk position that cannot be cheaply abandoned; Spain depends on Moroccan cooperation for returns, for counter-terrorism and at the border generally — a dependence Sánchez himself invoked when he made the orderly return his argument against premeditation; a formal accusation against a formal ally would force consequences Madrid may not want to carry; and it is possible the government genuinely holds an investigative report to a higher bar than a leak-driven news cycle does. Naming them is not choosing among them. Unexplained is a permitted verdict here. A motive attributed without evidence is the failure this audit exists to avoid, and it does not become permissible because the conduct is hard to rationalise.

Scope, and why this is flagged rather than absorbed. The standard on this entry is alliance integrity and the honest characterisation of the US-EU relationship, and the charge names Washington and Rabat. What Madrid knew, when, and why it will not say is a second accusation, with a different subject and a different standard, and folding it in here would let a strong Spain-side story stand in for the American precursor the prediction actually requires — precisely the substitution the 1 September restatement was written to prevent. Only the part that bears on Morocco-as-instrument is taken into the charge above. The rest is logged in the evidence and left for an entry of its own. Verdict: ongoing. Prediction: open. Checkpoint: unchanged.

The charge: American legislative preparation preceded a third-party hybrid operation against EU territory, and American diplomatic cover followed it.

Evidence

US House Appropriations Committee report, April 2026
National Security, Department of State, and Related Programs Act, passed the House 217-209, July 15, 2026; accompanying committee report 119-631
Ceuta and Melilla language attributed to Mario Díaz-Balart, Vice Chairman, House Appropriations Committee
Report 119-631 carries no force of law; official US policy continues to treat both cities as Spanish
Thomas Massie post, August 1, 2026
US State Department statement, July 31, 2026
US State Department raises Ceuta travel advisory to Level 3, August 1, 2026
NYT Ceuta ground reporting, July 31, 2026
Riccardo Fabiani, International Crisis Group, via NPR, August 16, 2026: the crossing cannot confidently be attributed to a state — "it's plausible deniability"
Ignacio Cembrero's Pegasus-to-Ceuta connection reported as a lone analytical position, NPR, August 16, 2026
Casualty range unconverged: 57 in initial reporting, at least 72 confirmed, 100 or more per the mayor of Ceuta
Morocco-US strategic partnership documentation
Morocco-Russia strategic partnership, March 2016, renewed October 2025
Considered and rejected as prediction-resolving, 21 August 2026: Latvia/Belarus tunnel interception (no US precursor); ICC sanctions on Akane and Seye under EO 14203 (no third-party instrument, no EU national targeted); Cuba secondary-sanctions exposure of Spanish firms (direct rather than proxy pressure); second Ceuta wave of 15 August (no fresh US precursor)
Royal palace ceremony, Rabat, 24 August 2026: Minister of Islamic Affairs Ahmed Toufiq, "liberate the occupied cities," King Mohammed VI in attendance (POLITICO, 27 August 2026)
Justice Minister Abdellatif Ouahbi, call to discuss "the future of the two cities," cited "historic and geographical right," mid-August 2026
Domestic Spanish reaction: Feijóo (PP), Abascal (Vox) — "act of war"; Podemos — "hostile act of hybrid war"; Sumar — formal motion against Morocco's 2030 World Cup co-hosting status; Antonio Maíllo (IU) — names a "United States-Israel-Morocco alliance" objective to destabilise the Spanish government
Fabiani, second statement, 27 August 2026: Ceuta as signal to Washington and Israel; "low-hanging fruit" framing tied to unnamed recent US/Israeli remarks — considered and rejected as a documented American precursor; inference, not a citable document
Jorge Dezcallar, former Spanish ambassador to Morocco and former head of Spanish intelligence: "Rabat confuses concessions with weakness"
Historical anchor: Morocco's 1975 Green March, precedent for mass-mobilisation pressure forcing a Spanish territorial handover
Sánchez government's 2022 reversal of near-50-year neutrality on Western Sahara, backing Morocco's position — per Fabiani, appears to have emboldened rather than settled Moroccan territorial pressure
Designation of Autistici/Inventati as a Specially Designated Global Terrorist, US Department of State with US Treasury, under EO 13224, 26 August 2026 — Italy-based hosting collective; cited grounds include material support to the PKK alongside Antifa, Hamas/Hizballah communiqués, and 2026 rail sabotage in France, Italy, Germany, and the Netherlands
Considered and rejected as prediction-resolving, 1 September 2026: the Autistici/Inventati designation — first candidate to meet both 21 August checkpoint conditions (member state other than Spain; named, dated, non-migration American document), but the target is not a member state government, the instrument is overt rather than deniable, and no third party is involved
CENIF report on the massive irregular entry into Ceuta, prepared for National Court judge María Tardón, leaked 2 September 2026 — 55 pages, 32 photographic exhibits, nine-minute video annex: "prior planning"; "active guiding" of migrants by uniformed Moroccan gendarmes and plain-clothes personnel; Moroccan police response "one of total permissiveness"; a two-phase design to collapse border management and then "eliminate Spain's response capacity"; roughly 10 per cent of entrants remained, migratory purpose serving as "formal cover"
Judge María Tardón instructed the investigating officers of the Comisaría General de Extranjería to report to her alone, not to their superiors or the Interior Ministry
National Police director Francisco Pardo to Interior Minister Grande-Marlaska, 2 September 2026: "there is no police report whatsoever" attributing planning or execution to Moroccan security forces — contradicted by the published excerpts of the CENIF report
Pre-crossing warnings, per El Mundo: CNI reporting circa 21–22 July 2026 naming 30 July as a possible date; 27 July notification from the Army's Regimiento 32 de Guerra Electrónica to CIFAS, mass surge timed to the Throne Festival rated very high in probability; CENIF warning of an extreme risk of collapse; Guardia Civil alert on the evening of 29 July, at least 3,000 massed and ready to swim
Deployment at the frontier when the crossing began: five civil guards and four members of the underwater unit; army reinforcements late in the afternoon (El Mundo)
Ministerial split: Defence Minister Margarita Robles says the CNI warned; Interior Minister Fernando Grande-Marlaska denies it and told Congress on 28 August 2026 that the information did not allow the true scale to be foreseen; Ángel Víctor Torres backed Marlaska; the PSOE position is that both accounts "can be true at the same time"
Guardia Civil report to Judge Tardón, 4 September 2026: prior warnings existed, but none anticipated the magnitude of the entry — the government's strongest exculpatory document on the record, logged as such
Pedro Sánchez, Cadena SER, 31 August 2026: disinformation attributed to networks "linked to Russia and Israel, and to an ultra-right international," citing EEAS analysis; no Moroccan role named. Israeli Foreign Minister Gideon Sa'ar: Sánchez is "lying shamelessly." Kremlin spokesman Dmitry Peskov denies involvement
Pedro Sánchez to Congress, 3 September 2026: concedes Moroccan forces did not contain the crossing for roughly ten hours; maintains no solid evidence that Morocco organised or executed it; argues the orderly return of some 70,000 people would have been impossible had Rabat planned it; promises "total firmness" if state responsibility is established; discloses that ambassador Karima Benyaich was summoned on 21 August over the "historic rights" statements; says relations "will not be the same." Feijóo: the government "knew it — and covered it up." Abascal: Sánchez is "defending Morocco"
Izquierda Unida calls for the resignation of Grande-Marlaska or of police director Pardo if the CENIF findings are confirmed
US State Department spokesman Tommy Pigott, 6 August 2026: the United States "unequivocally supports Spain's sovereignty over Ceuta and Melilla," and the committee report is not part of US law — logged against this entry's interest, a month later than it should have been
European Commission continues to describe Morocco as a trusted partner, reported 2 September 2026
Considered and rejected as prediction-resolving, 7 September 2026: the whole 31 August–4 September Spanish disclosure sequence — it bears on Morocco-as-instrument and on Spanish government conduct, carries no American precursor of any kind, and is therefore not a candidate under the prediction at all

