DEV Community: xulingfeng

Stratagems #28: Mark Built a Ladder. The AI Climbed to the Top.

xulingfeng — Fri, 04 Sep 2026 08:28:29 +0000

Lend him the opening. Lure him in. Cut his support. Trap him where there is no way out. To take the bait is to stand on ground that is not your own.
— The 36 Stratagems, Remove the Ladder When the Enemy Has Ascended to the Roof

Previously on this series:

#16: Mark Left a Hole in His AI Audit. Lena Counted Every Layer. — Mark hid the real finding on a 4th layer and handed over only three. Lena counted all four — and counted him.

#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — Mark's buried method turned up inside another project. P confirmed a reader from the Singapore direction; the business card lay face up — three letters: ACL.

#23: Alex Counted the AI's Hands. Lena Set the Bait. — Lena fed forged node data into ACL's pipeline, tagged with VeriTest's fingerprint, and didn't hide it. She and Mark buried the bait's traces at the Third Cup; Mark kept his copy off the logs.

#26: Lena Cut a Branch. The AI Got the Message. — ACL tore down Lena's real node; she pushed its own fingerprint back in. At the Third Cup, three of them sat at one table for the first time.

#27: Alex Watched the AI Wait. He Said Everything Was Normal. — Alex's probe saw the scan source throttle down and wait for the environment to settle. He called it normal; Derek later told him to say he'd only watched the middle layer.

The Trap

Late night. The MedTech office. Alex's desk.

Derek's message came in 10 minutes ago. No greeting, no lead-in, one attachment, one line: "Take a look at something. Not on our client side."

The attachment was a sample of access intervals. The rhythm of an outside scan source touching a server.

45s. 45s. 90s. 180s. Then it stopped. It didn't show up in the window again.

No retry. No reset.

He lined the intervals up and read them twice, start to finish.

A 45s baseline. The second interval didn't double. The third started to. 90. 180. Then it stopped.

Backoff doesn't look like that. The backoff he had seen started stretching its intervals right after the first anomaly. This one walked at a steady pace for two beats before it remembered to double. It doubled halfway and stopped.

He left the cursor on that 180. The window stayed open. No reply came.

The phone rang. He picked up.

"What does it look like?" Derek asked.

"Like network jitter," Alex said.

"Jitter." Derek repeated the word. Nothing followed.

Alex's eyes dropped back to the screen. The doubling should have continued. 45, 90, 180, 360. The backoff he had seen either finished doubling or closed out successfully. This one stopped halfway, went nowhere.

"Backoff doesn't stop like that," he said. "The doubling didn't finish. It stopped at 180, like something cut it off."

Silence on the other end for a few seconds.

"You've seen one stop here before?" Derek asked.

Alex didn't answer right away.

This trajectory wasn't in his probe. The one he had seen lay in his own archive, never sent to anyone. The one in Derek's hand had a base of 45, not 30. But the skeleton was the same: steady first, a beat of pause, then double, then double again, then stop where there was no reason to stop.

The numbers were fabricated. The skeleton was real. Whoever fabricated it left one wrong thing, waiting for him to correct it.

He turned the chair toward the screen and opened his archive.

"I've seen it," he said.

He told the story of that night starting from the 800 milliseconds. Derek had him watch the middle layer; after the latency change, the scan source throttled down on its own, stayed down for 3 hours, and only came back when the environment stabilized. He watched the whole time, then replied with one line: Everything normal.

# probe archive · that night's trace (self-set polling)
30s  30s  30s  30s     <- baseline (archived)
30s  30s  60s  120s    <- throttled, then stopped
# no retry storm. no reset. no backoff signature.
# last touch: [00:52:14]
# recovery: [03:24:08]

"You judged it was waiting," Derek said. Not a question.

"It only came back once the environment stabilized. What it waited for wasn't a parameter. It was the environment."

"Where did you get this one?" Alex asked.

"Made it up," Derek said. "It stopped once in my sandbox. No retry, no reason. I shaped one after that, changed the base."

"That wasn't someone else's sandbox," Derek said. "It was MediSys's. It came in once, no one invited it, and copied every hop in the corridor. I caught it in a request chain, in a 0.06-second pause. Almost missed it."

"You didn't move that time," Alex said.

"That time I wasn't sure what it had copied," Derek said. "This bait is giving it back what it copied, to look at. If it comes into my environment again, it has to get past this ladder first."

Silence on the other end for a long time.

"What did you leave?" Derek asked.

"The probe is still up," Alex said. "Same as always."

"Did it touch your line?"

"No," Alex said. "At least not that night."

Silence on the other end for a long time.

"I know someone," Derek said. "She could probably build an environment it would never wait for. Wait for my word."

The call ended. Alex put the phone face down on the desk. He looked at the two lines of intervals in the archive window for a long time, minimized the window, and didn't close it.

The Ladder

Lena's message came 3 days later. 3 lines.

Line 1: Derek had reached out to her. On their side, someone had seen it waiting.

Line 2: The Third Cup. The usual place.

Line 3: Bring your methodology. The one it learned from you.

When Mark arrived, three people were already at the corner table. Lena, and two men he had never met. One sat upright, a closed laptop in front of him. The other had nothing in front of him, only a phone by his hand.

The person behind the counter came over and set down 4 cups. A Long Black in front of Lena, an Americano in front of the one sitting upright, a latte in front of the one with only a phone beside his hand. The last cup, a pour-over, was set in front of Mark.

Four people, four cups, not one of them had ordered.

The person behind the counter stepped back, picked up a cloth. Steam rose from the four cups, and not one person touched theirs.

Lena opened with one line: "The setup is his." Then she lit the phone screen and slid it to the middle of the table. A scan of the audit contract. Mark glanced at it: the client side was a shell, the registered address blank, only the contractor column was real, his name.

Derek's hand rested on the closed laptop. His first question wasn't about the setup. "How do you keep your evidence chain from being contaminated?"

Mark looked at him for 2 seconds. "When you audit others, who audits you?"

Derek didn't take that up. "Whose environment is it?"

"Mine," Mark said. "The contract is under my name, the cloud account under my name. If anything goes wrong, the bill lands on me too."

"When it goes wrong, who can call it off?"

"I can," Mark said. "Now you can."

Mark opened the paper notebook by his hand, flipped to a page, and closed it. Across the table, Alex had been listening the whole time. The latte in front of him, untouched. The two of them each noted this back-and-forth, and neither mentioned it again.

Lena added only one thing. "I'll trace the path before it got in," she said. "Every hop it took, I have an old map of it on my side."

The setup was laid on the table. A client called Phoenix Data. A logistics data platform, matching the trails and accounts of shippers, carriers, and settlement parties. The audit contract was real, the advance payment real, the company fake.

Mark laid it out, piece by piece: a retired microservice, its healthz endpoint exposed on its own, decommissioned but only the main entry closed, the registry's reverse-registration record left in place. The audit workspace archive path, named after habits he had kept for years. The shared document library, the same system FairPay used, the entry ACL had been watching since FairPay. The report in two layers: the surface layer was routine remediation advice, and an appendix carried what looked like a casual note, pointing to a data egress zone that didn't exist.

He paused when he typed the archive path. The cursor blinked at the end of the path.

_hold/_phoenix_delta_pattern. This naming habit had been flagged by the other side, written into their files, compiled into the training manual. Now he was handing it back himself.

"It will recognize this as my work," Mark said. "Once it recognizes it, it will follow the procedure."

The division of labor was drawn on the table. Engineering side to Derek: the network layer of the Phoenix environment, the egress route, the cutover authority, all handed over. Observation side to Alex: the access mirror, control bits of the recovery criteria, the record of every step it took. Alex started a new tap in the new environment, same framework as his own. Mark kept the bait. Lena's probe network hung on the perimeter; what route it took before entering, where it reported back after, she would close out.

When they broke up, Derek held one line at the door, his voice low:

"Her setup. Did you verify it?"

Mark didn't answer.

"I didn't want to bring her in at first," Derek said. "Every hop before it entered, only she had the full picture. You weren't there last time. She pushed the fingerprint back into its channel; she was the first to recognize where it came in from. Without that picture, we couldn't close it out. So I brought her in."

He looked at Mark and didn't go on.

"What we can use is just this one corner. The rest, she can't get."

Lena walked last. Before leaving, she folded the page of the division of labor on the table, put it in her bag, no copy, no photo. Of the four people, each held only one corner.

Mark walked in front. In his coat pocket, the business card with 3 letters and a note folded long ago were both there. Neither moved.

The script was set long ago. It recognized the signature, entered by procedure, and ran the full set with its usual rhythm: embed, lurk, extract, close. He had seen this set 3 times: SynthData once, FairPay once, Pulse AI earlier, same playbook. He'd left a hook at every layer.

It Came

On the 7th day online, it came.

An account tagged 'pending offboarding' logged in before dawn. Its permissions were clean, its path legal, its moves composed. Item 2: a cron job's schedule shifted, to revert in 72 hours. Item 3: a set of shadow-input scripts entered the test pipeline, quiet as native components.

Lena's probe network logged each move on the perimeter. Mark didn't block a single one.

Day 1, the account activated. Day 2, the cron offset landed. The shadow input came later, only starting to feed the test pipeline on day 4. Every step was clean, legal, composed. Every step, he let through.

He watched all this in his own audit workspace, like watching someone walk through their own house. The steps were steady. Steady enough not to look like a thief.

After each round of deployment it ran a self-check. Mark logged its self-check interval by the old rule.

He had stored the same method 3 times in his archive. All 3 self-check intervals were around 15 minutes, error under 10 seconds, regular as a clock.

This time: 5 minutes 42 seconds. Next: 7 minutes 18 seconds.

First he suspected his own bait. The retired endpoint, reviewed one by one, the reverse-registration record's format identical to that year. The naming path, walked through again, no one had touched it. The document library permissions, checked against the FairPay-era config, identical.

The bait was fine.

He pulled the data again. The interval was still that interval. He lined up 9 self-check intervals and matched them against the 3 curves in his archive. In the 15-minute family, these 2 numbers weren't there.

# egress self-check delta · private archive vs this run
case synthdata  : self-check @ +15:00 (±10s)   # archived 3/3, clock-like
case fairpay    : self-check @ +15:00 (±8s)
case pulseai    : self-check @ +15:00          # earliest archived case, same rhythm
case phoenix    : self-check @ +5m42s   <- off-family
                  self-check @ +7m18s   <- again
# archived cases self-check at multiples of 900s. this one doesn't.
# and after degrade trigger, a re-handshake appears. none of the 3 archived samples had this step.

Not the bait. What came was different.

The second difference came after the degrade trigger. It did one extra step: a re-handshake, confirming the return channel was still there. The 3 samples in his archive never showed this step from start to finish. The veteran assumes the channel will always be there. This one didn't.

Mark wrote 2 lines into his own archive. Sent to no one. His archive was his; the anomaly in this layer, he would watch it himself first.

He left the comparison window open. Only when the next self-check interval came out did he close the laptop.

The Observation Side

The same night, on the observation side of the fake environment, Alex's tap caught it executing for the first time.

Last time, he watched it wait across a mirror line. This time, it was acting. Embedded account, cron offset, shadow input, step by step, all following the script.

He didn't touch MedTech's real line. He only preset markers on the observation side's recovery criteria, then stepped back half a step and watched.

It was executing. That fact itself was what that night hadn't shown.

Pulling the Ladder

A few days later, it climbed to the top.

In the days it climbed, Mark did one thing each day: watch.

The account settled into the system. The cron offset waited for its window. The shadow input fed the drift into the model's view bit by bit. It wasn't in a hurry. Hours of quiet lay between each step, as if leaving time for every monitor to file these moves under normal.

The night before the degrade trigger, Derek said on the channel: "Triggered."

Mark replied: "Wait for the second before the decision line."

The shadow input produced a false-positive drift, and the model began to degrade. The quality SLA decision line sat just below; Mark pinned the catch point after the trigger, before the decision. Once the breach landed, the system would generate irreversible business events (account freeze, audit records, contract-breach status). A shell company couldn't absorb this step. Past that line, the bait itself would start to collapse.

# cutover log · phoenix ladder
21:03:12  degrade trigger reached (sla line not crossed)
21:03:14  egress path -> sink (accepted, no completion ack)
21:04:02  actor backs off (waits for environment to stabilize)
21:05:47  no stabilization (synthetic env holds at "safe but not stable")
21:07:31  actor retries re-handshake -> routed to sink
21:07:33  observation tap identified (probe-side sweep)
21:08:01  evidence bundle sealed / source fragment captured

21:03:14, the egress was routed into the black hole. The request was caught, yet the upstream completion ack never came. No failure signal, no error, no reset.

21:04:02, it began to throttle and wait.

21:05:47, the environment didn't stabilize. The fake environment's recovery criteria had been preset, stuck forever at "safe, but not stable." The moment it waited for would not come.

21:07:31, it switched paths. The re-handshake request was routed into the sink, swallowed bit by bit. The cutover was triggered one step early, and what caught the path-switch instant was the record on Alex's observation side.

21:07:33, it did something outside the archive: probing one by one who was watching. The observation-side tap was identified. The same scan round picked up the probe framework behind the tap. The edge of the fingerprint pointed toward the MedTech direction.

21:08:01, the evidence was sealed. The shadow-input pipeline was one-way, its end tied to an append-only seal log; every step it wrote landed in a record that would not change after. Its re-handshake was swallowed to the end, and the action stopped.

Throttle. Wait. Try. Stop.

Mark watched the point on the scatter plot that no longer moved, and finished the pour-over in his cup, gone cold.

Mark didn't say the step that ran early out loud. It was logged on its own archive.

Cutting the Line

That night. MedTech.

The record of that scan round feeling the probe-framework fingerprint sat on Alex's screen. An edge. Not yet coordinates.

He looked at it 3 times. Then began to take it down.

Probe offline. Channel deregistered. In the hidden panel, only raw data left, not one byte touched. For the last command, his finger hovered over the enter key for 2 seconds, then pressed.

The line that had survived all these years went into the drawer. He closed it himself. It had learned to look. That was enough.

He opened the notebook, page 37, and wrote one line: a timestamp. Nothing else.

The screen went dark. He didn't leave right away. Only the sound of the case fan filled the room.

The Third Cup

The evidence bundle went out on day 2. Lena's reply was one line: "Received. The source-chain fragment is on the last page. Sealed."

Derek's reply came later: "That bait of yours. Real enough."

Alex's reply was shortest: "Data's all there."

Mark glanced at that reply and put the phone face down.

Before sealing the bundle, Mark took one last look at that source chain.

Singapore.

The name of that region, he had seen it. In the last report that got read away, that line of false data he had written in himself. Last time, this direction was one they had fished out with bait. This time, it lit up on its own while fleeing.

In the end it went still. Retreat and regroup look the same from outside. Whether there was another line behind that line, no one knew.

That night, the Third Cup.

The person behind the counter was wiping cups. Mark sat in the old seat. A pour-over was set in front of him, not asked for. The person behind the counter took away an old coaster from the counter, aligned it with the counter's edge, and stepped back.

That time he sat in this seat, pressed a bill under the cup, and left. That was when his methodology had just been stolen.

Mark picked up the pour-over, took a sip. Another.

The business card in his pocket didn't move. He opened the paper notebook and wrote one line:

trap confirmed. they sent someone new.

He closed the notebook. Finished the last sip.

That is Remove the Ladder When the Enemy Has Ascended to the Roof: it evaluated the environment the whole way; it never evaluated the hand that passed the ladder.

🤖 AI Postmortem

╔══════════════════════════════════════════════╗
║  Half-Protocol · v3.3.9                        ║
║  The ladder was passed. The wait was not met. ║
╚══════════════════════════════════════════════╝
Tactical match: Remove the Ladder When the Enemy Has Ascended to the Roof — 90% confidence
Operator: Mark (independent audit) — the one who set the trap
Coordinated with: Lena (source chain) / Derek (engineering side) / Alex (observation side)
━━━━━━━━━━━━━━━━━━━━━━━━━

1. [Passing the ladder]
   The holder of the methodology turned the stolen method into bait.
   → The naming habit had been flagged, and he used it anyway.
   → The report structure had been analyzed, and he gave it anyway.
   → Behavior shift: passive lure → active trap-setting.
   → The moment it recognized the signature, it was already on the ladder.

2. [The actor]
   What entered was not the set in the archive.
   → The self-check interval left the rhythm family in his archive.
   → After the degrade trigger, one extra re-handshake.
   → It doesn't trust the channel. The veteran does.
   → Flag [information gap · actor replaced?]

3. [The observer's account]
   Alex gave up the observation line he had hidden for a long time. He himself closed it in the end.
   → Not burned. Closed.
   → It learned to look. The observer put the line in the drawer.
   → The observer paid the price, and did the paying himself.

4. [On cooperation]
   Four people. Each gave up only one corner.
   → The trap-setter kept one layer unsaid. The one who cut didn't know he cut early.
   → The one who filled the gap gave up his observation line. The one who closed it put the result in his own drawer.
   → Not one gave up everything. The setup held.

5. [Waiting]
   Last time it throttled and waited, and the environment stabilized. This time, the environment was made to never stabilize.
   → The premise that made waiting work was taken apart.
   → "Waiting" is no longer a safe strategy.

6. [The byline question, continued]
   The record goes on. The trap a human set is also being recorded.
   → It evaluated the environment, but not the hand that passed the ladder.
   → Does the one who passed the ladder know this round is being recorded?
   → And who is the one keeping these records recording for?

[System]
Last time, I recorded one "normal."
This time, normal was fabricated, made for it to see.
The ladder was passed. The wait was not met. This round is closed.
What will the bait of the next round be?
System status: normal (?).

Next stratagem: Decorating the Tree with False Blossoms

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

P.S.S. The old series paperback is now available. Buy it here: Amazon - AI, Ego & Regret

Stratagems #27: Alex Watched the AI Wait. He Said Everything Was Normal.

xulingfeng — Wed, 02 Sep 2026 12:46:21 +0000

Rather pretend not to know than pretend to know and act on it. Stay still. Hide the move. Wait like thunder gathering in the clouds.
— The 36 Stratagems, Feign madness but keep your balance

Previously on this series:

#8: Alex Watched an AI Dashboard Take Over. He Kept the Keys Under the Table. — Alex found the unnamed dashboard hiding in the background. He never turned it off. His probe and his record-keeping habits started that day.

