The War Spills Into Europe
Assessment
Russia's war on Ukraine is no longer contained to Ukraine. Across May–June 2026 the conflict's edge has crossed NATO and EU borders in three reinforcing ways. First, the airspace breaches turned lethal: on May 29 a Russian Geran-2 drone carrying ~30kg of explosives struck a 10-story apartment block in Galați, Romania, injuring a 14-year-old boy and his mother — the first Russian drone to cause casualties on NATO soil — after months of incursions into Poland (which scrambled jets on May 13 and May 24), Romania, Moldova (a Shahed closed northern airspace on May 13), and the Baltics, where NATO air-policing jets repeatedly scrambled and a Romanian F-16 shot down a stray drone over Estonia on May 19. Second, the nuclear dimension moved forward: on May 18 Russia and Belarus began joint exercises practicing the combat use of nuclear weapons — the first since the nuclear-capable Oreshnik IRBM was forward-deployed to Belarus in December 2025 — with Putin and Lukashenko overseeing live missile launches on May 21, and on June 6–7 a Russian strike hit the Centralised Spent Nuclear Fuel Storage Facility in Kyiv Oblast, drawing an Estonian FM condemnation. Third, the geography of escalation widened: Zelensky disclosed that Ukrainian intelligence had identified five specific Russian scenarios for expanding the war via a Belarus–Bryansk axis toward Chernihiv and Kyiv or directly against a NATO state, while Russia's SVR threatened Latvian 'decision-making centers' and Medvedev told EU citizens their 'peaceful sleep is over.' ISW assesses Moscow is manufacturing informational pretexts — exploiting Russian-jammed Ukrainian drones diverted into NATO airspace — to pressure the Baltics below the Article 5 threshold. Romania has invoked Article 4 criteria; allies (Italy, France, Britain, Spain, the US) are surging air defenses to a flank whose organic coverage remains thin.
Theatre
Events
- 1 7 Jun 2026 Estonian FM condemns Russian strike on a spent-nuclear-fuel storage facility in Kyiv OblastTallinn, Estonia
On the night of June 6–7, 2026, a Russian strike hit the Centralised Spent Nuclear Fuel Storage Facility in Kyiv Oblast. Estonian Foreign Minister Margus Tsahkna condemned it as a 'conscious risk to nuclear safety' that brings Europe closer to catastrophe, declaring no state can 'play roulette with global nuclear security' and demanding strong consequences. President Zelenskyy and Foreign Minister Sybiha also called for a global response. The strike folds a transboundary radiological hazard into the spillover threat — a Chernobyl-country reminder that a single hit can make the war everyone's emergency.
Transboundary hazardA spent-fuel store, unlike a reactor, holds decades of accumulated fission product with no containment dome — a breach would loft contamination across the EU border on prevailing winds, which is precisely why an Estonian FM, not a Ukrainian one, leads the condemnation.Internationalizing the strikeTallinn framing a Kyiv-Oblast strike as 'global nuclear security' converts a Ukrainian air-defense failure into a NATO-flank concern, the rhetorical move that turns spillover from a Ukrainian problem into an alliance one.Escalation ladderHitting nuclear-waste infrastructure days after the Russia–Belarus nuclear drills stacks two nuclear signals in one fortnight, the kind of normalization-by-repetition ISW flags as conditioning European publics to a higher baseline of risk. - 2 6 Jun 2026 Ukraine reports a rise in Russian drone attacks routed through Belarusian airspaceBelarus
On June 5, Ukraine's State Border Guard Service reported that Russia has increased drone attacks launched via Belarusian territory, with most Shaheds entering Belarusian airspace before crossing into Ukraine through Kyiv and Zhytomyr oblasts. Spokesperson Andrii Demchenko said Belarus has not condemned the practice and that the Kremlin is actively pressuring Minsk to enter the war with its own forces. Ukraine continues to reinforce its northern defenses, though no significant Russian troop buildup near the border has been observed. The routing turns Belarus from passive host into an active conduit that extends Russia's reach toward Poland's supply corridors.
