The Legitimacy Audit: Affordable Contestation in Budgeted Collective Choice

This paper turns a positive theory of heresthetic manipulation into a normative measurement procedure. The legitimacy question it asks is not whether an installed outcome is currently popular, but whether those who lost can still activate a pivotal, institutionally recognized response without exceeding their resources. Two councils with identical outcomes, majority margins, and public justification can differ in legitimacy when a captured certification board raises the price of the counter-certificate beyond the opposition's budget: one world is affordably contestable and the other is not. The audit formalizes exactly this distinction. Under contest-attack coincidence, the central result is an incompatibility. A nonnull installation program cannot both pass the pooled-coalition affordability audit and be strictly coalitionally secure, because its least blocking price is no greater than the budget of a coalition certified able to contest it. Conversely, strict route security makes every coincident pivotal contest unaffordable, and equality at the budget cutoff is contestable but insecure. The incompatibility is routewise; an outcome-level version additionally requires route-invariant blocking-price margins. On an explicit contest graph, re-entry prices, the audit verdict, and the uncovered set are computable in polynomial time, while pure equilibrium membership remains PSPACE-complete under a succinct polynomial-horizon encoding. Affordability of restoration alone does not imply uncovered-set containment, as a five-voter free-rider example shows; containment is recovered only when every coverer admits an individually enforceable final challenge with strict net willingness to use it. Coalition pooling can therefore make an audit pass even when the unique noncooperative equilibrium mounts no contest, so an affordable-contestation verdict is a statement about coalitional capacity, not about what an uncoordinated opposition would actually do. At a hysteretic capacity layer the audit uses the rebuild price rather than the marginal erosion price, producing an exact legitimacy tax and a half-open disagreement frontier, and a specified renewal technology yields a closed-form minimum stationary maintenance outlay. The audit recursion terminates at a fixed interpreter, and no proper resource signature can classify audit status. The theory therefore delivers a parameterized, layer-indexed correspondence rather than a universal legitimacy index.