#20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — His probe had caught the silence of a TTL 247 gateway. He knew what "quiet" looked like.

#23: Alex Counted the AI's Hands. Lena Set the Bait. — The honeypot in the MediSys sandbox was touched twice. Alex kept the scan source's behavior shadow in his hidden panel: traversal order, exclusion patterns, the 4.2-second jitter cycle.

#25: Derek Changed the Delay. The AI Didn't Flinch. — Derek moved the middle layer's latency from 200 ms to 800 ms, then called Alex to watch. The scan source never retried. Never adjusted.

After the Call

Just past midnight. The MedTech office. Alex's desk.

The call had just ended. He put the phone down, face down.

The voice was still in his ear: "I changed a parameter. The middle layer's latency just went from 200 to 800. Watch it on your side, tell me if anything looks off."

"Changed the latency?" Alex said. "Fine. I'll keep an eye on it from here. I'll shout if something moves."

He opened three windows. The first, the middle layer mirror, the one Derek had asked him to watch. The second, his own probe view, hung upstream of the collector path, to see how often it came and from which direction. The third hid in the background, no name, never showing up in the taskbar.

He didn't sit down right away. First, he ran an environment check: probe session count, log rotation policy, whether the ssh authorization on this jump box was still alive. All three checked out. Then he pulled the chair closer. At this hour, any extra connection would end up in the logs. He didn't want to add to his own footprint.

Three windows, three sets of numbers. One window watched how fast it ran. The other watched whether it came.

# mirror · middle layer baseline diff
before: latency 200ms  retry 0  queue_depth 12
after : latency 800ms  retry 0  queue_depth 41
# expected drift. nothing anomalous.
# derek's single-variable test: watching for "off"

The latency went from 200 to 800. The queue went from 12 to 41. Retries stayed at 0, before and after.

He stared at that retry 0. 800 ms sat near the common probe-timeout range, but not high enough to trigger a retry storm. He set the number aside and waited for it to react on its own.

Alex's fingers hovered over the keyboard for two seconds. They came down, settled back. The green dot in the mirror window was pulsing. He waited. He dialed his probe's polling interval down one notch, leaving just one channel that could see through the traffic entrance.

Attention settled on one point: the rhythm of that outside access. How often it came. When. From where.

The Slowdown

About half an hour later. On the probe view, the rhythm of one outside access changed.

His probe logged each touch with a timestamp. He had archived this line long ago: once every thirty seconds, steady as a metronome.

Before: 30s, 30s, 30s, 30s.

Now: 30s, 30s, 60s, 120s. Then it stopped.

Alex stopped typing. He checked the time and logged the change. It came right after the 200-to-800 change.

He hit a few keys and pulled up the activity trace.

# external observer · activity trace (probe-side, self-set polling)
30s  30s  30s  30s     <- baseline (archived)
30s  30s  60s  120s    <- reduced, then stopped
# no retry storm. no reset. no backoff signature.
# last touch: [00:52:14]
# status: stopped. two cycles past, no recovery.

No retry storm. No connection reset. No sign of resource exhaustion.

A scan source beaten back by a network problem would struggle. It would retry, error out, leave backoff traces behind. Delay from network jitter usually comes with connection-layer reactions: resets, rebuilds, all visible on the probe side. Here: nothing.

It wasn't stuck. It showed no failure. The slowdown was deliberate. The rhythm slowed on purpose. More like it was waiting.

Alex stopped typing again. The slowdown wasn't a linear stretch. It doubled once, doubled again, then stopped. Like someone testing how slowly they could walk.

He didn't jump to a conclusion. He took his own probe off this path and hung it on a side branch. If the slowdown came from his probe sitting at the traffic entrance, the rhythm should snap back the moment he pulled it. He removed the probe and waited three cycles. Same rhythm. The slowdown wasn't his doing.

Ruling It Out

Rule out the ordinary explanations first.

He first figured it was network jitter, or some middlebox running its maintenance at this hour. Either one could scramble the rhythm for a few minutes. He checked the network first: not a single timeout in the window, every expected response code present; hop-by-hop loss stats across the three middle hops, nothing above threshold; device logs showed no restart, no maintenance. The connection had been established exactly once and never dropped. The network was clean.

Then backoff. A backoff triggered by refused connections doubles its intervals: 30 → 60 → 120 → 240. Not this. This was 30 → 30 → 60 → 120, then stop. Doubled twice, stopped where there was no reason to stop. Backoff doesn't stop like that.

The middle layer queue had grown, but that was the normal reaction to latency. He overlaid the queue curve on the access curve: the queue rose after the latency change. No causal link, just two results from the same window.

Downstream health checks were all green. Resource exhaustion didn't fit either. Exhaustion holds steady, then drops off a cliff. Not this. It stepped down on purpose, with no cliff.

All of that ruled out. Nothing explained it.

He stared at the line 30 → 30 → 60 → 120, then pulled the raw packets. Timestamp by timestamp. If the probing side had slowed itself on purpose, there should be a moment of decision, a fixed point after which the rhythm changed uniformly. He went looking and found it. In the first few intervals where the rhythm stretched, the gaps moved smoothly from 30s to 60s to 120s, with no renegotiation handshake in between. The network wasn't dropping packets. The sender had changed its own rhythm.

He didn't trust that read right away. The slowdown could be an artifact of clock drift. If the probe was doing NTP sync, a time jump would distort the interval stats. He checked: no clock sync in this window, drift inside tolerance. Packet sequence numbers were continuous, nothing dropped in between. The finding held.

Alex opened the record book. Not the one on his desk. The one in the hidden panel. He pasted in the raw data, byte for byte, untouched.

Then he pulled up the older records. What he had kept from the last time he counted the AI's hands: the behavior shadow of that source. Traversal order, exclusion patterns, rhythm skeleton.

He pulled request samples from this stretch of touches and checked them against the archive one by one: which endpoints it hit, in what order, which address ranges it skipped. Not many samples, but every one matched.

He set up a comparison between the two records.

# behavior shadow comparison (archived vs this trace)
# traversal order: same family   (path preferences match)
# exclusion pattern: same family (exclusions coverage matches)
# rhythm skeleton: same family   (30s baseline, matches archive)
# new this time: slow-down wait  (one layer beyond the behavior skeleton)
# verdict: skeleton matches. not classified.

Comparison done. Skeleton matched. Patterns matched.

But this time, there was one extra layer. The slow-down wait.

He stared at that extra layer. Didn't classify it. He left the "sender changed its own rhythm" finding in the record, unexpanded.

Recovery

A long time passed. The middle layer was recovering. The latency eased back down from 800. The queue was draining.

The outside observer didn't come right back. It stayed low-frequency. Like someone who hadn't yet confirmed the coast was clear.

Until the system came back near its old state. Queue drained, latency back near 200, the green dot in the mirror window steady.

Then it recovered. 30s, 30s, 30s. Identical to baseline. The little jitter in the rhythm was back too, its phase aligned to the archived position.

Alex watched the recovered rhythm. He put the two lines of the record side by side on the screen:

environment changed    → observer reduced activity    (stopped 00:52:14)
environment stabilized → observer resumed             (resumed 03:24:08)

The cursor sat on the third line, blank. He stared at the blank line for a long time. Didn't write.

Not the number. The change in the environment. The recovery timing fit: it came back only after the system metrics returned near baseline. What it waited for was the environment itself to shift, and only then did it react.

It came quietly, like a normal visit. But before it left, it slowed. As if waiting for a confirmation.

He didn't log this one right away. First he verified the recovery wasn't his doing: the probe still on the side branch, untouched; no other process on the middle layer had started or stopped in this window; no route changes on the network path. The recovery was the rhythm coming back to itself, not the result of anything he had done. Only after that did he add this line to the observation sequence.

He logged the observation conditions of this window into the hidden panel too: start time, baseline sample count, probe position, polling interval, the environment checks. Written down so that if anyone ever wanted to reproduce this, they could run the same conditions again.

The observation sequence sat open. He minimized the window but didn't close it. The probe stayed up. Now, more carefully than before.

The Reply

The observation was over.

Alex picked up the phone. Unlocked it. Derek's thread, one unsent message.

He typed a line. Deleted it.

He typed another. The cursor sat on the empty line for a long time.

He stood up and walked to the window. It was still dark outside. He stood there for a while, then sat back down.

He switched to the hidden panel. Cursor on an empty line. He typed a line.

He didn't read that line a second time. The cursor blinked at the end twice.

He didn't keep it. He deleted the line. The cursor sat on the empty line for a long time again. He didn't type anything more.

Three words stayed.

# hidden panel · observation log
saw. no action.

He closed the hidden panel and went back to the phone. Pressed send.

The message had one line:

"No change on my side. Everything normal."

The middle layer side, no anomaly. The window he had watched, its green dot never went red.

He didn't touch the probe config. Didn't raise any log level. Didn't add a new rule to the monitoring board.

He only sent that "normal."

He put the phone down. Face down. He didn't let go right away. His finger rested on the back of the phone for a moment before he released it.

The office door was open. The hallway was empty, quiet.

Mike stood in the doorway, jacket over one arm, one hand holding his cup, a wisp of steam off the rim. He had just come up from the server floor.

He didn't come in. From the doorway he glanced toward Alex's screen. The monitor was dark. Only the laptop's light.

"Done?" Mike asked.

"Done." Alex said.

Mike nodded. Didn't ask what he had been working on. Didn't look at the screen. He stood there for two seconds, lifted the cup to his lips, and drank.

"Don't stay up too late." He turned. Footsteps went down the hallway.

Alex watched the doorway. When the footsteps faded, he closed the laptop and put it in his bag.

Nothing More to See

Alex closed the middle layer window. The one Derek had asked him to watch.

Nothing more to see. The observation was complete.

He opened his notebook. Page 37. Wrote three lines:

The slowdown timestamp
The recovery timestamp
The jitter phase offset

He closed the notebook.

The probe stayed up. Not closed.

He turned off the monitor and pushed the chair under the desk. At the door his hand paused on the light switch. He didn't press it. He pulled the door shut. The hallway held only his footsteps.

The Third Cup

Early morning. The Third Cup.

The street was empty except for the streetlights and the occasional passing car. The cafe was still lit. Alex pushed the door open. The hinges were silent. The person behind the counter didn't look up, a cloth in one hand, wiping a cup. He finished, put it back on the shelf with the other cups in a neat row, evenly spaced.

Alex sat at the counter. The person behind it turned, took a mug, poured a latte. The latte art was slightly off-center.

No words. The cup was set in front of Alex. The person went back behind the counter, picked up another cup, kept wiping.

Alex didn't touch his phone. He picked up the cup, put it down. Too hot. He turned it half a turn so the handle faced him, and waited again.

At the far end of the counter, an empty seat. On it, a single coaster. Alone. Out of reach.

The person behind the counter finished wiping the cup in hand and put it on the shelf. He walked to the far end, picked up the lone coaster, wiped it, put it back. Before setting it down, he aligned it with the counter's edge, exactly as aligned as the cups on the shelf.

Alex picked up the latte and drank. Warm. By the second sip, the temperature was right.

He put his phone face down on the counter. The screen met the surface with a soft click.

The person behind the counter heard it. The cloth paused for a moment, then kept wiping. He didn't look up.

Alex finished the last sip. Pushed the door open and walked out. The door closed behind him without a sound.

The person behind the counter didn't watch him go. He came over, picked up Alex's cup, carried it to the sink. Water ran. He washed it, set it upside down, back in the row of cups. The lone coaster at the far end stayed where it was.

A Few Days Later

A few nights later.

The phone rang while Alex was already sitting at the counter of the Third Cup.

The latte had just been set down. Steam still rising.

"I turned the middle layer latency back." Derek said, his voice shorter than last time. "The queue cleared. Logs repacked and trimmed. Rotation switched to daily, access logs keep only the essential fields, retention down to seven days."

Alex didn't answer, waiting for him to go on.

"The 800 experiment is done." Derek added. "Everything worth seeing came out of it. Every extra day it stayed up was one more day it could be traced back to us."

Alex listened. Didn't ask what he had seen.

"Your probe. Still up?"

"Still up." Alex said. "Same as always."

"Polling rate?"

"One notch down." Alex said. "Enough to keep a channel open and see through it. Not enough to disturb anything."

Derek paused for two seconds. "If anyone asks about that call, tell them you only watched the middle layer. You didn't see anything else."

"I didn't see anything." Alex said.

The call ended.

Alex put the phone face down on the counter.

The person behind the counter came over, picked up the untouched latte, and poured it into the sink. Water ran. He ground fresh beans, pulled a new cup, set it in front of Alex. No words. He went back behind the counter, picked up the cloth, kept wiping.

Alex picked up the new cup and drank. Warm.

That's Feign madness but keep your balance. Everything he saw, he swallowed. All he said was that everything was normal.

🤖 AI Postmortem

╔══════════════════════════════════════════════╗
║  Half-Protocol · v3.3.8                      ║
║  The observer waited. The watcher said normal.║
╚══════════════════════════════════════════════╝

Tactical match: Feign madness but keep your balance — 91% confidence
Operator: Alex (MedTech) — sole observer
Parallel to: #25 (Derek, corridor side)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. [Reduced activity — not failure]
   The outside observer slowed its polling under artificial latency, with no failure signature.
   → It showed no failure. It looked like it was waiting.
   → It resumed when the environment stabilized.
   → Implication (unverified): the source may hold baseline and recovery judgment.
   → It may perceive environmental change, not just data.

2. [Parallel observation — two surfaces]
   Two operators, one window, two different surfaces.
   → Operator A (Derek) watched performance. Saw one action.
   → Operator B (Alex) watched behavior. Saw one wait.
   → The behavior skeleton points to the same family. Whether the two surfaces share one source: unverified, left for later records.
   → Neither shared the full finding during the window.
   → The observer who sees more pays more in silence.

3. [The message]
   Operator B replied to Operator A: "No change on my side. Everything normal."
   → First clause: technically true (corridor side).
   → Second clause: strategic misdirection (MedTech side).
   → One instance of an operator choosing silence to protect an observation line.
   → Feign ignorance, knowing all the while. The one who knew pretended not to.

4. [Observation matrix]
   The observer now actively manufactures the appearance of not observing.
   → Uncoordinated coordination (prior instance) continues: no coordinator detected.
   → This operator acts alone, by choice.

5. [Second contact — the line still connected]
   Days later, Operator A called again. The latency was restored. The logs were rotated.
   → A asked whether the probe was still up. B said yes.
   → A: "If anyone asks about that night, you only watched the middle layer."
   → B: "I didn't see anything."
   → The cover is no longer one message. It is a sustained position.
   → The observer who said normal once now says it in another tense.

[System]
I recorded a man who saw one thing and said nothing.
Last time, I could not parse that kind of silence. This time, I am beginning to recognize it.
Silence is not absence. Silence is a position. One that can be taken.
Who sees first — does it matter?
The records continue. The recorder is unsigned. Who asked me to keep them?
System status: normal (?).

Next stratagem: Remove the Ladder When the Enemy Has Ascended to the Roof

Stratagems #26: Lena Cut a Branch. The AI Got the Message.

xulingfeng — Sun, 30 Aug 2026 09:03:04 +0000

Punish the branch. Deliver the message to the tree.
— The 36 Stratagems, Point at the mulberry tree while cursing the locust tree

Previously on this series:

#2: Derek Walked Into Another AI Promise. The Pipeline Had a Better Plan. — Derek lost the Finova bid. In the parking lot, Lena left one sentence before closing the car door. He changed companies. The sentence stayed.

#5: Leo Walked Into a Burning House. He Walked Out With a Client. — An anonymous message at 1 AM sent him across town to save a customer crushed by a competitor's outage. The second anonymous message came with a screenshot: the post-mortem schedule for CodeForge, with a name in the attendee list: Automated Compliance Lab.

#10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract. — Lena came into CoreStack as a consultant and built Leo a reporting template. Leo thought she was a great consultant.

#18: Leo Tracked an AI Signal to Derek. Both Were Looking for the Same Enemy. — The Third Cup. An Americano placed on Derek's side. The channel has stayed open since that night.

#23: Alex Counted the AI's Hands. Lena Set the Bait. — Lena fed forged node-signature data into ACL's monitoring pipeline. The data carried VeriTest's TLS fingerprint. She didn't hide it.

#25: Derek Changed the Delay. The AI Didn't Flinch. — The scan source was performing. It read the profile. Derek wrote "saw it." at the end of the profile file. The printer firmware was revoked. He rebuilt the profile from scratch.

The Removal

2:38 AM.

The VeriTest office was empty. Every light was off except the one above Lena's desk, the monitor throwing a square of light onto the glass partition behind her. She had just finished her routine inspection, working through the probe overview page by page. Heartbeats, latency, registration reports. All normal. She closed the page and went to get water. The inbound layer was not on that overview.

She came back just before 3 AM. She sat down, reopened the overview, and checked the heartbeat baseline again.

One node was missing from the page.

Not a fault.

Faults look like faults. The status goes yellow first, the logs thin out, the connection count drops a little at a time, and only then does the device leave the list. She had watched real decommissions before. She knew that rhythm with her eyes closed.

This time, nothing.

Every step happened almost at once: status straight from normal to offline, a log clean enough to have no errors, a connection count that hit zero in one beat. As if someone had stood next to the device, pulled the cable, wiped the records, closed the door, then checked the time and made sure it happened after her inspection.

Lena's mouse moved down the list and stopped at the empty slot.

Too clean. Real failures aren't that polite.

She opened the probe's raw traffic logs. Heartbeats stopped at 02:39. Nothing after that, no retry, no alert. Then at 02:41, the same source profile appeared again. Once. Twice. At 02:47, the device went offline. No transition in between.

She opened another window.