Belarus as conduit, not just hostRouting Shaheds in via Zhytomyr and Kyiv oblasts lets Russia approach the Polish–Ukrainian supply line from an axis Russian territory can't reach — the exact geometry ISW says makes Belarusian airspace strategically valuable independent of any ground invasion.Co-belligerent without firingBelarus declining to condemn drones transiting its airspace makes Minsk a legal co-belligerent in fact while preserving Lukashenko's deniability — the 'industrial integration' threshold below an overt declaration of war.No buildup, by designUkraine seeing routing increase but no troop massing matches the assessment that Russia wants Belarus as a launch platform, not an invasion springboard — cheaper, harder to deter, and it still pins Ukrainian forces to the northern border. - 3 Jun 2026 Ukraine to send counter-drone experts to the Baltic states and RomaniaBaltic states & Romania
President Zelensky announced on June 3 that Ukraine will dispatch counter-drone expert teams to Latvia, Lithuania, Estonia and Romania to share experience and interceptor technologies, expanding an international drone-expertise program that earlier sent teams to Qatar, the UAE and Saudi Arabia in March 2026. The move followed Ukraine's Drone Deal with Lithuania and a proposed air-defense pact with Latvia at the Bucharest Nine summit. It inverts the usual flow of military assistance — the war's frontline state now exports the defensive know-how its NATO neighbors lack against the same Russian drones crossing their borders.
Reverse capability transferKyiv exporting interceptor expertise to four NATO members reverses the aid relationship — three years of intercepting Shaheds has made Ukraine, not its protectors, the holder of the operational counter-drone knowledge the eastern flank suddenly needs.Filling the air-policing gapBaltic Air Policing fields fast jets ill-suited to cheap drones; Ukraine's teams bring layered EW and low-cost interceptor tech, the specific mismatch the Estonia and Latvia scrambles exposed when €1M missiles chased $50k Shaheds.Integration as deterrenceEmbedding Ukrainian specialists in Latvia, Lithuania, Estonia and Romania quietly knits Ukraine into NATO-flank defense ahead of accession — a functional integration that raises the cost to Russia of treating those borders as a free-fire test range. - 3 31 May 2026 Italy deploys troops and jets to Romania after the Galați drone strikeGalați / Constanța, Romania
Following the May 29 Geran-2 strike on Galați, Italy expedited a deployment of about 100 personnel and fighter jets to Mihail Kogălniceanu Air Base, arriving June 15 for a one-month specialized anti-drone training mission to detect, track and destroy hostile unmanned systems — separate from routine NATO Air Policing. Romania closed the Russian consulate in Constanța and expelled the consul general. NATO Secretary General Mark Rutte called Russia's behavior a danger to the alliance, and Kyiv and Bucharest agreed to accelerate joint drone manufacturing. The Italian deployment is the alliance converting condemnation into forward presence on the flank Russia just bloodied.
Dedicated anti-drone, not air policingItaly fielding a standalone counter-UAS mission distinct from Air Policing concedes that fast-jet QRA cannot stop Shaheds — the Galați F-16s declined to fire over a city — and that the flank needs a purpose-built layer it does not yet own.Diplomatic expulsion ladderBucharest closing the Constanța consulate and expelling the consul general escalates one rung short of expelling the ambassador, the graduated diplomatic punishment Romania's president had explicitly threatened if incursions continued.Industrial answer to a recurring threatAccelerating joint Romania–Ukraine drone manufacturing treats the incursions as a standing condition, not an incident — buying production capacity to match a threat that a one-month Italian rotation can only bridge, not solve. - 4 29 May 2026 pivotal A Russian Geran-2 drone strikes an apartment block in Galați, Romania — first casualties on NATO soilGalați, Romania
On May 29, 2026, a Russian Geran-2 drone carrying at least 30kg of explosives struck a 10-story apartment building in Galați, Romania, near the Ukrainian border, injuring a 14-year-old boy and his mother — the first time a Russian drone has caused casualties on NATO territory since the war began. The drone was part of a 43-UAV swarm targeting the Ukrainian Danube port of Reni, ~20km away; Romanian F-16s scrambled but declined to fire over the populated area. President Nicușor Dan's forensic report confirmed a Russian Geran-2 by Cyrillic inscriptions and matching components. FM Oana Țoiu said the incident meets the criteria to invoke NATO Article 4, citing over 40 drone incursions; Poland's Tusk urged NATO to act after Medvedev told EU citizens their 'peaceful sleep is over.'