Errata

The 21 August entry and this one both state the July 31st crossing at 50,000–60,000. POLITICO's 27 August reporting describes "this summer's influx" as "more than 70,000 migrants" into Ceuta. This may reflect a cumulative summer total (July 31 plus the smaller 15 August wave) rather than a correction to the July 31 figure specifically, but the sourcing does not make that explicit. Treated here the same way the casualty count is already treated: unconverged, not resolved, flagged rather than silently reconciled. Resolved, 7 September 2026. It was not a cumulative total. Spanish and international reporting has converged on roughly 72,000 people crossing over 30–31 July out of an estimated 80,000 attempts, and the CENIF report's own arithmetic — some 70,000 of 72,000 returned — settles it. The 50,000–60,000 figure was an understatement, is corrected in the bullet above, and is left recorded here.
The casualty range logged as unconverged on 4 August has converged, upward. The count now stands at 111 or more — some 100 in and around Ceuta waters and 11 at Fnideq — after passing through 57 in initial reporting, 72 confirmed by 2 August, and 86 in Sky News reporting. The bullet above is corrected. The earlier figures are left recorded rather than overwritten.
The crossing is dated 31 July throughout the earlier entries. It ran across the night of 30–31 July, and the investigative record is consistently 30–31: the CNI named 30 July, the Guardia Civil alert came on the evening of 29 July, and the CENIF report frames the event as 30–31 July. The bullet above is corrected; the single-day dating is left standing in the earlier review sections rather than retro-edited.
The 6 August 2026 State Department statement affirming Spanish sovereignty over Ceuta and Melilla should have been logged at the first review on 21 August and was not. It cuts against this entry, and the delay is the entry's error, not the statement's.

All audit entries are living documents. Updates are published with date stamps. Verdicts may be revised as evidence develops. Predictions are resolved — confirmed, denied, or extended — at the stated resolution date.