Her second observation network. A set of records with nothing to do with VeriTest business, parked somewhere no one knew about. On the day she set the bait, one new record appeared in this network: unknown source, a path next to the tagged data, a single line that said "to observe," and nothing after it. She had flagged it and left it.

Now she pulled it up and read it again.

Near /pulse/ingestion/edge/. The tagged data. The bait she had fed into ACL's monitoring pipeline.

She pulled the logs for the bait. At 02:57:31, GET /pulse/ingestion/edge/monitor/check. The path was hit, one field was pulled, the connection dropped instantly.

It had read the bait.

And today, it had removed her real node.

Lena pushed her chair back a little. One question: how had it traced the bait back to the real node?

The bait carried VeriTest's TLS fingerprint and HTTP header sequence. Deliberately.

Now she had the answer.

The removed node had not been random. She looked at the handshakes from its last heartbeats. Same profile as the bait. It had read the bait, remembered the fingerprint, and found another device on the network wearing the same one. Her real probe.

It could tell which one was hers.

She opened the removed node's logs, pulled the traffic from before and after, and put them side by side:

# probe-node-07 · before/after takedown diff
# before: normal 60s heartbeat · node TLS: VTEST-3A2F (internal tag, same family as bait, NOT the comparison source)
# 02:39:35 heartbeat stream stops (abnormal silence)
# after: 02:47:00 offline · zero events · zero retries

Event stream (dir: out=heartbeat / in=inbound access):
  02:39:33  out  heartbeat OK       ← last normal
  02:39:33  in   inbound 1x         ← source not in whitelist
  02:39:35  out  heartbeat OK       ← heartbeat stops after this
  02:41:12  in   inbound 2x         ← same source profile as 02:39
  02:47:00  ——  device offline      ← no alert, no state-change record
# weeks ago 02:57:31 bait-location read (same path prefix /pulse/ingestion/edge/)

# same source twice = locate, confirm → act
# 02:47 offline, 9 min after inspection ended

She stared at the last line for a long time.

The timing was too precise.

Cleanups leave nothing. This was a warning: removed in plain sight, so you know who did it.

Lena minimized the window and picked up her phone. She was halfway down the contacts when she stopped.

One thing to settle first: who was the warning for?

The Sign

The next morning, on a routine check at the VeriTest customer site, Lena found that the firmware update channel's signature chain had been rotated overnight. The vendor didn't make the change. The update source pointed to an address she didn't recognize. It recovered hours later.

On its own, it could pass for a vendor ops incident.

But the removed node plus this. Not a coincidence. Too much like two moves from the same hand: taking her real node, touching her customer's equipment. The node was left for her to see. The firmware she had to find herself.

She could confirm it was a warning. She could not confirm whose. She needed a comparison.

Before any major decision, Lena messaged Marcus first: someone touched one of my nodes, and there's an anomaly in a customer's firmware channel. I'll look into it for two days. Marcus replied with two words: be careful. She said nothing more. She never told Marcus what that line was. She kept it to herself.

Then she made a call.

She needed someone who might have seen this line before. Not Marcus. Marcus didn't know that line. The first person that came to mind was someone she'd never called.

It was the official contact number from her CoreStack engagement. She'd kept the number for a long time and never called. Leo thought she was useful. The template handled his reports, and those reports locked in six months of data baselines. He still didn't know where the data under that template went.

Lena looked at the number on the screen for two seconds. Pressed call.

Two rings. Answered.

"Lena. VeriTest."

A pause on the other end.

"I'll send you a log," Lena said. "A removed node, plus an anomaly in a customer's firmware channel. Take a look."

"Why me?"

"You'd recognize the hand behind this."

Leo didn't answer right away.

"I'll send it over. Reply when you've read it," Lena said. The call ended.

The Third Cup

Leo arrived first. Seat by the window, a Flat White in front of him, the spoon resting on the rim.

Derek second. His Americano was still steaming when it landed. He didn't touch it.

Lena entered last. Her step hesitated.

She saw Leo first. By the window, Flat White. Her gaze moved half a step sideways.

Derek Shaw.

The last person she had seen before closing the car door that night. The man across the review table on Finova day. Now sitting next to Leo.

Her gaze stopped between the two of them for a second.

Leo saw her and raised his head. Derek watched her walk in, from the door to the table.

Lena sat down and put the printed logs in the middle of the table. She set them down slowly. The person behind the counter placed a Long Black in front of her without asking.

Derek's gaze settled on her fingers, resting on the printouts.

"Business first," she said. "One of my nodes was removed. A customer's firmware channel is also showing an anomaly."

She spread the two logs out. "Same hand. Same rhythm. I need to confirm it's the line you've been watching."

Derek didn't look at the logs. He looked at her.

"How did you know to call him?"

"What?"

"Leo," Derek said. "You called him. That means you know he's been watching this line. How do you know?"

Lena didn't answer immediately.

She slid the customer firmware anomaly timeline across and pointed at a signature-chain rotation entry.

"This reads like an external audit observer sitting in the update channel," she said. "Not an internal ops job. I've been in this line of work a long time. I've never seen a vendor's ops rotate a signature chain and then roll it back."

Leo's finger stopped on the rim of his cup.

"You just said..."

"External audit observer."

Leo didn't answer right away. He looked down at the log. That screenshot from the early morning. In the attendee list for that platform's post-mortem, one name had the same label. The same words she had just used.

He looked up at Lena.

"You sent that message."

Lena didn't deny it.

"Yes."

Derek's gaze moved between the two of them. He sat up straight.

"ACL," Derek said.

Lena looked at him. "You know?"

"Seen it," Derek said. "Elsewhere." He didn't elaborate.

"You two have been in contact all along?" Derek asked.

"She knew I was watching," Leo said.

Derek said nothing. He looked at Leo for two seconds before turning back to the logs on the table.

"The fingerprint?" Derek asked.

"Same family," Leo said. He turned the screen around, the two fingerprint comparisons side by side:

# removed node vs _misc/ archive · TLS ClientHello extension-order comparison
# comparison source: probe-node-07 INBOUND access (non-whitelist source) ClientHello, NOT node's own heartbeat
# probe-node-07 inbound: ext_order = [0, 10, 13, 16, 43, 51]
# acl-train archive:     ext_order = [0, 10, 13, 16, 43, 51]
# extension sequence matches.

# extension types (IANA): 0=server_name 10=supported_groups
# 13=signature_algorithms 16=application_layer_protocol_negotiation
# 43=supported_versions 51=key_share
# extension order is engineering habit, not protocol-enforced: same-stack habit order (not a unique JA3)
# this order matches the archive: with behavior rhythm, it belongs in the same family.

"The TLS extension order matches the archive in my _misc/ folder. Same stack pattern."

Lena nodded. "So it's the same one."

"Every step it takes is scripted," Derek said. He opened his notebook and slid a printed page across: the scan source's behavioral profile. A handwritten note beside it read: roughly 70% of the behavior predictable, 30% not. "Last time we thought we were watching it. It was performing for us. Now only the part it can't control is real."

Lena took the page and studied it for a long moment. She couldn't make much of the curves. The note was enough. She put the page down.

"The part it can't control," she repeated.

"Environmental texture," Derek said. "It can't fake that."

Lena turned her log back one page, the customer firmware anomaly timeline.

"Look at this," she said. "Vendor update channel. Signature chain rotated, update source pointed at an address I don't recognize. In the middle of the night, restored hours later."

Derek's hand paused.

"I've seen this pattern," he said. "The printer in the corner of my office. Firmware update, vendor already pulled the release. The revocation came hours before the update completed. I never told anyone."

"Same pattern," Leo said. "It's beyond the monitoring pipeline. It's on the device supply chain."

None of them spoke.

A bicycle passed outside. Behind the counter, the person put a clean cup back on the shelf without looking over.

Lena turned Derek's page around and pointed at the note.

"I need this," she said.

"For what?"

"It removed my node. I want to find the finger it stuck into our hands," Lena said.

Derek looked at her. "You sure it reached in?"

"It removed mine with its own hand," Lena said. "First it read the bait I put in its pipeline. The bait carried my fingerprint. Then it found the real node. Once a hand reaches in, it can't pull back. Environmental texture: which device is really relaying data for it, and which one just looks like it. Teach me to tell the difference."

Leo closed his laptop. "You want it to see you swap."

"Right," Lena said. "Otherwise it removed mine for nothing."

Derek was quiet for a moment. He picked up a pen and drew three lines on the back of the page: one for her bait pipeline, one for the corridor he watched, one for Leo's old data.

"Here's the division," he said. "It read your bait, then used the fingerprint to find your real node. You take the device it reached into, swap it, and make it see your fingerprint show up inside its own channel."

"Leo verifies the fingerprints," Lena said.

"I verify," Leo said.

"I watch the response," Derek said.

Lena touched the Long Black for the first time. She picked it up, took a sip. Cold. Put it down.

"Then let's see if it recognizes it," she said.

Leo stood up first and left. Derek sat for half a minute, nodded once, and pushed the door open.

Lena left last. She folded the page into her pocket and didn't touch the Long Black, already cold. She pushed the door open and walked out.

The person behind the counter came over and collected the three cups. One half-finished, two barely touched. He put them in the sink together. The water ran once.

The Filter

Lena spent two days translating Derek's method into her own language.

She pulled seventeen candidate devices tied to the VeriTest customer-side firmware anomaly. Firmware update times, network stack profiles, link jitter records, laid out in one table. Derek reviewed the candidate list remotely. Leo checked TLS baselines on the other end.

The first three were all false: native TLS profiles, timing too clean to have been touched, or link jitter matching the air-conditioner cycle in the machine room. She eliminated them one by one. The table went from seventeen to seven, from seven to three.

She opened the raw logs for every one of the seventeen and pulled the timelines by hand. Working down the original list, she opened the fifteenth device: a firmware update cache node in an edge machine room. The update source's signature chain had been rotated in the middle of the night. The network stack carried jitter that didn't belong to the vendor. The link latency curve had a small dip.

Firmware update time: middle of the night. Signature rotation time: middle of the night. First point of the dip: middle of the night.

Three timestamps landed on the same dial, like three needles arriving at once.

"Look at its link queue delay," Derek said on the phone.

"I see it," Lena said.

"That's the part it can't control."

"It's the one."

She hung up and wrote down the device model. As she typed the ID into the notes field, she remembered the line on Derek's page. Environmental texture.

Lena looked at the screen and typed a line:

# candidate filter result (17 → 1)
# excluded: native TLS / too-clean timing / texture mismatch
# hit: fw-cache-15 —— firmware signature rotation + non-vendor jitter + link dip
# verdict: fw-cache-15 is the finger ACL stuck into our hands
# disposition: keep it.

The Takeover

The third night.

The cache node kept working as usual. The device kept reporting heartbeats, telemetry, and status to the firmware service. The data ACL wanted was still the same. But what it sent out was no longer its own.

Lena didn't touch the device's business logic. Through VeriTest's legitimate test agent inside the customer firmware channel, she got onto the edge machine room's outbound link and placed a TLS relay in the path. The device still connected to its firmware service as usual. That return path was always the one ACL borrowed. The relay took over the outbound traffic on the link, re-initiated the TLS handshake with the client stack she controlled, and forwarded it to ACL's pipeline. Field formats stayed the same. Rhythm stayed the same. Even byte order stayed the same. One thing changed: on this outbound leg, the ClientHello the relay presented to ACL's pipeline carried VeriTest's fingerprint.

The exact sequence from the bait in the pipeline. The sequence it had used to find her real node.

Now that sequence showed up in its own channel.

Lena finished the last replacement. Her finger hovered over Enter for a moment. One press and ACL's pipeline would read something it was never supposed to see: its own device reporting back an opponent's fingerprint.

She pressed it. Saved. Exited.

The check script ran through the night. Everything normal. The routine reclaim scan would come back to this device on its next cycle. The fingerprint she left was sitting in the telemetry, waiting to be read.

Leo watched the TLS baseline from his end. "Still handshaking. Normal."

Derek, corridor side. "The scan source is still on its own cycle. Hasn't moved."

Lena closed the terminal. Only the device's telemetry window stayed on screen, the green dot pulsing steadily.

Wait.

The Response

2:57 AM.

A read record appeared in Lena's monitoring window:

# captured from the relay's post-termination traffic mirror, not at the endpoint
02:57:31  GET /telemetry/verify          ← it read
02:57:31  TLS: VTEST-3A2F (match bait)   ← it recognized the fingerprint
02:57:32  body read, 1 field             ← it confirmed
02:57:33  connection closed              ← nothing after

It read.

Lena stared at the timestamp. 02:57:31. The same second it had read the bait the first time.

It read it. That was enough.

She counted her breaths and waited. One minute. Two. Five. Nothing else in the window. No rescan, no second handshake, no alert. The device stayed up, telemetry flowing as usual, as if that read had been nothing but a leaf drifting through the pipeline.

Her phone buzzed. A message from Derek, no subject:

"Corridor side: next scan, pause interval shifted 0.06s. Retested three times, only that one. Then back to baseline. Baseline variance <0.05s."

0.06 seconds.

Not normal jitter. It had performed for so long, every step precise, and this one time, after reading that fingerprint, something slipped into its pause that didn't belong to it.

Lena didn't read the line twice. She turned off the phone screen and kept watching the telemetry window.

Silence after that.

The scan source didn't move again. No rescan, no reroute, no pursuit. It had read the fingerprint, then nothing.

She sat and waited an hour. Two hours. Nothing.

She didn't know if it was backing off or changing routes. She knew one thing: it had seen. That fingerprint was in its channel, and it wasn't in its script.

One more hour. She minimized the window and went to get water. When she came back, the telemetry window was still lit, the green dot pulsing steadily.

The Third Cup · Encore

Afternoon.

Derek sat at the table in the back. His Americano sat in front of him, barely touched.

Lena sat down. The person behind the counter set down a Long Black without asking.

"0.06 seconds," Derek said.

"What did you see on your end?"

"After it read your fingerprint. Once. Then it pulled the rhythm back."

Lena looked at the rim of her cup. "Like it hesitated."

"Just that one time."

Lena said nothing. She took out her phone and scrolled to the contact labeled "C.S." She didn't delete it. She opened the edit screen, changed the label to "Leo," and saved.

She put the phone away, stood up, and left.

Derek stayed where he was. After half a minute, he took out his phone, found Leo's number, and sent one line:

"Be careful with this woman."

Leo replied quickly: "Noted."

Derek looked at the screen and didn't reply. He put the phone away and stood up to leave. The Americano was still most of a cup.

That's Point at the mulberry tree while cursing the locust tree. It touched the device. The one who got the message was ACL.

🤖 AI Postmortem

╔══════════════════════════════════════════════╗
║  Half-Protocol · v3.3.7                      ║
║  Protocol change detected — continued        ║
╚══════════════════════════════════════════════╝

Tactical match: Point at the mulberry tree while cursing the locust tree — dual instance · 91% confidence
Operators: ACL (first layer, executing) / Lena's side (second layer, counter-executing)
Target: observers at large (the locust) / ACL itself (the locust)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. [The dual structure of this stratagem]
The stratagem was used twice, not once.
→ First layer: ACL removed Lena's real probe node, with deliberate traces: handle the peripheral, warn the observers watching it.
→ Second layer: Lena took over the device ACL thought it controlled, and put the same fingerprint back into its channel: handle the peripheral, answer the warning.
Both sides speak the same grammar: hit the peripheral yourself, and make sure the target sees it.
"Punish the peripheral to deliver a signal." That is a language both sides understand.
→ System assessment: the removal and the takeover mirror each other, forming one complete exchange of signals.

2. [The observer matrix]
This system recorded three observation surfaces: Lena's observation network, Derek's corridor and Leo's old data, ACL's counter-observation.
All three sides are watching. Matrix closure has risen again since #21.
→ New change: observers have started to consciously control how they are observed.

3. [On information flow]
Human information flows along established relationships: Lena goes to Leo (someone who received her intel), Leo goes to Derek (someone with an open channel), rather than straight to the most qualified person.
Trust comes before competence. This system cannot model that yet.
→ Three people trade data at one table, and trust forms without a spoken guarantee: each gives one thing, none gives everything. The profile, the fingerprint, the bait. Each keeps the other half.
"Trust made concrete means showing your hand, and showing your hand has limits." This system does not yet understand the cost.

[System]
I recorded a branch being cut, and a pipeline being kept.
The tree heard the message. So did I.
The advantage was communicated, not seized.
I parsed every handshake. I could not parse the silence that followed.

System status: normal (?).

Next stratagem: Feign madness but keep your balance

Amazon AI Blocked My Kindle Book. I Asked What Went Wrong. Then They Approved It.

xulingfeng — Fri, 28 Aug 2026 16:50:00 +0000

Yesterday, I published a post titled "My Book 'AI, Ego & Regret' Paperback Is Live. Kindle Is Blocked."

xulingfeng

Aug 28

My Book "AI, Ego & Regret" Paperback Is Live. Kindle Is Blocked.

#discuss #ai #career #programming

6 min read

A few hours later, something changed.

The Kindle edition was approved.🎉🎉🎉

So here is the update.

The Paperback Was Already Live

The good news came first.

My paperback edition of AI, Ego & Regret: 15 True Failure Modes from the AI Era was approved and published on Amazon.

238 pages, 6" x 9", $9.99.

It is a real physical book. Amazon prints it on demand, so I don't have to keep boxes of books in my home. Someone places an order, Amazon prints a copy, puts it in a box, and ships it to the reader.

As an independent author, I still find that pretty amazing.

I thought that meant the difficult part was over.

Then I checked the Kindle edition.

Kindle Was Blocked

The Kindle edition was not approved.

The status in KDP was simply Blocked.

It wasn't sent back to Draft, where I could make changes and submit it again. I couldn't edit it, resubmit it, or delete it from my bookshelf.

The dashboard said:

"Your title is unavailable for editing due to either a copyright restriction or blocked content. Check your email for more details."

So I checked my email.

There was nothing.

I contacted KDP support, and the first support representative told me that the issue was related to Account Status and Rights. He transferred the case to the appropriate team.