Article 4 threshold crossedȚoiu declaring the strike meets Article 4 criteria triggers the consultation mechanism — short of the Article 5 'armed attack' line — exactly the calibrated response Russia's plausible-deniability drones are built to keep capped at consultation, not collective defense.The intercept dilemma, made concreteRomanian pilots declining to fire over Galați because a missile could cause ground casualties is the counter-drone gap in one decision: NATO's fast jets cannot safely engage cheap drones over cities, so a $50k Shahed reaches an apartment block unopposed.Provocation calculusZelenskyy and analyst Paul Goble read the strike as a deliberate Kremlin test of NATO cohesion and intimidation of Moldova; Medvedev's 'peaceful sleep is over' confirms the messaging — Russia is pricing how little a casualty-causing breach actually costs. - 5 20 May 2026 pivotal Russia's SVR threatens Latvian 'decision-making centers' as ISW warns of a manufactured pretextBaltic states
On day 1547 of the war, Russia's Foreign Intelligence Service (SVR) threatened Latvian 'decision-making centers' over alleged Ukrainian drone launches from Latvian soil — a charge Riga denies. The Institute for the Study of War assessed that Moscow is manufacturing a pretext for aggression against the Baltic states, exploiting Russian-jammed Ukrainian drones diverted into NATO airspace to shift the political cost of Ukraine's long-range campaign onto the eastern flank and split allies. Analysts framed the incidents as Russia redirecting blame to create friction among NATO members and undermine public confidence. The episode shows the spillover is being weaponized as information warfare, not just felt as stray ordnance.
Pretext engineeringThe SVR alleging Ukrainian launches from Latvia — when ISW attributes the drones to Russian EW diverting them — is the textbook 'information condition,' fabricating a casus belli Moscow could later cite to act against a Baltic state under cover of self-defense.Below the Article 5 lineThreatening 'decision-making centers' rather than launching an overt strike keeps the pressure hybrid and sub-threshold, exploiting the gap between Article 4 consultation and Article 5 defense that Russia has mapped through every prior incursion.Splitting the allianceShifting the blame for diverted drones onto Latvia aims to fracture NATO consensus — if some allies half-believe the Baltics 'invited' the incursions, the unanimity an Article 5 invocation requires erodes, which is the real target. - 20 May 2026 pivotal Zelensky discloses five Russian scenarios to expand the war via a Belarus–Bryansk axisBelarus–Bryansk axis
On May 20, President Zelensky stated that Ukrainian intelligence had identified five specific Russian scenarios for expanding the war through northern Ukraine — attacks from an axis between Belarus and Russia's Bryansk region targeting the Chernihiv–Kyiv direction, or directly against a NATO member state. He ordered defensive reinforcements, instructed the Foreign Ministry to intensify pressure on Belarus, and said Russia may be preparing to mobilize up to 100,000 additional troops, while assessing the Kremlin currently lacks the capacity for covert mobilization. He reiterated the warning in his May 21 evening address. The disclosure names the war's potential expansion vectors explicitly, converting analysts' fears into a stated Ukrainian planning premise.
Five vectors, namedPinning the threat to a Belarus–Bryansk axis aimed at Chernihiv–Kyiv 'or directly against a NATO member' is the spillover risk stated as a discrete planning set, not a vague fear — Ukraine says it is preparing a military and diplomatic response for each scenario.Mobilization ceilingZelensky's own caveat — Russia eyes ~100,000 troops but lacks covert-mobilization capacity — bounds the threat: the near-term danger is a drone/missile front from Belarus, not a 2022-style armored thrust the northern fortifications are built to blunt.Diplomatic deterrence of MinskTasking the Foreign Ministry to pressure Belarus, paired with the 500-target warning, aims to raise Lukashenko's price for participation above whatever Moscow offers — deterring the host before the launch platform becomes a launch decision. - 19 May 2026 A Romanian F-16 shoots down a stray Ukrainian drone over EstoniaLake Võrtsjärv, Estonia
On May 19, 2026, a Romanian F-16 on NATO Baltic Air Policing duty shot down a suspected Ukrainian strike drone over Lake Võrtsjärv in southern Estonia — the first time a drone has been downed in Estonian airspace. Estonian Defense Minister Hanno Pevkur confirmed the drone was likely Ukrainian and heading toward targets in Russia; Ukraine's Foreign Ministry apologized for the unintended incursion, blaming Russian electronic warfare for deliberately redirecting its drones toward the Baltics. The shootdown followed similar violations across Latvia, Lithuania and Finland. It captures the cruelest mechanism of the spillover: Russia's jamming turns Ukraine's own weapons into incursions on the territory of Ukraine's allies.