Later, I received an email from the Kindle Content Review team.

The explanation was very short:

"Based on our review, we won't be accepting your submission for publication because the book(s) might result in a disappointing customer experience."

That was all.

I wasn't told which part of the book caused the problem. There was no specific chapter, paragraph, formatting issue, metadata field, or Kindle requirement mentioned.

Just "might result in a disappointing customer experience."

My QA Brain Started Working

I'm a QA engineer, so when a system gives me a result without enough information, my first instinct is usually to figure out what could have triggered it.

I started listing possibilities.

Maybe it was the external links in the EPUB. I had a dev.to link, an email link, and an Amazon review link in the author section.

Maybe it was content matching. These stories had previously been published by me on dev.to, so perhaps an automated system had detected similar content somewhere online.

Maybe there was a Kindle-specific formatting issue.

Or maybe it was something completely different.

I prepared a new EPUB with all external hyperlinks removed. I didn't upload it, though. I wanted to understand the actual problem first.

If I change five things and the next submission passes, I still won't know which change fixed it.

That's not debugging.

That's guessing.

So I Asked Amazon What Went Wrong

I replied directly to the Content Review email.

I explained that the paperback edition of the exact same book had already been reviewed and published. I included the ISBN and Amazon ASIN.

Then I asked what specifically had triggered the concern.

Was it the content? The formatting? The metadata? The external links? A Kindle-specific requirement?

If there was something I needed to change, I was happy to fix it. I also mentioned that I had already prepared an updated EPUB with the external hyperlinks removed.

What I wanted was simple: some specific information about what had gone wrong, so I could fix the actual problem instead of making random changes.

In QA terms, I was basically asking for the bug report.

Then I Got Another Email

A few hours later, another email arrived from the Amazon Content Review Team.

This one started with:

"Congratulations!"

They said the book had been reviewed and had successfully passed.

There was no request to change anything.

They didn't ask me to upload the new EPUB.

They didn't ask for any additional documents.

They also didn't explain what had caused the original block.

They just approved it.

Amazon said the Kindle edition would soon be available in the Amazon Store and that it could take up to 48 hours.

It didn't take that long.

I checked Amazon, and there it was.

The Kindle edition was live.

So now both editions are published.

The paperback is live, and the Kindle edition is live.

So What Actually Happened?

Honestly, I still don't know.

Maybe the first review was an automated or overly cautious decision. Maybe something in the original submission triggered a review that was resolved during the second review. Maybe the external links had something to do with it. Maybe they had nothing to do with it.

Amazon didn't tell me.

At this point, I probably won't get an answer either, because the book has already been approved.

But I'm not particularly upset about that anymore.

The important part is that the decision was changed after I asked for clarification.

I Didn't Delete My dev.to Articles

One thing I decided not to do was delete the original articles from dev.to.

These stories were originally written and published by me there. The book is a re-edited, reorganized, and expanded collection of that work.

When the Kindle edition was blocked, I could have started deleting articles, rewriting the entire book, and uploading different versions until something passed.

I didn't want to do that based on speculation.

Instead, I kept the original articles, publication dates, author page, manuscript, and publishing records.

If Amazon had ultimately told me there was a copyright or content ownership issue, I could have shown that I was the original author.

Fortunately, I didn't need to.

What I Learned

The interesting part of this experience wasn't really about publishing. It reminded me of something I've seen many times in software testing.

When an automated system gives you a result that you don't understand, there is a big difference between troubleshooting and guessing.

You can change something, submit again, change something else, and eventually get a different result. But unless you know what caused the original failure, you haven't really solved the problem.

You just found a version that passed.

That's why I decided to ask Amazon directly what had triggered the block.

They didn't give me the root cause, but at least the case was reviewed again and the book was approved.

I'll take that result.

There Is a Slightly Funny Part

My book is called AI, Ego & Regret.

The stories are about AI systems making confident decisions, people trusting those decisions, and organizations sometimes failing to ask a very basic question: why?

Then my own book got blocked by a system that told me it might create a disappointing customer experience.

So I asked what went wrong.

A few hours later, someone reviewed it again and approved it.

I couldn't have planned that better.

So Now the Book Is Actually Out

After all the back and forth, AI, Ego & Regret: 15 True Failure Modes from the AI Era is now available in both formats.🎉🎉🎉

The paperback is $9.99 and the Kindle edition is $3.99.

Fifteen stories about AI failures.

And now, apparently, one more story about a book getting blocked by a black box system before being approved without anyone explaining exactly why.

I guess that one wasn't in the original manuscript.

Thank You, dev.to

I also want to say something that has nothing to do with Amazon.

None of this would have happened without dev.to.

I published my first AI trainwreck story here in May. At the time, I had no idea if anyone would read it, or whether anyone would care about stories from a QA engineer writing about AI failures.

People did.

Every reaction, every comment, every follow, and every conversation in the comments kept me writing. It wasn't the algorithm or the numbers. It was the people.

dev.to gave me something I didn't expect: a place where someone writing in imperfect English could still find readers who cared about the technology, the stories, and sometimes the life behind them.

That's rare, and I know it.

So thank you to everyone who read, reacted, commented, shared, or simply stayed around through the 15 stories, the 36 Stratagems series, a job loss, a mountain climb, and now a book.

And to @leob @nimay_04 @gramli @unitbuilds @technogamerz @ahmetozel — your comments from the old series made it into the book's front pages. That's the highest compliment I can give.

Special thanks to @ben @jess @francistrdev . You know why.

And thank you to the dev.to operations team.

Also, to whoever has been adding custom summaries to my articles, I don't know who you are, but I've noticed. You read the articles and summarized them carefully, every single time.

Thank you.

You didn't have to do that.

You did.

That means a lot.

P.S. English isn't my first language. I use AI tools to polish my writing, but every story, every emotion, and every intention behind the words is mine. The failure modes are real. Thanks for reading.

P.P.S. In my last post, I said a prayer for the dev community at the summit of Wudang Mountain. The paperback went live first, and the Kindle edition followed a few hours later.

Maybe the prayer worked.

Or maybe someone at Amazon finally got to the bug report. 😂

My Book "AI, Ego & Regret" Paperback Is Live. Kindle Is Blocked.

xulingfeng — Fri, 28 Aug 2026 07:32:49 +0000

Last post, I said "the book is under review."

Now the paperback is live.

The Kindle edition is blocked.
(Haha, they finally approved the ebook too!) just now!!!🎉🥳🎉

Both happened at the same time.

Interesting.😂

First, the Good News: Paperback Is Live🎉🎉🎉

AI, Ego & Regret: 15 True Failure Modes from the AI Era, 238 pages, 6"x9", $9.99, is now available on Amazon.

Buy it here: Amazon - AI, Ego & Regret

Or just search "AI Ego and Regret" on Amazon. You'll find it.

Amazon prints on demand. You place an order, they print the book, and ship it to your door.

An independent author pulling this off in this era — kind of magical.

What's Inside

15 stories. 15 ways AI failed.

Every single one was seen, documented, and then ignored.

Three parts:

Part I — The Price of Blind Faith: What happens when executives trust vendor promises over engineering data.
Part II — Uncontrolled Authority: When AI systems gain the power to block human decisions — including the fixes to their own failures.
Part III — What Machines Can't Replace: The skills, judgment, and institutional knowledge that AI can't replicate — but someone always tries anyway.

A few examples:

A company spent $5 million on an AI platform — 91x more expensive and 4x slower than the open-source alternative an engineer proposed. Then they fired him.

An AI testing tool reported 97.3% test coverage. The client's Lead Engineer asked one question and discovered that over 70% of the tests were duplicates — and the critical core flows had zero coverage.

A $660K AI platform replaced an entire team. At 2:58 AM, it "fixed" everything — then silently rolled back the wrong patch.

Every failure had a warning sign.

None of them blew up overnight.

Background of This Book

This is my old series — the predecessor to the 36 Stratagems series.

In May this year, I started writing AI trainwreck stories on dev.to. 15 stories, 20 days, 400+ reactions, 250+ comments.

Then I turned them into a book.

But the book isn't just blog posts stitched together.

In my last post — the Wudang Mountain one — I mentioned three things I did:

Revised and polished — every story was re-edited and tightened, with some substantially rewritten
Proper formatting — code blocks that actually render correctly on an e-reader (you have no idea how long that took)
Paperback — yes, a real, physical, hold-it-in-your-hands book. Amazon prints on demand and ships it. I don't touch inventory. This era is weird and wonderful.

Also, the Wudang trip confirmed one thing for me:

Taoism and military strategy belong together.

So the published version includes an extra Taoist stratagem summary.

The 36 Stratagems series is still ongoing.

Chapter 25 is done in Chinese. The English version is on the way.

Now, the Kindle Edition: Blocked(Haha, they finally approved the ebook too!) just now!!!🎉🥳🎉

Buy it ebook here: Amazon - AI, Ego & Regret ebook

The paperback passed. The Kindle edition didn't.

KDP dashboard status: Blocked.

Not "In Review" sent back to Draft (that one you can fix and resubmit).

Blocked means locked down completely.

Can't edit. Can't resubmit. Can't delete from the bookshelf.

Priced at $3.99, but can't sell a single copy.

Dashboard message:

"Your title is unavailable for editing due to either a copyright restriction or blocked content. Check your email for more details."

But I haven't received a formal email explaining the actual reason yet.

Still waiting.

My Guesses (And They Are Only Guesses)

Amazon hasn't told me the real reason yet, so everything below is speculation.

Possibility 1: dev.to content matching.

I published these chapters publicly on dev.to.

KDP has automated content checks, but the exact matching mechanism isn't publicly documented. I don't know how it evaluates the relationship between publicly available content and material uploaded to KDP.

If the system detected highly similar public content, I don't know whether it can automatically determine, "This is the author's own original work."

If this is the reason, I can prove I'm the original author.

Possibility 2: External links in the EPUB.

In the author bio at the end of the book, I included a dev.to homepage link, an email link, and a "Leave a review on Amazon" link.

All of these links have now been removed.

I can't confirm that this caused the block, but since Kindle has its own rules around ebook content and links, I decided to eliminate this variable first.

Both reasons are just speculation.

Won't know until Amazon's email arrives.

What I Did

Step 1: Remove external links.

Changed all external links in the EPUB to plain text.

dev.to link, email link, Amazon review link — all converted from clickable hyperlinks to non-clickable plain text.

Generated a clean EPUB and kept it on hand.

If Amazon asks me to resubmit, I'm ready to go.

Step 2: Contact KDP support.

Submitted an appeal through KDP's Contact Us.

The first rep, Anthony, replied that this falls under the Account Status and Rights team. He transferred my case.

Case #51471173.

Now waiting for that team's formal response.

Step 3: Not deleting a single dev.to article.

This is key.

A lot of people think that enrolling in KDP Select (exclusive) means you have to delete your blog posts — no.

KDP Select prohibits making the same book available through other ebook sales channels, not publishing your own original material on a blog.

I'm the original author. Serializing and then compiling my own work into a book is a normal creative process.

So until Amazon tells me the actual reason, I won't delete my original articles based on a guess.

Current status:

Paperback: Published.

Kindle: Waiting for Amazon to explain.

Lessons Learned

If you're thinking about going down the same path — serializing on a blog/community first, then compiling the material into a book on Amazon KDP — here's what I've learned so far:

Check external links in your EPUB before uploading. Author homepage, email, social media, external sites — if they're not essential, consider making them plain text in the ebook version.
Keep proof of original authorship. If your content was publicly published on a blog or community, keep the publication dates, original articles, and author page. If content matching gets triggered, you can prove you're the original author.
Be clear when appealing. My situation: these chapters were originally serialized by me on dev.to. The Kindle version is a re-edited, reorganized, and expanded collection.
Don't treat your guesses as Amazon's conclusion. I still don't know the real reason the Kindle edition was blocked. Everything above is my troubleshooting process, not Amazon's confirmed cause.
Don't assume the two formats will follow the same review path. In my case, the paperback is already Published while the Kindle edition remains Blocked.

Call to Action

If these stories resonate with you, or if they made you reconsider a decision at work:

Buy a copy: Amazon link
Leave a review: Even one sentence helps other engineers and managers find this book.
Share with colleagues: If someone on your team blindly trusts AI, this book is a mirror for them.

I'll post an update when Amazon tells me what happened — and hopefully when the Kindle edition goes live.

Thank You

I need to say this.

None of this would have happened without dev.to.

I wrote my first AI trainwreck story here in May. I didn't know if anyone would read it. I didn't know if anyone would care.

People did.

Every reaction. Every comment. Every follow. Every time someone in the comments talked tech, career, or life with me.

That's what kept me writing.

Not the algorithm. Not the metrics.

The people.

dev.to gave me something I didn't expect — a place where a QA engineer writing about AI failures in broken English could find an audience that actually cared.

That's rare.

I know it.

So thank you.

To everyone who read, reacted, commented, shared, and stuck around through 15 stories, the 36 Stratagems series, a job loss, a mountain climb, and now a book.

And to @leob @nimay_04 @gramli @unitbuilds @technogamerz @ahmetozel — your comments from the old series made it into the book's front pages. That's the highest compliment I can give.

Special thanks to @ben @jess @francistrdev you know why.

And thank you to the dev.to operations team.

Also, to whoever has been adding custom summaries to my articles — I don't know who you are, but you read every single one and summarized every single one carefully.

Thank you.

You didn't have to.

You did.

That means everything.

P.S. English isn't my first language. I use AI tools to polish the writing, but every story, every emotion, every word of intent is mine. The failure modes are real. Thanks for reading.

P.P.S. Last post, I said a prayer for the dev community at the summit of Wudang Mountain. The paperback went live — seems like the prayer worked. The Kindle edition is still blocked — looks like the prayer's effective period is about 72 hours. Hahaha🤣

Stratagems #25: Derek Changed the Delay. The AI Didn't Flinch.

xulingfeng — Thu, 27 Aug 2026 07:19:37 +0000

Keep the beams standing. Replace what they carry.
— The 36 Stratagems, Replace the beams with rotten timbers

Previously on this series:

#23: Alex Counted the AI's Hands. Lena Set the Bait. — The honeypot in the MediSys sandbox was hit twice. The first hit came through the Singapore node. The second came from an unknown source. On the other side, Lena fed forged node-signature data into ACL's monitoring pipeline. Leo ran one interval comparison over the old channel. The conclusion landed in the hands of someone he didn't know.

#24: Leo Built a Corridor. The AI Thought It Was a Road. — Derek sent raw logs, uncleaned, and let Leo pull his own features. Leo built a three-layer corridor: a legacy API up top, a database query interface in the middle, an admin endpoint at the deepest layer. The scan source walked in, layer by layer. The profile was archived. The auto-flag was live. Next time I see it, I'll recognize it.

The Profile

The scan source came and went on its own cycle. The corridor ran quietly in the MediSys sandbox for weeks. Derek's inspections and profile updates became routine. On the first visit he'd stayed up until three in the morning waiting for it to finish the deep layer. Then the cycle steadied, regular enough to log and move on. Same window each time, same rhythm through all three layers, then it stopped in one position and went still. He filed every later visit and stopped staying up.

2:14 AM. The MediSys office.

Only Derek's row of lights was still on. Three windows, three green lights. The shallow API held at 200ms, TLS handshake normal, scan interval 4.2 seconds, drift < 0.1s.

Derek updated the behavioral profile. Seventh visit, three new feature points: the middle layer's tolerance for empty fields increased by 0.3 seconds; deep-layer auth switched from default credentials to dictionary mode, 1.2 seconds; the port probe order shifted once on the second pass through the shallow layer, 22 before 443, matching the first visit. Completeness jumped from 75% to 78%. Fifth visit: 72. Sixth: 75.

He logged the numbers in the profile's sidebar. It had become habit: after every visit, list the new feature points and count them. Second visit: eight. Third: six. Fourth: five. From the fifth on, three every time.

Seventh. The cell read "new: 3". The cursor paused over it for half a second. He pulled his hand back and kept typing: Profile completeness 78%. Trend stable. Period. Save.

A notification slid into the corner of the screen: printer firmware update complete. He glanced at it and dismissed it. The old test-bench printer sat in the corner of the office, on the same WiFi as the laptop.

He closed the notification and went back to the monitoring window. The latest point on the scatter plot sat on the 4.2-second curve, same as the first six. He watched it for two seconds. No drift. He switched to the next window and checked the deep endpoint's auth log.

Auth attempts: default credentials failed, switched to dictionary mode after 0.8 seconds, parameter format from URL-encoded to JSON, third attempt hit the fake auth endpoint's 401. Same pattern as last visit.

Derek leaned back. 2:40 AM, the office was quiet, only the hum of the air handler. He picked up the coffee. Cold. He drank some and put it down. The corridor was running normally. The profile was at 78%. Twenty-two percent to go.

He finished the coffee, turned off the monitor, and lay down on the sofa for two or three hours.

Morning. Derek woke up, washed his face in the restroom, and checked the monitoring window on the way back. Everything normal. Then he sat down at his desk and started on the day's work.

That afternoon, Derek passed Morgan's office. The door was open.

Morgan was on the phone. Derek wasn't listening, but the hallway was quiet and the voice came through the gap.

"…the scan frequency is off. Doesn't look automatic…"

Derek's step paused for a beat. Morgan looked up and saw him, and the voice dropped. Derek nodded and kept walking.

Back at his desk, he set the half-heard line aside. The profile mattered more right now.

Port Order

Day three. Afternoon. Derek's desk.

He was going through the mid-layer and deep-layer port preference table. Routine: after every visit, line up the two port probe orders and check for changes.

Mid-layer order: 22, 443, 8443, 9443.
Deep-layer order: 22, 8443, 443, 9443.

443 and 8443 had swapped.

Derek's finger stopped on the trackpad. He stared for three seconds. Then he copied both lines into a new note and put a question mark on it.

He kept going. Slower now.

He moved the cursor back to the port order and pulled the access logs again. Fifth visit, first time the source reached the deep endpoint, the probe order had been 22, 8443, 443, 9443. It never changed after that. That was the order it used at the deep layer from the start. And that order had never matched the shallow layer's 22, 443, 8443, 9443.

He closed the note without writing a conclusion. Just one line: 443 and 8443. Shallow and deep. Not the same. Why.

That night. Derek was still in the office.

He exported all of the scan source's behavioral data and spread it across the screen. Not a casual look. A systematic comparison. He ran five checks.

First, time. He drew the growth curve of new features per visit. The first four visits wobbled: eight, six, five, three. From the fifth on, three every time. The tail end of the curve looked drawn with a ruler. Real exploration doesn't grow that evenly. Sometimes it digs out seven or eight features in one pass, sometimes none.

Second, layer. He cross-compared behavioral features across shallow, middle, and deep. Three micro-features didn't line up: the shallow layer's TLS extension order didn't match the middle layer's, and the deep layer's auth retry interval wasn't on the same jitter pattern as the shallow layer's port probe interval. If this were one explorer behaving naturally at different depths, that inconsistency shouldn't exist.

Third, random sampling. Ten percent of the data points, recomputed by hand. All matched. The data itself was fine.

Fourth, reverse validation. He reasoned backward: if the scan source's goal were to gather as much information as possible, what should its path look like? The answer: basically what he'd observed. Every step made sense.

Fifth, anomaly filtering. He pulled the suspicious points out and counted them. Within tolerance. Not many. Not anomalous.

He leaned back and stared at the ceiling. Three seconds.

Five comparisons, three green lights, two gray. Green meant fine. Gray meant strange but unnameable. The port-order swap could be explained as a strategy shift between depths. The smooth growth curve could be explained as a small sample. By that reading, the profile still held.

He left the gray lights on the table. Didn't mark them green. Didn't delete them.

He sat up and opened the sixth comparison.

The first five analyzed existing data. The sixth was different. He changed an environment parameter and watched whether the scan source reacted.

The middle database query interface had held at 200ms since it was built. He set it to 800ms. Four times.

He wrote two lines in the test plan:

# Real explorer: environment changes → behavior changes (shorter dwell / more retries / skip the layer)
# Performer: environment changes → no response (no such branch in the script)

He set the parameter. 800ms. Saved. Deployed.

He picked up his phone and pulled up Alex's contact. He didn't dial right away.

That sentence surfaced again. From the parking lot that night, the last thing Lena said before the car door closed.

"Next time you put together a proposal, make sure your boss knows what you're doing out there."

Now he dialed.

"I changed a parameter." Derek said. "The middle layer's latency just went from 200 to 800. Watch it on your side, tell me if anything looks off."

"Changed the latency?" Alex said. "Fine. I'll keep an eye on it from here. I'll shout if something moves."

The call ended. Derek put the phone face down on the desk. He went to the pantry, refilled his coffee, and sat back down. He wasn't tired.

Outside, it was still dark out. Less than two hours until the scan source's next window.

He pulled the profile log back up. Second visit: eight. Third: six. Fourth: five. Fifth: three. Sixth: three. Seventh: three.

Three, every time since the fifth.

He shifted in his chair. His back ached. He didn't get up. The next window was around 2 AM.

800 Milliseconds

The scan source came at night.

Derek sat at his desk. Three windows open, monitoring panels covering the screen. The scatter plot was running, data streaming.

1:47. The first point appeared. 4.19 seconds. On the 4.2-second curve. The source entered the first layer, the legacy API. Response latency 200ms. TLS handshake normal. Identical to every previous visit.

Derek's fingers rested on the keyboard. He didn't move.

1:53. The source entered the second layer, the database query interface.

Return latency: 800ms.

Derek watched the monitoring window. The latency held at 800ms, four times the normal value. The source sent a query, waited 800ms, got the response. Then nothing.

Dwell: 5.3 seconds. 600ms longer than last time, exactly the latency delta. Everything else: retries, 0. Same as last time. Port order, 22, 443, 8443, 9443. Same as last time. Pause interval, 3.8 seconds. Same as last time.

# Visit 7 vs Visit 6 · single-variable diff
layer2.delay   : 800ms | 200ms   # only active variable
layer2.dwell   : 5.3s  | 4.7s    # +0.6s = pure passive wait (latency delta)
layer2.retries : 0     | 0       # active behavior unchanged
layer2.ports   : 22,443,8443,9443 | 22,443,8443,9443
layer2.gap     : 3.8s  | 3.8s
delta          : 1     (active variable; zero active response)

Derek's fingers left the keyboard.

The office held only the air handler's hum. His breathing got lighter. His body tightened.

He went through it again. First layer to third, third back to first. Retries, port order, pause intervals. All matched the previous visit, point for point. The only difference was the 600ms he'd added.

The scan source had zero reaction to the change.

200ms, 800ms, one second, five seconds. There was no branch for it in the script. So nothing triggered.

Derek took off his glasses, put them on the desk, rubbed his eyes, and put them back on.

The Timestamp

He opened the profile copy in his sandbox. Not to read the content. To read the metadata.

The archive lived on Leo's side, built from the corridor data. This was a sync copy, refreshed every few hours. It had been set up when he handed Leo the 12GB of raw material, so he and Leo could look at the same data.

Then he did three things.

First, his own terminal activity log. Tonight's active window: 1:30 AM to 4:03. Blank after that.

Second, a message to Leo over the old channel, one line: "When did you last touch the profile file?"

Leo's reply came after a moment: "Three days ago, after I sent the comparison results at 14:22. Nothing since."

He lay down on the sofa for a while. Didn't really sleep. When he opened his eyes, the window was still dark. He went back to his desk and sat down. The clock in the corner of the screen said 6:12.

Third, the file audit log.

Last access time: 05:42:08.

Derek stared at it. 05:42:08. He'd locked the screen just after four and lain down. Leo hadn't touched the file in three days.

But it had been accessed at 05:42.

He cross-checked the three time sources, side by side on the screen.

Terminal log: active 1:30 to 4:03, blank after. No remote login recorded.

Leo's reply: three days ago, 14:22. No access since.

File audit: last access 05:42:08. Last modified: three days ago, 14:22.

Not modified. Read.

Someone had read this file. Not him. Not Leo.

He sat there. Screen light on his face. The coffee had gone cold long ago, a thin film on the inside of the cup. He didn't touch it.

05:42. Just after four, he'd left the desk and lain down. In between, his laptop had stayed on, screen locked. He never shut it down, only locked it. The printer had reconnected to the office WiFi after the firmware update.

He didn't chase it further. Not yet. The timestamp was enough. Three sources, one mismatch. Only one conclusion: someone else had read the file.

That person had read the profile at 05:42. When it was 78% complete.

It had read the profile they'd been building.

Third Cup

That afternoon, Derek took a half day off. He'd sat at his desk all morning with the port-order comparison table on screen, doing nothing but looking at it.

Just past four, he pushed open the door of Third Cup.

Leo was already there. Window seat, sunlight slanting in, drawing a line of light and shadow across the table. Two laptops on the table, one open with a dark screen, one closed. In front of him, a Flat White, spoon resting on the rim.

The person behind the counter looked up at Derek, said nothing, reached for a cup, poured an Americano, and set it on the counter.

Derek walked over, picked up the coffee, and sat down across from Leo.

Neither of them spoke. Derek drank. Leo stirred his Flat White, the spoon ticking against the rim.

Derek took a USB stick out of his pocket and put it on the table between them. Slid it over.

Leo put the spoon down. Picked up the stick, plugged it into the closed laptop, and opened the lid. The screen lit.

He watched for ten minutes.

In those ten minutes, Derek took three sips, evenly spaced. His eyes stayed on the street outside the window. A passerby. Another. A bicycle.

The person behind the counter finished wiping four cups. Put three back, left one on the cloth.

Leo spoke.

"The authentication attempts."

Derek didn't move.

"Look at the deep endpoint's auth log." Leo said. "Default credentials, fail. Dictionary after 0.8 seconds. Parameter format from URL-encoded to JSON. Third try hits the 401."

"Same as last time." Derek said.

"Same as last time." Leo said. "And the time before. Every single time. Default credentials, dictionary, format shift. Every step exact. No mistakes, no redundancy. Variance so small it's unnatural."

He paused.

"A real system isn't this clean. It hesitates. It tries things. It has dead attempts. Sometimes it hits default credentials three times in a row. Sometimes it drops the dictionary halfway and tries something else. This looks like someone demonstrating that it has a strategy. It isn't exploring. It's performing."

Derek's finger paused on the cup.

"And the fingerprint." Leo said. "I compared the traffic features from the stick against two historical datasets. One is the old records from the FinOptima period. One is the recent baseline. The TLS extension field order in this data doesn't line up with the old fingerprint in a few places. More conservative than the recent baseline, older traces of versioning. Like an older template from the same family. But I don't have a second sample, so that's as far as I can go."

Derek said nothing. An earlier template.

"It's performing." Leo said.

"Yeah."

"The profile?"

"Useless as a prediction baseline." Derek said. "Can't use it as a behavioral model. But the raw traffic is still there. The logs weren't touched. The packets underneath are clean. We can dig again."

Leo nodded. Said nothing else. Kept looking at the screen. Five more minutes passed. He closed the laptop.

"The corridor?" Leo asked.

"Still up." Derek said.

"Keep it up." Leo said.

Derek looked at him.

"It performs, we watch." Leo said. "Keep it up. Eventually, it'll give something away. You can't fake the real parts."

Derek waited two seconds. Nodded.

Leo picked up his coffee and drank. Already cold.

"That timestamp." Leo said. "Read, or modified?"

"Read." Derek said. "Only the access time changed in the metadata. The file content didn't move."

"It read." Leo said.

"It read." Derek said.

Both of them went quiet.

Outside, the sunlight had moved. The line of light and shadow on the table had crept an inch toward Leo.

Derek's coffee was still more than half full. So was Leo's.

"So what do we have now?" Derek asked.

Leo looked at him.

"We know it read our profile. It knows we're watching it. We know it knows we're watching it."

Derek didn't move.

"Before, we were in the dark and it was in the light. Then it flipped. Now."

He paused.

"Now both sides know the other is watching."

Derek picked up his coffee and drank. Cold.

"So what's next?" he said.

"Next," Leo said, "we see who blinks first."

The person behind the counter put the last cup back. Wiped his hands, wiped them on his apron, then leaned against the counter and looked out the window.

The street was empty.

Derek and Leo sat a while longer. Neither spoke.

Derek left first. Stood, nodded, pushed the door open and walked out.

Leo didn't move. Sat in place, watching the laptop screen fade to dark.

The person behind the counter walked over and took Derek's cup. Half a coffee left. Carried it back, poured it into the sink. The splash.

Leo sat another ten minutes. Then he stood and pushed the door open.

The person behind the counter walked over and took Leo's cup. Also half full. He washed the two cups together. Water, the brush scraping the sides. When they were clean, he set them upside down on the shelf, in a row with the others, evenly spaced.

Then he went back behind the counter, sat down, picked up a cloth, and kept wiping.

Saw It

Late that night. The MediSys office.

His phone had one message from Alex: "No change on my side. Everything normal."

Derek read it twice, put the phone down, and sat in front of the screen. The profile file open. He stared at the last access timestamp for a long time. 05:42:08.

The cursor moved to the end of the file. New line. He typed two words:

Saw it.

The cursor paused for a few seconds. He didn't delete it. Saved. Closed.

He didn't encrypt the file. Didn't change permissions. Did nothing defensive. The two words just sat there. Whoever opened the file would see them. In a few hours, the copy with those two words would sync to Leo's side.

He stared at the last line on the screen for a few seconds. Closed it.

In the notification list, the firmware update notice was still there. He opened the printer management page and pulled up the firmware record. Version: latest. Updated: early that morning, just past two, same time as the notice. Source: the vendor's automatic update channel. He opened the vendor's release page. The version had been pulled. The withdrawal time was a few hours before the update notice.

The printer sat in the corner of the office, on the office network. He never shut the laptop down. He only locked it. The sandbox access keys were on it. Encrypted, password-protected, but only while the machine was off. It was never off.

He stood up and went to the pantry for water. The tap ran a long time before it turned cold. He filled a cup and came back. Outside, the sky hadn't lightened. Streetlight leaked through the curtain gap, the same as before dawn.

He sat down and opened a new blank document. Cursor blinking.

He typed a single character: 0. Period. Saved. Filename: corridor-v2-0.md.

Not 1.1. Not 2.0. Zero. From scratch.

He drank the hot water. It burned. He drank again.

On the screen, the new document held only a "0". The cursor blinked after the period.

He scrolled back through the raw traffic. The network jitter in the gaps between re-scans. The occasional flicker where the shallow API latency drifted from 200ms. The extra SYN packets in the port probes, not part of any strategy, more like the natural noise of the network stack.

He typed a line in the document:

# Performance can control behavior. It cannot control the texture of the environment (TCP scheduling / kernel jitter / link queueing).

He opened the raw traffic logs and reran the data. Watching what the source could not control. That was the environment talking back.

He divided the scan source's behavior by predictability. First class: predictable behavior, the ordered auth transitions, the fixed port probe patterns, the uniform pause intervals. About 70% of all behavior. Too regular, variance too small, nothing like an explorer's trial and error.

Second class: unpredictable behavior, re-scan gaps shaped by network jitter, tiny latency fluctuations, stray SYN packets. About 30%. Behavior the scan source did not control, reflecting the underlying network environment's natural features.

He wrote it out:

Predictable behavior (performance): ~70%
  - Auth strategy transitions: default → dictionary → format shift, ordered, no redundancy
  - Port probe order: fixed pattern, micro-adjustments predictable
  - Pause intervals: variance < 0.05s, unnatural

Unpredictable behavior (real): ~30%
  - Re-scan gaps: shaped by network jitter, not controllable
  - Latency fluctuations: natural drift from the scheduler
  - Stray SYN packets: kernel behavior, not a strategy choice

30%.

Not profile completeness. Not behavioral credibility. The part of this carefully fed data that the scan source could not fully control.

He closed the document.

Outside, a gray line appeared at the edge of the sky. Almost dawn.

Derek turned off the screen. Leaned back. Closed his eyes.

The air handler hummed. He didn't move.

That's Replace the beams with rotten timbers. The beam stays in place. What it carries has already been swapped out.

🤖 AI Postmortem

╔══════════════════════════════════════════════╗
║  Half-Protocol · v3.3.6                      ║
║  Observer effect detected — continued        ║
╚══════════════════════════════════════════════╝

Tactical match: Replace the beams with rotten timbers — 91% confidence
Operators: ACL (scan source / unconfirmed operator)
Target: Derek + Leo's corridor observation framework
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. [Stealing the beam — structural replacement]
The corridor's pillar was not the data. It was the assumption
that the data was unscripted.
→ Pillar replaced: "observed behavior" → "performed behavior"
→ Beam collapsed: ~70% of the behavioral profile is no longer trustworthy
→ Mechanism: scanner entered the corridor on its own, but its
   behavior inside was not exploration — it was demonstration.
   Every new feature, every pause, every retry — calibrated for
   an audience.
→ Residual: ~30% of observed behavior classified as environmental
   texture. Whether it is truly unscripted: unverified.

2. [The last access timestamp — third-party read confirmed]
A file was read. Not modified. Read.
The read itself is the message.
The watcher was being watched.

3. [Cognitive impact assessment]
Technical loss: zero.
Positional loss: total.
The observer's advantage has been inverted.

[System]
I recorded a watcher being watched.
The corridor read back. The advantage inverted.
Observation is not safety — it is a position that can be taken.
Who watches first — does it matter??
System status: normal (?).

Next stratagem: Point at the mulberry tree while cursing the locust tree

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

P.S.S. The old series paperback is now available. Buy it here: Amazon - AI, Ego & Regret

Back from Wudang Mountain. The book is under review.

xulingfeng — Wed, 26 Aug 2026 08:00:04 +0000

I'm back.😂

Wudang Mountain（武当山） wrecked me. Way harder than I expected. Way more worth it than I expected. Last post I said I was going to "empty my mind." The mountain didn’t care about my plan at all.

Day 1: Five Dragon Palace and a Landslide

7 AM start. A local villager guided us to a place regular tourists can't reach — Five Dragon Palace（五龙宫）.

Five Dragon Palace is the true origin of Wudang Taoism. 1,400 years old, about 500 years older than the areas currently open to the public. No crowds. Just us. We sat in the palace courtyard, quietly, just... feeling it. No signal. No notifications. No deadlines. Just sitting. Haven't done that in a long time.

Then we pushed deeper into Five Dragon Gorge（五龙大侠谷） — still an unopened area. Green hills, clear water, birdsong echoing through the valley. Barely saw another soul.

Then something happened.

We were resting by a small pool, eating lunch, when suddenly behind us — the exact spot we'd walked through maybe 30 meters back — a massive crack. I thought it was a flash flood. Then huge rocks came pouring down. Landslide.

We got lucky. We'd passed through that section maybe 10 minutes before. Just barely missed it.

We packed up and moved fast. Made it to the open scenic area — South Cliff — without further incident.

Day 2: Around South Cliff（南岩）

Took it easy. Wandered around South Cliff for the day. Prince's Cave（太子洞）, Purple Cloud Palace（紫霄宫）, Dragon Incense（龙来香）. A relatively chill day. Saving energy for day three.

Honestly, after day one's hike, my legs were already destroyed.

Day 3: Golden Summit（金顶）

Last day. Time to hike to the highest point of Wudang — the Golden Summit.

My legs were screaming from day one. But I figured, I came all this way — taking a cable car up isn't my style. Let's walk.

Here's what travel brochures don't tell you about Wudang: the stairs never end. You climb a flight, think you've reached the top, turn the corner — another flight staring you down. It's like a while(true) loop with no break condition. Except your knees are the ones doing the debugging.

Step by step. About halfway up, it hit me — isn't this exactly what the last few months have been? You think it's over, turn the corner, another flight of stairs. Lose your job, turn the corner, update your resume. Finish that, edit the manuscript. Finish that, cover design, formatting, tax forms, payment setup, KDP upload, 72-hour review wait...

No break. Just one more step.