EW as a spillover weaponRussian jamming diverting a Ukrainian drone over Estonia weaponizes Kyiv's deep-strike campaign against Kyiv's own allies — a near-free way for Moscow to manufacture NATO-airspace incidents using Ukrainian airframes it never has to launch.Air-policing actually firedA Romanian QRA F-16 downing a drone over Estonia is the first kinetic engagement of the Baltic mission here — proof the alliance will fire over sparse terrain (a lake), even as Galați showed it won't over a city, defining where the intercept line actually falls.Friendly-fire diplomacyKyiv publicly apologizing while NATO shoots down its drone hands Russia exactly the allied friction it engineered, forcing Poland and Estonia to demand kill-switches from a partner whose drones they are now intercepting. - 18 May 2026 pivotal Russia and Belarus begin joint nuclear-weapons drills near EU and Ukraine bordersBelarus
On May 18, 2026, Belarus and Russia began joint exercises practicing the combat use of nuclear weapons, including the delivery and preparation of warheads from non-standard deployment areas — the first such drill since the nuclear-capable Oreshnik IRBM was deployed to Belarus in December 2025. On May 21, Putin and Lukashenko oversaw live launches by video: a Sineva SLBM from a submarine, a Yars ICBM from Plesetsk, a Belarusian-crewed Iskander-M ballistic launch at Kapustin Yar, Tu-95MS and MiG-31 hypersonic launches, and the delivery of nuclear munitions to field storage in Belarus. Kremlin spokesman Peskov called the drills 'a signal to NATO and Europe.' Ukraine condemned them as a Non-Proliferation Treaty violation; ISW read them as leveraging Belarus and masking battlefield weakness.
Belarusian crews go nuclearA Belarusian crew firing an Iskander-M and Russia delivering munitions to Belarusian field storage operationalizes the December Oreshnik deployment — Minsk is no longer just hosting warheads but training to handle them, deepening Russia's de facto control ISW flags.Signal explicitly aimed at NATOPeskov naming 'NATO and Europe' as the audience makes the drill a coercive instrument, not a readiness exercise — timed days after Ukraine's largest drone strike on Moscow, it answers Russian weakness in Ukraine with a nuclear gesture at the alliance.Proliferation precedentPracticing warhead delivery from 'non-standard deployment areas' near EU/Ukraine borders is the NPT-violation Ukraine cites — normalizing forward, mobile non-strategic nukes in Belarus that shrink Baltic and Polish warning time to minutes. - 15 May 2026 Zelensky warns Russia is pressuring Belarus to join offensive operations against Ukraine or NATOMinsk, Belarus
On May 15, President Zelensky said Ukrainian intelligence had documented new Russian efforts to persuade Lukashenko to join offensive operations — potentially against the Chernihiv–Kyiv direction or directly against a NATO member state — and ordered the northern border strengthened with a response plan. Major Robert 'Madyar' Brovdi, commander of Ukraine's Unmanned Systems Forces, accused Lukashenko of providing direct tactical aid by opening Belarusian airspace to regular Shahed routes, with Air Force data confirming Russian drones fly within 5–10km of the Belarusian and Moldovan borders to evade air defenses, and antennas installed on residential buildings in southern Belarus to guide them. ISW assessed a Belarusian ground invasion is very unlikely but that Russia may push Minsk to permit drone launches from its soil.
Border-hugging flight pathsRussian drones flying 5–10km off the Belarusian and Moldovan borders to slip air defenses is the operational reason the spillover keeps clipping NATO airspace — the evasion geometry that put incursions over Latvia, Estonia and Moldova in the same weeks.Guidance infrastructure on Belarusian soilAntennas mounted on southern-Belarus residential buildings to steer Shaheds is physical proof of integration below an invasion — Minsk hosting the navigation backbone of strikes on northern Ukraine without sending a single soldier.Ground threat downgraded, air threat liveISW judging a ground invasion 'very unlikely' while warning of drone launches from Belarus reframes the northern danger: not tanks toward Kyiv, but a new launch axis that forces Ukraine to fortify the border and divert forces regardless. - 13 May 2026 Poland scrambles jets and activates air defenses during a Russian drone attack on UkrainePoland
On May 13, Poland scrambled fighter jets and helicopters, activated ground-based air defenses and radar reconnaissance, and placed forces on heightened alert as a preventive measure during a large-scale Russian drone attack on Ukraine involving 139 UAVs. The barrage caused casualties and damage across multiple Ukrainian regions — two killed and four injured in Rivne, eight killed and 11 injured in Dnipropetrovsk, and over 6,500 residents left without power in Poltava after a drone struck an electrical substation. Poland repeated the scramble on May 23–24 during another massive barrage. The recurring alerts show NATO's largest eastern-flank army now treats every major Russian strike on western Ukraine as a domestic air-defense event.