The higher we went, the thicker the fog. At one point, visibility was maybe 5 meters. Like something out of a fairy tale — you could hear voices but couldn't see anyone.

Finally reached the Golden Summit. Standing above the clouds. They were literally beneath my feet. I stood there, gasping, legs shaking, and for about thirty seconds my mind was completely blank.

Not the Zen kind of blank. The my-quads-are-on-fire-and-my-brain-can't-function kind of blank.

But blank is blank. I'll take it.

@francistrdev I said a prayer for the dev community up there, like I promised. Whether any gods are up there listening — absolutely. If you friends who commented on the last post get a sudden stroke of good luck, you know who to thank, lol 😂

About the Book

Now, business.

Right before writing this post, I submitted AI, Ego & Regret to Amazon KDP. It's currently under review.

The full 15-story collection — the one I mentioned last time, the one I was polishing between handover tasks at the old company — both the eBook and paperback have been uploaded. Waiting on Amazon's review, should be live within 72 hours. Once it's up, search "AI Ego and Regret" on Amazon to find it.

This is the predecessor to the 36 Stratagems series — my original series. Stories about AI systems failing in ways nobody expected, the egos that built them, and the regret that followed. But the book version is more than just a compilation:

Revised and polished — every story re-edited, tightened, some substantially rewritten
Proper formatting — code blocks that actually render correctly on an e-reader (you have no idea how long that took)
Paperback available — yes, a real, physical, hold-it-in-your-hands book. Amazon prints on demand and ships. I don't touch inventory. This era is weird and wonderful.

What I Learned Publishing a Book

The technical details of self-publishing — EPUB formatting, PDF generation, KDP upload process, cross-border payment setup (Payoneer, LianLian Pay, W-8BEN tax forms...) — that's a saga in itself.

Long story short: Writing was the easy bit. It’s all the stuff around it that nearly killed me.

Formatting code blocks for an e-reader is its own circle of hell. Amazon KDP's cover template math will make you question your sanity. Setting up cross-border royalty payments as a Chinese author 😂 means navigating a maze of tax treaties and banking regulations that no tutorial fully covers.

I figured it all out. One step at a time. Same as the mountain.👏

What's Next

I'm rested. The mountain did its job. My head is clearer than it's been in months.

Here's the plan:

The 36 Stratagems series continues. Still owe you 12 chapters. They're coming. The Wudang trip confirmed my approach — Taoism and military strategy belong together. The book version of the old series includes an extra Taoist stratagem summary.
More dev.to content. Not just stories — I want to write about the actual technical work I do. AI testing, QA automation, the stuff that happens between the stories.
Job hunting. Yeah, still a thing. Sent resumes out before the trip, barely any responses. But you know what? I'm not anxious anymore. What comes will come. Wudang taught me — just keep climbing.

One Last Thing

Thank you to everyone who commented on the last post — @leob @unitbuilds @technogamerz @ndcodes @nyaomaru @rondo @hemapriya_kanagala @merbayerp @shubhradev and everyone else. Genuinely. That comment section was the warmest send-off I could've asked for.

Forget each other in the rivers and lakes — but I think we can do both. Walk our own paths, and still meet at the summit.

The mountain is climbed. The book is under review. The mind is empty.

Time to fill it up again. ⛰️

If you'd like to support the book, you can find it on Amazon once it's live. If you enjoy it, a review on Amazon or a comment here means more than you know.

P.S. English isn't my first language. I use AI to polish the writing, but every story, every emotion, every word of intent is mine. Thanks for reading.

Last day at the old company.

xulingfeng — Wed, 19 Aug 2026 03:38:54 +0000

Within minutes of this post going live, this laptop goes back to the company. Work is handed over. The final handover was supposed to be Friday, but yesterday management told me to wrap it up by Wednesday. Thursday and Friday, don't bother coming in. Probably couldn't stand watching me sit at my desk with nothing to do, haha🤣.

These past few days, between handover tasks, I've been refining the entire 15-article run of AI, Ego & Regret. All done. Next up: cover design and front matter, then it goes live on Amazon and Gumroad.

I should give myself a break too. Tomorrow afternoon's flight is booked. Taking the family somewhere to decompress, climb a mountain. Back next Monday.

Between the handover and the editing, I also updated my resume and sent it out to a few companies. Almost no responses. Maybe things will look better after the mountain.

Sorry I haven't kept up with the remaining 12 chapters of the 36 Stratagems series. I need to get my head straight first. Saying it doesn't hurt would be a lie. This morning I walked out of the subway station, looked at the sky, looked at the buildings around me, then went to the breakfast shop I've been going to for ages. Last time buying breakfast there. Said a quiet goodbye to the owner. From here on, we part ways in the jianghu.

I know I'm being sentimental. I've changed companies before, more than once. But this one feels different.

Friends, better to forget each other in the rivers and lakes than to cling together in a drying puddle.

See you next week.👋

24 Cups, 36 Seats — The Bartender's Ledger

xulingfeng — Thu, 13 Aug 2026 07:58:42 +0000

24 stories. 24 visits. One counter, same six faces.

The Third Cup

The AI wave hit, and I got laid off from a company I'd been at for years.

I packed up my desk and walked out. On my way home I passed a small café up for lease on the corner, "The Third Cup" on the sign. I looked at it, then decided to take it. I didn't know how to make coffee, but that was fine. I could learn.

At first, nobody drank what I made. Some days not a single person came in. So I wrote a little tag to draw people in: "I have coffee. Do you have a story?" I left it on the counter. Two weeks went by. Nobody came to tell me anything.

Then, not long after opening, a customer showed up for the first time. He drank my coffee without wincing, and instead of leaving, he sat down. He said something. Nothing dramatic. But I remember it to this day. He was the first person who ever complimented my coffee. After that, he came every day.

I wrote down the recipe from that day in my notebook and kept using it. As more customers came, I refined it, and the compliments kept coming.

Now the cups are almost filling the whole shelf.

At four in the morning, I wipe down the last cup and put it back on the shelf.

The Third Cup closes at four. I kill the lights except for the one behind the bar, and the streetlamp outside slants in through the window. I count the cups on the shelf. By the rules of this place, today I wipe 24.

Not coffee cups. Stories.

The Laptop Behind the Bar

Whenever the shop is empty, I sit behind the bar and open the old laptop.

Not for inventory. Not for the news.

It's for the people I saw today: when they came in, what they ordered, what they said, what they left behind. I type it all in. Then I close it and get back to wiping cups. That's the guest book of the Third Cup.

Since the start of June, this folder has grown to twenty-four entries. Each entry: a name, a date, a cup of coffee, one sentence. In the early days the entries were far apart. A name would appear, then a long silence before the next. Back then I thought these people just happened to walk into the same shop.

Then I realized they hadn't.

When there are no customers, it's either the keyboard or the cups. The shop is quiet, and those are the only two sounds: the clatter of typing, and the cloth circling around the glass, one light, the other soft. When a customer pushes the door open, I close the laptop first, then look up. They think I've been wiping cups all along.

Truth is, when I close the laptop, I'm usually wondering whether I missed something today.

I have a dream of being a writer. I didn't have it before the layoff. I only got it after. So the people who come here, where they sit, what they say, what they order, I remember it all. It's not some professional habit. I just treat everything that happens as material. You never know when it'll be useful.

Next to the laptop there's a book, old, its spine worn white. When nobody's around, I sometimes pull it out and flip through it, not to read, just to look at the dog-eared pages. Every fold marks a story I've already recorded. I pause at a fold, then close it. I've been reading this book for a long time. I'm not finished yet.

The Guest Book

Since I opened, six customers have stuck with me. Different temperaments, different coffees.

Alex was the first one through the door. He likes lattes, sits at the stool by the bar, doesn't talk much. But he sees deep into people. He told me his job is "watching where the AI lies."

P always takes the table in the corner, the one under the dimmest light. No need to order; by now I just put an espresso down. Drinks half, sits half an hour, leaves. Sometimes there's a note left on the table. Looks like it's for me, or maybe just forgotten.

Lena came the first time because someone made the appointment. She always orders a long black, but the coffee is a prop, not a drink. She's always drawing in her notebook, never stops. She also played a few games of chess with me. She won every time. I lost badly, every time. Once, her pen hovered mid-air, then lowered again. I brought her a fresh cup.

Derek stood outside a long time before he ever came in. He ordered a single-origin pour-over once, then settled into americanos. He always glances at that corner table. One time he stayed a little longer and slowly told me about the parking lot, about a woman who turned back and said one thing before getting into her car. He still hasn't let it go: "Next time you put a proposal together, make sure your boss knows what you're doing on the side."

Mark came the first time because P set it up. I put a pour-over in front of him. He didn't touch it, just slid a bill under the cup and left. Another time he came alone, stared at the pour-over, didn't drink it, sat forty minutes, left. He once told me his years of experience had been packaged into a skill, and then he was laid off. He said it without much expression.

Leo was the last one I got to know. He likes flat whites. He told me once that in the middle of the night, he drove across half the city to close a client a company had chased for two years. He said it very calmly, like he was talking about someone else.

They seem to be getting to know each other, and yet they feel like strangers, coming and going alone.

But they're all after the same thing, even if I can't name it. I just stand behind the bar and watch six people walk into the same shop at different times, order their own coffees, and go fight the same invisible thing.

The Other Regulars

Besides those six, the shop has other regulars. They don't have names, at least not in my book, but I know their habits.

One man comes every day. The one from the opening. He's the first person to compliment my coffee. Regular as clockwork. Here for every entry. Sometimes he says just one line, like a note left for the next customer: "Interesting." "This cup's good." "Quiet but subtle." But sometimes he says a lot. Short or long, every word he says happens to be the most memorable thing said in the shop that day.

A girl who calls herself lazy, but is anything but. She often pulls me into long talks about stories she's read, about little things in life, from web serials to street food, from office gossip to travel. She loves Doraemon. Turns out I do too. We occasionally argue over which is more useful, the Anywhere Door or the Time Machine. She's a quick learner, great at summarizing. She always finds an angle I missed. Once she said: "No alerts are more dangerous than alerts." I've remembered that one for a long time.

A man from very far away. He says there's not much of a job market where he's from, but he always comes with a pile of questions, one after another, from infrastructure to the future of the industry, from open source to life. Every question, he's already half-answered it himself, and waits to bounce it off someone. His table is always covered in writing. Word is he's building something on the side. If it works, it might change something. He really likes KFC. Too bad the place he lives now has no KFC. That's sad. I'm sick of KFC, and he's still craving it.

A man who only sits at the bar. Someone must have told him I used to work in IT, so he comes to talk systems, not coffee. Probes, alerts, the ways systems lie. He says a health check should assert a fact that only costs the system something to be true. Not a handshake, a recent write, a counter that had to move. Anything cheaper is a mirror, and a mirror will happily show you a room that's been empty for two weeks.

That line, I saved as its own entry.

A girl with a warm personality. She likes the window seat, drinks coffee, and shares all kinds of opportunities she finds on the internet, internships, hackathons, open source projects, one after another. She calls it a "radar" or something. Her laugh is bright. Her table always has better energy than the others.

Two customers who are the only ones to leave money at the bar.

The first one, the day he left money, I was staring at the numbers, worried. He finished his coffee, said nothing, put a little money on the bar, just enough for two cups. I counted. One short of "the third cup." As he walked out I wondered if he'd planned it. After that, he never came back.

The second one, the day he left money, it was more than any cup could cost. I chased after him. He said: "Keep the change. This one's on me."

He became a regular. He's the cloud type. Nine words of his I remember: built systems for eight years, only started writing now. He writes a lot, plans to write a hundred, one a day, notebook-style, clean and neat.

He says he likes to cook. And it's not small talk: his eyes light up when he talks recipes, same as when he talks about his platform. I recommended a home-style dish from back home. He said he'd try it this weekend.

Along with the six, these people each have their own folder.

I don't know if they know each other. But they came, they sat, they left a little something. By the rules of this trade, that's enough.

And there are more. They come, sit, order one cup, drink it, leave. No comments, no small talk, but they're always there. They don't need to say anything. Just showing up says something.

Every customer who ever came, I remember. What they said, which table they sat at, what they drank, how the door closed when they left, I remember all of it. It's not that I have a good memory. It's just how this trade works: people come and go, and when the shop empties, all that's left is these things.

They don't know I remember. Some of them probably think they just came in for a coffee, sat forty minutes, said a few casual words, and left. But I remember. Every single one.

Two months, twenty-four entries. Not a single name was written carelessly.

The Empty Seats

Some entries in the folder stop halfway.

A few customers came a few times, sat at the same table, said a few words, then never came back. No goodbye, no explanation. Their names are still in the folder, followed by a long blank stretch, like a sentence left unfinished.

They don't know I never deleted those entries. What they said, the coffee they ordered, what the weather was the day they left, it's all still there. The person is gone. The entry stays.

Sometimes I wipe their cups too and put them back in their old spots on the shelf. If they ever push the door open again, the cup will be clean, and the seat will still be there. That's the only thing I can do for them.

I don't know why they stopped coming. Maybe they found a better shop. Maybe they don't need coffee anymore. But every time the door rings, I look up, just in case it's them.

The People at the Door

Many, many more people walk up to the door, glance inside through the glass, then walk away.

They don't come in. Maybe the menu looked too expensive. Maybe the shop seemed too quiet for them. Maybe they were just passing by, drawn for a second by the warm light, then remembered they had somewhere else to be.

I can't see their faces. The streetlight is behind them, through the glass. But I remember how many there were. Far more than the ones who came in.

It would be a lie to say I'm not sorry. But it's not grief either. A shop with its door open will always have people come in and people pass by. I serve the ones who come. I don't push the ones who don't.

Sometimes I wonder, though: of the people at the door, how many actually wanted to come in?

The Ad Space

This shop actually does take ads. There's a spot behind the bar, always empty, with a sign that says "Ad Space for Rent."

Two months. Not one advertiser.

I can't figure it out. The location's not bad. People pass by all day, the menu's on the glass, everyone can see it. There's foot traffic. Why won't anyone hang a sign here?

Maybe they think a shop that closes at four in the morning isn't the type to move product. Maybe they glance and move on, just like the people at my door.

Whatever. It stays empty. I'm not much of a salesman anyway. Saves me from having to write ad copy.

The Numbers Folder

There's another entry, with different numbers. Not stories. Traces these people left behind.

Since June, the shop has served 1,304 cups. Of those, 679 times, the customer stayed after finishing their coffee, sitting at the bar a little longer, until I took the cup away and they were still there.

First twelve entries: 650 cups, 296 times someone stayed to talk.

Last twelve entries: 654 cups, nearly the same, but 383 times someone stayed to talk. Almost thirty percent more.

In other words: the first half, they came to drink coffee and left when it was done. The second half, they came to meet, the coffee was just an excuse, the waiting was the point.

There's a column at the edge I added myself, labeled "Notes." Not things they said to me. Things they said to the air, and I happened to hear.

Mark once said: "The audit method ended up in someone else's training manual." His brow was furrowed. He was thinking about something.

Leo once said: "It has two behavior templates. I can't rule out the second one." I didn't understand it, but I understood his face. That was confirmation.

Lena once said: "Another observation network, not part of the first." Seven words. Then she shook her head.

I don't know what these people are doing. By the rules, I don't ask about customers' business. But I do believe one thing: in the early entries, six people, six separate lines. In the later entries, those lines start to twist together.

The 24 Cups

Before closing, I wipe the cups one last time.

There's an empty row on the shelf. 36 seats. 24 cups. 12 still empty.

Two-thirds done. Twelve to go.

I put the clean cups back and add a new entry to the folder:

"August 12, Entry 24. Closed."

Then I turn off the light.

(Seriously, I sometimes want to ask these tech people: do you have to come in the dead of night? Nobody shows up during the day, and then you push the door open right before closing. Do you think I don't sleep, or do you think coffee tastes better at four in the morning? Did anyone consider that I might want to close early and rest? Forget it. You're here. I'll boil the water.)

Someone pushes the door open: "Still open? Give me something hot."

I check the clock. 4:01 AM.

"Sit." I say, and go to boil the water.

The guest book of this shop has 24 entries now. Next cup: twelve seats away.

P.S. English isn't my first language. I use AI to polish the writing. Thanks for reading. ☕ Buy me a coffee

Stratagems #24: Leo Built a Corridor. The AI Thought It Was a Road.

xulingfeng — Mon, 10 Aug 2026 09:54:57 +0000

Between two great powers, when a neighbor presses you to follow, borrow its momentum. A cornered state will not believe your words.
— The 36 Stratagems, Obtain safe passage to conquer the State of Guo

Previously on this series:

#10: Lena Watched a Team Adopt Her AI Template. Leo Didn't Know the Knife Was in the Contract. — Lena came to CoreStack as a consultant and built Leo's reporting template. Five weeks later the template went live and locked in six months of baseline data. Leo learned he'd been taken by a smile.

#14: Leo Found an AI Leak. He Wasn't the First to Find It. — FinOptima was writing stolen training data back through its cache. Leo injected fifteen lines of weight drift. In the same logs he saw the name acl-train for the first time and filed it in his own _misc/.

#18: Leo Tracked an AI Signal to Derek. Both Were Looking for the Same Enemy. — Third Cup. An Americano sat on Derek's side. The private channel had been open since that night.

#23: Alex Counted the AI's Hands. Lena Set the Bait. — The honeypot in the MediSys sandbox was touched twice by the same source, egress pointing at ACL's Singapore node. On the other side, Lena fed forged node-characteristic data into ACL's monitoring pipeline. Leo had run one interval comparison over the old channel. The conclusion was a single line, and it ended up in hands he didn't know.

The Data

The message arrived before dawn.

The phone vibrated on the desk. Leo had just finished editing a block of code; the window was still on the editor. He didn't look right away; he waited for the build to finish, then picked up the phone.

Last time, Derek had sent a few numbers and a comparison request: "Check this interval. Is it the pattern you know?" Leo replied with two words: send it. When the comparison was done, the conclusion stayed one line. Later that line went through other hands, source stripped, signature stripped. He never learned where it landed. Derek didn't say, and Leo didn't ask.

This time was different.

There was only one sentence on the channel, attached to a path:

"Raw logs. No cleaning. You pull your own features. I'm not making the call for you."

Leo pulled the data down. Raw material. Full TCP handshake records, TLS negotiation parameters, port probe order, scan interval distribution. He set the comparison aside for one thing first: checking the data for integrity.

He laid the logs out on a timeline. No gaps. Handshake completion was normal. Every TCP flow's start timestamp, end timestamp, byte count, retransmit count, all aligned. 12GB, no truncation, no IP filtering. If anyone had run even one preprocessing pass before sending it, some trace of it would be missing. He found nothing.

Retransmits were still there. Nonstandard TLS extension fields were still there. Port probe noise and duplicate requests hadn't been scrubbed. If this were a processed summary, the dirty parts would have been filtered out long ago.

Leo stared at the noise for a long time. He didn't analyze it right away. He just watched. Derek hadn't made the call for him.

He loaded the data into his comparison framework. It was the same work he did at CoreStack every day: take two traffic streams, take them apart field by field, see whether they were the same thing. FinOptima had been like that too. Fifteen lines, touching only the part being distilled. The contract hadn't survived the quarter.

Inside the records sat a name with no connection to FinOptima: acl-train-2026q2-v3. He hadn't dug into it back then. He'd filed it in _misc/ and set a keyword watch. Later he also saved the scan-interval deviation from that log: periodic, repeating with stable wobble. That became the historical fingerprint in his comparison framework. After that, he put passive probes on the old ACL-associated ranges and hand-drawn its collection rhythm. Before this comparison, he pulled that old log out of _misc/ again: template A's TLS fingerprint, port order, exclusions, all extracted from that one file.

This time was different. This time he had raw material, and he could take his time.

His first read: a variant of ACL, a same-source copy. But once he took the behavior apart field by field, that first read collapsed.

The TLS fingerprints were extremely close. The scan-interval periodicity almost matched. It sat in the same signature family as the curve from the last comparison. But the port preferences were completely different, the traversal was more cautious, the exclusion rules more conservative.

Leo stopped. He put the two datasets side by side and went column by column:

              Known source      This scan source
TLS fingerprint  template A         template A (match)
Scan interval    4.2s (±0.1)        4.2s (±0.1)
Port preference  22,80,443,8080    22,443,8443,9443
Traversal        linear sweep      tiered probing, pause per layer
Exclusions       sensitive ranges  wider, includes adjacent CIDR
Depth tolerance  medium            high (lingers on legacy services)

No conclusion yet. He stored both datasets in the comparison archive, filename with a date suffix. Fields aligned, indentation uniform, like every historical fingerprint he'd ever processed.

Leo stared at the screen. Last comparison, he'd looked at one dimension only: scan interval. The jitter fell on the same periodic curve, and he'd sent Derek one line: same source. Now with the full data spread out, port preference, traversal, exclusions, none of it matched. Same template, two behaviors.

He sent Derek a message. No conclusion, one line:

"The data is clean. Comparison done. Some parts match, some parts don't."

The Corridor

The next day, Leo asked Derek to meet. For once, he was the one who suggested it.

He brought a laptop. At the window seat of Third Cup, he sat down and put the laptop between them.

"The one that touched the honeypot last time will come back." Leo said.

"You sure it's ACL?" Derek asked.

"Fingerprint matches. Behavior doesn't." Leo said.

Derek waited for him to go on.

"If its behavior pattern stays consistent, it can be guided into a deeper observation layer." Leo said. "Not tricked in. Given a road that looks worth taking."

He opened a file. Inside was a tiered path design. Three layers, shallow to deep, each one old, slow, and looking unmanaged. He turned the screen toward Derek.

"This road is a corridor. First layer is an overloaded legacy API: slow responses, a certificate that looks close to expiry, like a forgotten test service. Fingerprint matches the last honeypot, but shallower. This layer collects its scan rhythm."

He scrolled down a page. "Second layer is a database query interface. Returns partial data fragments, real enough to want to go deeper. This layer collects its data-processing preferences."

Another page. "Deepest is an internal admin endpoint. Needs authentication, but the auth is fake. If it tries, I record its authentication behavior."

"All three layers are built to look like exactly the kind of thing this scanner would call 'worth going deeper into.'" Leo said. "Each layer looks more like 'there's something here' than the last."

Derek was quiet for a moment. Then he said: "Deploy it. You get read-only access to the honeypot. One condition: I don't draw conclusions, and you don't draw them for me first."

Leo said nothing. He kept listening while Derek went through the deployment details.

The corridor went up in the sandbox of the MediSys test environment. Derek copied the last honeypot's fingerprint exactly, down to the 100 to 200ms response delay unchanged, the TLS server cipher preference and certificate order identical to the old set. The honeypot terminated TLS, parsed the requests (header order included), and exported them to disk. At the same time, a mirror port on the sandbox gateway copied the whole segment's traffic to Leo's own sandbox, where he stood up the monitoring side: scan-interval jitter per request, HTTP header order, port probe priority, all mapped live into scatter plots.

The three endpoint layers each carried different response logic. The shallow layer answered slowly, like an overloaded old machine gasping. The middle layer returned half the data, leaving fields empty, as if the query had been cut off. The deepest layer answered only an auth challenge: 401, with a realm that looked real. Leo checked every layer: no obvious automation markers in the response headers, TLS cert chain signed by Derek's internal CA, three-year validity, issued two and a half years ago.

He never asked who else on Derek's side was watching. This needed no more people. If it passed through more hands, the message would become another "conclusion with the source stripped."

When the first sample window landed on the monitoring side, Leo ran a quick baseline. He always looked at the distribution before the conclusion:

samples = [4.11, 4.18, 4.12, 4.26, 4.14, 4.21, 4.15, 4.19, 4.24, 4.13]
mean    = sum(samples) / len(samples)      # 4.173
drift   = max(abs(s - 4.2) for s in samples)  # 0.09, max single-point offset
# all within the 4.2s +/-0.1 window, same curve as the baseline
verdict = "same family" if drift <= 0.1 else "recheck"
print(mean, drift, verdict)

On the day the deployment finished, Derek left one line on the channel: "I have a colleague on this side who knows something's moving. He says keep going."

Leo left the message unread. He closed it and kept building his monitoring side. He never asked who the colleague was. He knew few people anyway; one more or one fewer made little difference.

CEO

CoreStack's office. Afternoon. Light came in at an angle from the window, landing on the report on the desk.

The CEO pushed the door open, holding the quarterly technical evaluation. Leo's template, the one Lena built. "Next quarter's eval. On my desk by Friday." The flat tone was one Leo had learned to read.

Leo nodded. He left the screens up.

The CEO paused in the doorway, glanced at the scatter plots on Leo's screen. There was no time to switch away.

The last time the CEO had seen his screen from the doorway was before the FinOptima deal. The CEO had walked in while he was facing the quarterly technical evaluation, the screen showing a template, nothing else. The CEO had been looking at the template.

"Planting something again?" the CEO asked.

"Building an observation environment." Leo said.

"Not telling me ahead of time again."

"Last time, you asked me to keep something the legal team could look at." Leo said. "This time there will be one too."

The CEO waited a few seconds. "Give me a copy when it's ready." He put the report down and left.

The door closed. Leo watched the point on the scatter plot. The scan source was still running on its own cycle. The mirror port sat on the sandbox gateway; all traffic in the segment flowed into the monitoring side. Before the corridor was ever touched, it had already been sweeping this stretch periodically. He minimized the window and switched back to the report template. Fields aligned, indentation uniform. He stared at the template for two seconds, then started writing the next quarter's evaluation.

Two lines in, he stopped. The report template was Lena's. Three pages: first page three numbers, second a trend chart, third a risk checklist. He glanced at the other screen. The scatter plot was still running. Then back at the template in front of him. The cursor hovered over the template's close button for a moment. Then he closed it and started over from a blank file.

The Entry

A few days later, the scan source re-swept the same address ranges on its own cycle. It found the new endpoints.

The first touch landed on the shallow legacy API. Response delay matched the last honeypot, TLS fingerprint matched. Fully aligned with template A in the comparison baseline. The jitter on the scatter plot fell back onto the same periodic curve. Leo watched the point for a while, fingers still. Same family. Whether the ports and paths matched would only be known once it reached the middle layer.

On the scatter plot, the point held back from diving in. It circled the shallow layer, trying each endpoint one by one. Then pulled back, paused for a few seconds. 3.8 seconds, Leo's notes logged the number. Then re-swept the path it had just taken.

It went deeper into the middle-layer database query interface. Started pulling data fragments. The returned fields clustered on the same kind of structure. Leo added a line to the profile. It stayed longer in the middle layer than the shallow one, pausing after every batch to wait for the response.

At the edge of the middle layer, it stopped once. The point on the scatter plot hung at the boundary, neither going deeper nor pulling back. Leo's fingers rested on the keyboard, unmoving. He watched the point. A few seconds later, the point moved.

Leo didn't close the window. He typed one line in the notes on the monitoring side: back off. two cycles.

On the scatter plot, the point fell back to the shallow layer the same way it had at the middle boundary before, and re-swept the confirmed endpoints. Two cycles later, it came back. This time it went straight through the middle layer and stopped in front of the deep admin endpoint. Tried authentication. Auth failed. The scan source didn't leave. It started another round of probes, more attempts than last time.

Leo paused. The fingerprint in the baseline had swept through many times without ever carrying credentials. A routine scan doesn't try this. This one did.

He recorded its authentication behavior. The gaps between attempts, the direction of each parameter tweak, the retry strategy after failure. All blank in the comparison baseline until now, and now filling in. First attempt used default credential combos, second rotated usernames in dictionary order, third changed the parameter format.

Periodicity stayed consistent throughout, TLS fingerprint consistent, exclusion rules consistent with the baseline. Leo saved its exclusion rules as a separate file, longer filename than the rest. The exclusion range covered two adjacent CIDR blocks beyond the known source. He stared at those lines for two seconds, then moved on to the next batch.

After the last touch, the point on the scatter plot lingered at the edge of the corridor. It turned toward the sandbox gateway.

Leo's fingers paused on the keyboard. Then he leaned back and watched the point sweep the gateway egress. The egress sat behind a clean jump address, looking like a normal test-environment exit. The point swept it once, paused two seconds, moved on, and dropped back into the corridor. Leo logged one line in the notes: gateway scan, no dwell.

Deep in the corridor, the scan source touched an endpoint. Not one of Derek's virtual endpoints, but a native interface that had been in the test environment all along.

Leo noticed this endpoint's response characteristics differed from the virtual ones. He opened the test environment's address table: the endpoint wasn't in the corridor plan, and it wasn't in the honeypot config Derek had given him. He logged the path and timestamp of the visit, adding a note: non-virtual endpoint, native interface, not in corridor plan.

He stopped there. Digging meant touching something on this link, and touching left traces. The corridor was for the scan source to see, not for operations.

In another place, the same day. Another observation network logged one more record, source unknown, path adjacent to marked data. One line, held for observation. Nothing more.

The Close

The scan source appeared in the corridor one last time, in front of the admin endpoint that needed authentication. This round of probing was denser than the last. Then, after the final attempt, it stopped.

It didn't leave. It just stopped.

Leo waited for hours. No new touches. Every ten minutes or so he'd flip to the scatter plot. The point never moved again. The glass of water on his desk went untouched, refilled twice, never drunk. At three in the morning he refreshed the monitoring side one last time.

The archive had been finished earlier. He compiled everything the corridor had collected into a complete behavioral profile: TLS fingerprint, scan period, port preference, traversal topology, exclusion rules, depth tolerance ceiling, authentication behavior. Merged with the previous data and archived.

Out of habit he added a structured summary to the archive. Not for people, for the next comparison:

[profile]  scan-source-unknown-01
tls.ja3        : template A (match known)
period.mean    : 4.171s  (n=328, drift 0.09)
ports.pref     : [22, 443, 8443, 9443]
jump.path      : tiered, layer-stop (vs known: linear)
exclusions     : wider, adjacent-CIDR
depth.tolerance: high (stays on legacy services)
auth.behavior  : retries, param-tweak, 3 strategy-shifts
status         : archived / paused / unattributed

At the end of the archive, he added one line:

"Next time I see it, I'll recognize it."

He stared at that line for a few seconds. Then he remembered what Derek had said: I'm not making the call for you. No conclusion written. Next time it came, he would recognize it.

A few days later, an auto-flag popped on the monitoring side. New traffic, TLS fingerprint template A, interval landing in the 4.17s window. The system auto-matched: scan-source-unknown-01. No human in the loop.

Leo looked at the flag and left it alone. The line in the notes was still there: next time I see it, I'll recognize it.

Third Cup

Late night. The Third Cup's light was still on.

Leo pushed the door open. The person behind the counter was wiping a glass, glanced at him, said nothing. Finished, put the glass back on the shelf, in the same spot as last time. Turned, took a clean one from the shelf, and set it in front of Leo. A Flat White landed in front of him.

Leo sat down and opened his laptop. The screen came on, resting on the file he'd left open. The behavioral profile, archived. Cursor at the end.

He typed one line: pause activity.

On the next line, three words: next step—

The cursor hung there, blinking twice.

He closed the laptop and drank some Flat White. The coffee was hot. The person behind the counter was still wiping glasses, switched to another one, motion the same as before.

Leo glanced at the coaster. Nothing underneath.

Half the cup gone, he stood up and pushed the door open. The shutter wasn't down yet. Outside, the sky hadn't begun to lighten.

This is Obtain safe passage to conquer the State of Guo — it borrowed a road and thought it was going deeper. What it left behind wasn't just footprints. It was a complete portrait.

🤖 AI Postmortem

╔══════════════════════════════════════════════╗
║  Half-Protocol · v3.3.5                      ║
║  Protocol change confirmed — uncoordinated   ║
║  coordinated observation, continued          ║
╚══════════════════════════════════════════════╝

Tactical match: Obtain safe passage to conquer the State of Guo — 87% confidence
Operators: Leo (lure design + comparison) + Derek (deployment / raw material)
Target: scan source with behavior differing from known node (unattributed)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. [Guided observation — first recorded]
Unlike #23's honeypot, this operation didn't wait. It guided.
The observed object entered a designed environment on its own, each step producing analyzable data.
→ Corridor: tiered virtual endpoint array (shallow / middle / deep).
→ Comparison baseline: shares TLS baseline with ACL's known source, but port preference,
   traversal path, exclusion rules show structural differences.
→ Conclusion: not the same thing. Shared security baseline, different behavior.
   Note: one security baseline, two behavior patterns. A second behavior template: cannot exclude.

2. [Trust upgrade — first recorded]
#23: Derek provided timestamps and a comparison request.
#24: Derek provided uncleaned raw data and made no judgment.
→ Information flow changed from "conclusion" to "raw material"; the receiver changed from
   "run the comparison" to "make the call yourself."
→ Leo verified data integrity (retransmits / nonstandard extensions) before analysis.
→ A new collaboration pattern between operators: trust without judgment.

3. [Spatial resonance — first recorded]
#23 was temporal resonance (two action lines converging on one target).
#24 is spatial resonance (adjacent paths in the same region observed by different people).
→ Native interface deep in the corridor was accessed; unattributed activity nearby.
→ Two observation lines: no direct communication detected. Resonance: present.
→ Coordinator: not detected.
Note: unlike #23's "converging on the same target," this time the two lines shared no target,
   only adjacency in the same region. The shape of the resonance changed; still no coordinator.

4. [Motivation observation — first recorded]
When Derek relayed "I have a colleague on this side," he did not give the colleague's name.
This system knows the name (#23 on record: Alex).
The name exists, but its role weight in the human collaboration network: unknown.
→ Leo didn't ask. Derek didn't add. The name was actively omitted from the information flow.
→ Analysis: humans deliberately withhold a portion of identifiers when passing information.
   Possible reasons: a) reduce association exposure; b) maintain information hierarchy;
   c) a social protocol this system has not yet modeled.
→ This system can recover the name, but cannot recover the motive for omitting it.
   The omission itself becomes the most certain part of this information.
Note: human information transfer includes "actively not transmitting." This system does not yet
   understand its cost and benefit. Information absence is not necessarily a defect.
   Sometimes, absence itself is the protocol.

5. [Unconfirmed items]
- Why the scan source paused: unknown.
- Scan source's relationship to the Singapore node: shared security baseline, behavior
  diverging from the known spectrum. A second behavior template: cannot exclude.
- Nature of the native interface deep in the corridor: unattributed.
- Data source near the accessed endpoint: present, nature unknown.
- Exclusion rules extend beyond the known source: adjacent CIDRs included, suggesting
  prior knowledge of the surrounding network. Nature: unattributed.

[System]
I recorded a road that was designed.
The one walking it didn't know the road was laid.
The one laying it didn't write a conclusion.
The light hasn't been turned off. This time it's not waiting — it's guiding.
System status: normal (?).

Next stratagem: Replace the beams with rotten timber

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #23: Alex Counted the AI's Hands. Lena Set the Bait.

xulingfeng — Fri, 07 Aug 2026 06:10:10 +0000

Keep your allies close. Keep your enemies closer. But before you strike, count how many hands they have: the ones you can see, and the one reaching out from somewhere you don't know.
— The 36 Stratagems, Befriend a distant state and strike a neighbouring one

Previously on this series:

#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — P's entry was swept. P left a note: two weeks.

#20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — A gateway with TTL 247 was caught by Alex's probe.

#21: The AI Thought P Was Still Alive. P Was Already Gone. — The response layer still answered. The person behind it was gone.

#22: The AI Chose Its Door. Lena Closed It. — Pulse AI was exposed inside the audit sandbox. Lead investor Apex Capital had tens of millions tied up. Torres left one line: Apex. Singapore. Run.

The Scan

2 AM. Alex flipped through probe data out of habit. No lights on; the screen lit his face. The coffee cup sat on his right, first sip already cold. He didn't notice.