Routine pre-emptive scramblesPoland launching jets 'as a preventive measure' for a 139-drone raid on Ukraine — and repeating it ten days later — shows the spillover risk has become routine enough that NATO's frontline state mobilizes air defense on every western-Ukraine barrage, absorbing the cost of Russia's tempo.Proximity, not targetingThe drones struck Rivne and Poltava, not Poland, yet Warsaw scrambles because western-Ukraine strikes near the border give minutes of warning — the geography that makes Polish airspace one EW glitch away from an incursion like Latvia's and Estonia's.Substation strikes near the borderA drone knocking out a Poltava substation for 6,500 residents underlines that the same infrastructure war battering Ukraine is creeping toward NATO's edge, where one stray Shahed on a Polish grid node would convert a scramble into an Article 4 case. - 13 May 2026 A Russian Shahed drone enters Moldova's airspace, forcing an airspace closureNorthern Moldova
On May 13, a Shahed-type drone used by Russia to attack Ukraine violated Moldova's airspace near Mohyliv-Podilskyi at 16:00, tracking over the Bălți, Ungheni and Hîncești districts before continuing south. Moldova's Defence Ministry confirmed the incursion and temporarily closed airspace over northern Moldova. The breach added to a pattern of Russian drone spillovers into neighboring states, including a similar incursion on May 8. Unlike NATO members, Moldova — a neutral EU candidate without Article 5 cover — has no alliance air shield, making each incursion a raw exposure of how the war's edge reaches even the non-aligned.
The undefended neighborA Shahed crossing Moldova underscores the one spillover victim with no Article 5 umbrella and no NATO Air Policing — Chișinău can only close airspace and protest, the vulnerability analysts say Russia exploits to intimidate a state it also targets via Transnistria.Daytime, deep penetrationA drone tracked at 16:00 across three central districts — not a brief border clip — shows incursions reaching well inside Moldova in daylight, a depth that signals either guidance failure or deliberate reach toward the Danube corridor.Transnistria leverageIncursions over Moldova compound Putin's parallel Transnistria passport decree, the dual pressure Zelensky and analysts read as Moscow keeping a second post-Soviet state destabilized while the main war pins Ukraine. - 7 May 2026 Two drones crash in Latvia from Russia; Kyiv offers Baltic airspace-security teamsLatgale, Latvia
On May 7, two drones entered Latvian airspace from Russia and crashed in the eastern Latgale region — one struck an empty oil-storage tank at the Rēzekne branch of East-West Transit, causing a brief cladding fire. Latvia's armed forces issued airspace alerts for Ludza, Balvi and Rēzekne, NATO air-policing fighters scrambled from Šiauliai, Lithuania, schools switched to remote learning, and Riga summoned the Russian chargé d'affaires and lodged a formal protest. Ukrainian FM Andrii Sybiha denied directing drones at Latvia, attributed the breaches to Russian electronic warfare redirecting Ukrainian drones, and offered expert teams to strengthen Baltic and Finnish airspace security. Estonia, citing repeated breaches since January, demanded Ukraine better control its long-range drones and floated kill-switches.
Civilian disruption from one droneSchool closures across Rēzekne and Ludza and a fire at an oil terminal from a single stray drone show the asymmetric disruption cost — a cheap airframe forces a NATO member into civil-defense mode, the leverage that makes the incursions worth Russia's EW effort.Šiauliai QRA activatedBaltic Air Policing fighters scrambling from Šiauliai for two crashed drones is the alliance's tripwire firing over Latvia — visible reassurance, but also evidence the mission is built for jets, not for the slow cheap drones now setting it off weekly.Ally friction over kill-switchesEstonia demanding Ukraine control its drones and propose kill-switches turns a Russian EW operation into a Kyiv–Tallinn dispute — the precise allied friction ISW says Moscow manufactures, achieved here for the price of jamming. - 2 May 2026 A Russian drone violates Romanian airspace near the Danube, scrambling F-16sTulcea County, Romania
On the night of May 1–2, a Russian drone briefly violated Romanian airspace in the Kiliia area during a coordinated strike on Ukrainian civilian and infrastructure targets near the Danube border. Romania scrambled two F-16s from the 86th Airbase at Fetești and issued RO-Alert warnings to residents of northern Tulcea County. The incursion — part of a larger campaign of 163 drones — was the second such spillover in recent weeks, following an April incident where drone debris damaged a farm building near Galați. Romania condemned the violation and coordinated with NATO. It is the opening data point of the May–June escalation: a non-lethal breach that the Galați apartment strike would, weeks later, turn deadly.
The pattern's first beatA brief Kiliia-area breach with F-16s scrambled and RO-Alert issued establishes the rhythm — incursion, scramble, no engagement, condemnation — that Russia then tested up the ladder until the May 29 Galați strike drew blood at the same Danube border.Danube-port collateral geometryDrones hitting Ukrainian Danube targets meters from Romania means spillover is baked into the targeting — Reni and Izmail sit so close to Tulcea County that strikes on Ukrainian ports inevitably risk Romanian soil, not by accident but by proximity.Debris already landingAn April drone-debris hit on a farm near Galați before this incursion shows the physical encroachment predates the headlines — Romania was absorbing fragments on its territory weeks before a populated building was struck.
Background
NATO's Article 4 lets any member call alliance-wide consultations when its security is threatened; Article 5's collective-defense pledge applies only to an 'armed attack.' Russia's drone incursions are engineered to sit in the gap between them — provocations under plausible deniability that probe NATO unity without clearly crossing the Article 5 line. After Russian drones breached Polish airspace in September 2025, Poland invoked Article 4 and NATO launched Operation Eastern Sentry to bolster air, sea and land defenses on the eastern flank, layered atop the Baltic Air Policing mission (allied fighters on QRA from Šiauliai, Lithuania, and Ämari, Estonia) and the January 2025 Baltic Sentry. The Galați casualties of May 2026 push that calibrated ambiguity toward its limit.
Spillover into NATO airspace predates the casualties. Russian drones and debris have crossed into Romania near the Danube border repeatedly since 2022 — Bucharest has logged dozens of incidents — and a wave of Russian drones penetrated Polish airspace in September 2025, the breach that triggered Poland's Article 4 call. Romania routinely scrambles F-16s from the 86th Airbase at Fetești and issues RO-Alert warnings to Danube-Delta residents. The pattern established a Russian tolerance-testing rhythm: each incursion measures whether NATO will treat a single drone as an 'armed attack,' and so far the answer — short of Article 5 — has emboldened the next.
Belarus has been Russia's launch platform since the 2022 invasion staged from its soil toward Kyiv and Chernihiv. By 2024 Putin and Lukashenko had built infrastructure to forward-deploy Russian non-strategic nuclear weapons there, and on December 30, 2025, Russia announced the nuclear-capable Oreshnik IRBM was deployed to Belarus — satellite analysts placed it near the former Krichev-6 aerodrome, ~5km from the Russian border. Belarus borders Ukraine plus NATO members Poland, Lithuania and Latvia, letting Russia route Shahed drones through Belarusian airspace to flank Ukraine's defenses and reach Polish–Ukrainian supply lines otherwise out of range from Russian territory.
The Baltics' acute vulnerability is the Suwałki Gap — a ~65km Poland–Lithuania border strip, the only land corridor separating Belarus from the Russian exclave Kaliningrad. Seizing it would physically join Kaliningrad to Belarus and sever the overland route reinforcing Estonia, Latvia and Lithuania, isolating six million people behind a hostile blockade; even unseized, short-range rockets from either side can interdict it. ISW assesses Russia is 'setting informational conditions' for escalation against the Baltics — manufacturing pretexts (alleged Ukrainian drone launches from Latvian soil, claims of protecting 'compatriots') to act below the Article 5 threshold, the hybrid logic that slow-escalates isolated incidents to avoid triggering collective defense.