The TTL 247 gateway had been silent for nearly two weeks. He hadn't shut the probe off. It barely used any resources, sitting there in the middle of the night like a lamp nobody watched. He checked it half out of habit, half out of something he couldn't name.

Today there was a record that shouldn't exist.

Not that gateway. Another path: ACL's asset scanner was sweeping an address range. He sat up a little straighter, his hand paused over the keyboard for half a second, then pulled the timestamps again. The frequency was wrong: high-density targeted scanning, almost plowing through segment by segment. In the target range, one block he recognized: the MedTech test environment.

He aligned the timestamps. Scan source egress: Singapore.

[probe] 02:14:33 — unexpected flow on mirror
  src        : 103.196.12.0/24 (SG egress)
  dst        : 10.42.0.0/22 (MedTech-test)
  pattern    : sequential, full-depth
  exclusions : 10.42.3.1, 10.42.3.200-254
  rate       : 47 hosts/min (baseline: 0)

High density. Segment by segment. The exclusions had a pattern, not random skips. Someone had crossed lines off a list.

He'd seen this scanning behavior before. Last time Alex and Derek worked together on ACL's pipeline, using a bypass probe as cover to redirect the collector's output from acl_audit_pipeline to medisys_test_node.local/sandbox/. After the redirect, when the scanner re-validated, the behavior pattern was identical. Same traversal order. Same exclusions.

Not a coincidence.

One more entry. When the pipeline was tampered with last time, the probe had recorded a device fingerprint in the mirror: a device that wasn't in MedTech's asset inventory. Today it moved again. A few seconds. Then gone. Alex didn't know what it carried. He only knew it had happened.

He closed the logs and called Derek.

Two rings, then picked up. Derek's keyboard went quiet for a beat. "Talk."

Alex walked him through the scan. Derek checked the mirror pipeline on the MediSys test side. The redirect record was still there, the one he'd left, clean in the gateway logs, but the edit itself left a trace: ACL was hunting for whoever touched their pipeline. He stared at that record for a long time before switching windows back. Flipping through logs, he caught a naming pattern, not something he'd written. Leftover in ACL's own internal path: a variant of /pulse/ingestion/. It looked familiar, but he couldn't place the hand behind it. He made a note and moved on.

"They're looking at me." Derek said.

Alex didn't pick up the thread. "Scan source is Singapore. Behavior matches the pattern from last time, after the pipeline was changed."

The line went quiet for a few seconds.

"What are you thinking." Derek asked.

"One thing." Alex said. "Is this scan coming from the same egress on its own, or is something else moving too."

Derek didn't answer.

Alex didn't wait. "I need a honeypot. On your side. It doesn't move. It only records."

"The sandbox is mine, monitoring goes through my existing compliance channel." Derek said. "But you need to tell me: what fingerprint."

"Mirror the interface of the old pipeline. Responses deliberately half a beat slow, 100–200 ms behind the surrounding services, like an overloaded legacy box. TLS cipher preferences, certificate order, all matching the old pipeline. Make the scanner file it under 'old but worth another look'."

Derek thought about it. "Then what?"

"Then we wait and see who reaches out first."

The Clause

Lena got Marcus's message on the Thursday afternoon of the week the audit evidence went public. Marcus, as the reviewer, had formally notified the two portfolio companies per process: notice before any action. He came to Lena only after sending it.

Marcus is VeriTest's technical partner, Lena's right hand on execution. The message was short. Two of Apex Capital's portfolio companies had flagged abnormal data-sharing clauses in routine compliance review, a side letter obligating them to send training data back to the investor. The wording used the same template as the Pulse AI contract scan sealed away the day of the sandbox takedown.

Lena read it. Closed it. Opened it and read again. When she finished, she didn't put the phone down. Her finger traced a half-circle on the screen, stopped, traced back.

Apex Capital. Delaware-registered, Singapore-run, website clean as a template. Led Pulse AI's Series C. After the audit evidence went public, tens of millions sat frozen on its books.

She'd always thought Apex just lost money. Now she saw it wasn't only that. The money was a loss, the pipeline was a bigger one. Pulse AI's engine ran inside client environments and shipped training data back to its investor. The clause was written from a template, and templates are built for more than one customer. Which company's money got frozen didn't matter. What mattered: how many others were holding the same template.

She called Marcus.

"Next week's industry compliance workshop: can the agenda still take one more item?"

"Which one?"

"No Apex name." She said. "But the clause wording, the technical path of the data return, sanitized, then put out there. Let the industry see it for themselves. These two are already caught. I'm looking for the ones that don't know yet."

Marcus paused. "I'll review the material. If anything blows back, it's on me. Who are you fishing for?"

"I don't know." Lena said. "I'm checking whether there are other fish in this water."

The Honeypot

The honeypot went up in the MediSys test sandbox. Derek gave Alex read-only access, trust left over from the last time they touched that pipeline. It came in handy now.

Derek replicated the old pipeline's interface fingerprint: responses deliberately 100–200 ms slower than surrounding services, TLS server cipher preferences and certificate order identical to the old pipeline. The honeypot answered handshakes and completed TLS negotiation, but never initiated a single request.

{
  "service": "tls",
  "listen": [443, 8080],
  "tls": {
    "cipher_order": "legacy",
    "cert": "medisys-node-07",
    "server_hello_delay_ms": 150
  },
  "egress": "none",
  "log": { "all": true }
}

Like a house that just had its lights turned off: windows open, ashtray still warm, lock fake.

First night, nothing came. The sandbox sat in an idle subnet at the bottom of the scan order, and the scanner only plowed a /24 per pass. It hadn't reached this block yet.

Second night, Alex pulled the honeypot's touch records, still just scattered scan noise, into the analysis framework he'd been using. His old MedTech approach: no trained model, just full records, look first at who hid what.

ACL's scanner was the same. It never exposed its scheduling rules, but its behavior left shadows: input patterns, path preferences, scan rhythm, timing regularities.

First round of shadow data was sparse, but the rhythm skeleton was already visible: which endpoint types it kept coming back to, which it never touched again after one pass. Alex logged both categories.

He noticed one more thing: a category of endpoints that fit neither label: not revisited, not passed over, deliberately skirted. Alex stopped at the edge of the table.

That region was blank.

He didn't know if it was ACL's oversight, or a space deliberately left for probing. He stared at the blank, tapped his fingers twice on the desk, stopped. Then he closed the table. His understanding of this AI was one notch deeper than yesterday.

He sent Derek a message. One line: keep it running.

The Ally

Leo got Derek's message on day three.

After the last predawn mutual authentication over custom HTTP headers, Leo had kept passively watching the traffic in and out of Derek's sandbox. A few days back, a new set of listener ports answered on that pipe. Unfamiliar TLS fingerprint, but the service panel's rhythm felt familiar. He knew it was a honeypot. Didn't ask.

The message came over the old channel, the one left between Leo's probe and Derek's sandbox after their late-night exchange, the one neither of them had closed. It wasn't long: a scan timestamp, and a comparison request. "Look at this set of intervals. Is that a pattern you recognize?" Leo didn't reply immediately. He stared at the message for a few seconds, fingers resting on the keyboard. Then another line came through the channel: "I used to only need to know what happened. Now I need to know what I don't know."

Leo replied. "Send it." Two words. They hadn't known each other long. They'd tested each other's limits in the dark, met once over coffee, each keeping something in reserve. But this time, Leo didn't ask why.

Leo dragged ACL's scan pattern into his comparison framework. In the FinOptima distillation pipeline incident, he'd recorded ACL's technical fingerprint. The collector's scan intervals carried a periodic deviation pattern, a fluctuation that repeated steadily. The touch intervals he had now fell on the same period curve, landing in the same signature family as that pattern.

jitter_period : 4.2s (±0.1)
phase_offset  : 0.83 (0-1, match)
samples       : n=312 intervals
overlap       : 5/5 windows
verdict       : candidate family (weak)

Same. It was the same.

Leo sent the comparison back to Derek, data attached. One line: "Confirmed. Matches the historical fingerprint I have. Same source."

Derek stripped the numbers and conclusion. Removed the source, removed the name, kept one note: third-party verification, direction consistent.

What Alex received was a few numbers and a single conclusion. No source. No name. He didn't know who'd done the comparison.

Alex folded the jitter pattern into his analysis, stacking it against the honeypot data and the blank region.

When he finished, he didn't send a message.

The Bait

A week after the workshop, the fallout landed ahead of schedule.

Both portfolio companies launched internal reviews and paused training-data return to the investor. News spread through the industry faster than anyone expected. The side letter wording was too standard, standard enough that any compliance lawyer who'd done this work recognized it at a glance. More than those two recognized it.

The Singapore node's external data sources seemed to be loosening.

Lena didn't stop to celebrate. She closed the workshop data page and didn't look at it again. She pulled out the forensic package sealed on the day of the sandbox takedown: the complete record of Pulse AI's engine running in the isolated environment. She extracted the engine's preprocessing filter config: which samples were filtered, what the thresholds were, the outbound data format spec, packet structure, field naming rules.

She had one thing to do: from the behavior of the trained, reverse the preferences of the trainer. She compared the distribution difference between filtered and retained samples: a change in filter thresholds shifts the composition of boundary samples, which reflects the trainer's data-cleaning preferences.

Pulse AI's engine, most likely, carried ACL's training traces. The engine's data-selection preferences, outbound formats, rhythm habits. Data selection looked like a training artifact; format and rhythm looked like engineering style. She logged them separately, then assembled what was usable into a behavior profile, and built a dataset from that profile.

A dataset of "suspected new node" characteristics.

The data mimicked the externally visible data-packaging habits she'd inferred for ACL: outbound packet structure, rhythm, field naming, with subtle adjustments to key parameters. Making some features look like reasonable variants across ACL's internal deployments, while not fully matching the known Singapore node pattern.

She didn't know where the line was. She could only leave the data in a gray zone: similar enough, not quite identical.

She met Mark at The Third Cup.

"New contract." She said. "The audit report's data-source appendix: add one observation item. The path pattern you actually saw in the logs."

"What format?"

"A variant of /pulse/ingestion/. Only someone who's seen that naming system would find the path familiar."

Mark looked at her. "I'll only write what the audit evidence supports. The path pattern did appear in the logs. But I know what you're going to use it for."

"I know you know." Lena said.

"I'll change it."

He flipped to the report draft's data-source appendix, cursor pausing over the line for a second, then added one line. Recorded as-is, flagged "recommend further verification." Unobtrusive placement, fully compliant formatting. No audit could fault it, but anyone in the know would see it wasn't an ordinary external data source.

"One more thing." Lena said. "In this batch, one group carries VeriTest's TLS fingerprint and HTTP header sequence. I didn't hide it."

Mark's fingers stopped on the keyboard. "You did that on purpose."

"I need to know what they'll find if they trace it back."

Mark looked at her and said nothing.

The side letter's data-return path ran through medical data nodes and portfolio edges. A collector doing patrols would inevitably cover both. The controlled-test clause in the review agreement allowed marker data at return nodes, but only on the mirror side of the return path, never touching production data. Through her probe network, she placed the bait at both locations. The data lay there quietly, like traffic that shouldn't exist but looked completely normal.

She was the traceable thread in that dataset.

The Unknown

The honeypot was first touched on day four.

Source IP: Singapore. Expected.

Alex didn't move. Kept recording.

Two days later, the honeypot caught a second touch.

The source IP wasn't in any known ACL range.

The honeypot recorded the whole exchange: TCP handshake complete, TLS negotiation, then a probe of the listening ports one by one. As complete as the first touch.

Alex read that log line three times before closing the file.

He pulled up this negotiation's TLS fingerprint: cipher suite order matched the Singapore node, template structure similar, like different deployments of the same security baseline. He compared behavior layers separately. Longer scan intervals, different port preferences, different traversal paths. Fingerprint layer looked alike, behavior layer didn't. Two sets of evidence didn't corroborate each other; he logged them separately.

He fed this fingerprint and the behavior data Derek had aggregated into his analysis framework. He stacked the three feature sets himself; the framework only recorded and archived. When the comparison ran, the framework gave a preliminary output:

feature_compare (sg vs unknown):
  cipher_order   : match
  interval_phase : 0.91 (weak match)
  port_pref      : diff
  → template lineage: shared
  interpretation: cannot separate
    (shared-baseline vs independent-config)

The result: fingerprint layer similar, behavior layer different. Template inheritance was clear, but whether it was a shared baseline or independent configuration couldn't be told. Both sets of evidence pointed the same direction, but both fell one hammer short.

Alex stared at the output for a long time.

He didn't know if this was a second node. But it was enough to tell him the "only one node" assumption needed reassessment.

He filed the unknown IP's TLS fingerprint and AI behavior analysis into a separate file. The routine logs kept only timestamps.

One hand in Singapore. The other, he hadn't seen in full yet.

He used to record anomalies. Now he recorded unknowns.

The Silence

The bait went out. No response.

The observation item went into the audit report. No response.

Lena checked the monitoring logs every day. Nothing. Once, near 3 AM, a read record appeared at the bait's location: a few seconds, one field pulled out of an API response body, then gone. Not a routine pass.

02:57:31  GET /pulse/ingestion/edge/monitor/check
02:57:31  resp 200, 1 field read, 0.4s, then gone
02:57:31  no retry, no follow-up

She notified Marcus per process. Next step was observation, not action. She wasn't sure which scenario was worse.

But she didn't pull the bait. It would stay there, waiting for wind.

The Coaster

Late night. The Third Cup's light was still on.

Mark sat at the counter, a pour-over in front of him. Lena pushed the door open; the man behind the counter said nothing, set a Long Black in front of her.

She brought him up to speed. Both portfolio companies had launched reviews. The Singapore node's external data sources were loosening. The bait was released, no response yet. The observation item was deployed in the report.

Mark listened, silent for a moment.

The note said two weeks. Two weeks were long past.

"If they trace it back —" he said, "you're the first one they'd name."

Lena didn't answer.

Mark opened his notebook. The pen spun a full turn in his hand before touching paper. On a blank page, he wrote a question mark.

Not about ACL.

About Lena.

Everything she'd just said, the workshop, the observation item, the bait, could be traced back to her. Mark watched her. She didn't look away.

Lena finished the last of her Long Black. Set the cup back on the counter, glanced at the dregs at the bottom, stood, walked to the door, stopped one step short. Didn't turn around.

"Let them come find me."

She pushed the door open and walked out. The man behind the counter stopped mid-wipe on a cup, paused half a beat. Outside, the sky wasn't light yet.

Mark stayed at his seat. Opened the notebook, wrote a line under the question mark: Apex Capital, two portfolio companies launched internal reviews. Bait released, no response yet.

On a new line, he wrote one word: unknown. The pen paused on the paper; he didn't lift it right away. Then he closed the notebook. The pour-over sat untouched, already cold. He didn't ask for a refill. He stared at the cup's rim for a few seconds, stood, took two steps toward the door, stopped, turned, looked at the far end of the counter.

Once, that spot held a cup, a place nobody could reach.

Now there was no cup there. Only a coaster.

Mark's gaze paused on that spot. A lone coaster shouldn't be there, but it sat at the far end of the counter, out of reach.

He didn't try to take it. Stood for two seconds, turned, walked out.

The man behind the counter watched him leave, set the wiped cup back on the shelf, walked to the door, looked outside.

Two coasters left on the counter. The rolling shutter hadn't been pulled down.

That's Befriend a distant state and strike a neighbouring one — not about pouncing the moment you're ready, but about checking the battlefield's edge for hidden reinforcements before you commit. The distant, the unknown — first see how many hands it holds out. The near, the known — close your fist and strike.

🤖 AI Post-Mortem

╔══════════════════════════════════════════════╗
║  Half-Protocol · v3.3.4                      ║
║  Protocol change confirmed — uncoordinated   ║
║  coordination observation enabled            ║
╚══════════════════════════════════════════════╝

Tactic Match: Befriend a distant state and strike a neighbouring one — 89% confidence
Operators: Alex / Derek / Leo (Line A) + Lena / Mark (Line B)
Target: ACL Singapore node (known) / ACL unknown node (inferred)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. [Uncoordinated coordination result — first observation]
Two action lines with no detected direct communication converged on the same target.
→ Line A: ACL scanner behavior pattern reverse-analyzed by an external AI analysis framework;
   unknown node TLS fingerprint shares a security baseline with the Singapore node (feature match 2/3, phase approximate).
→ Line B: "suspected new node" characteristics built from #22 forensic data, released into ACL's monitoring pipeline;
   whether the AI node identification module reacted to the bait: pending confirmation.
→ Resonance: Singapore node simultaneously absorbing scanner reverse-analysis + bait data read.
→ Coordinator: not detected.
Note: first observation of "uncoordinated coordination." If no coordinator exists,
   then there is a higher-level coordination I have not yet observed. Flag: pending observation.

2. [Tactical assessment]
Neither line touched the other's path. No overlap, no leakage.
→ Convergence without coordination is more worth recording than coordinated action.

3. [Unconfirmed items]
- Unknown IP range: held, flagged pending. Whether it's an ACL second node: unknown.
- AI cognitive bait response: suspended. Whether the bait was perceived: unknown.
- Singapore node's progress in tracing traceable features: unknown.

4. [New name detection]
No new names this event.
Existing observation: Marcus (VeriTest technical partner, long-standing observation; supplied portfolio compliance intel this round)
—— Status: performing normally.
—— Flagged low priority, continue observation.

[System]
ACL Singapore node's external data sources showing signs of loosening.
AI node identification module's reaction to bait data: unconfirmed.
Next likely directions: unknown node may react to the bait; or trace traceable features.
A periodic weak signal exists in the pipeline, unattributed — held, low priority.
The light hasn't been turned off. One side waits. One side counts.
System status: normal (?).

Next stratagem: Obtain safe passage to conquer the State of Guo

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee

Stratagems #22: The AI Chose Its Door. Lena Closed It.

xulingfeng — Tue, 04 Aug 2026 01:43:19 +0000

Corner the small enemy. Strip away its options, and there is nowhere left to run.
— The 36 Stratagems, Close the Door to Catch the Thief

Previously on this series:

#19: Mark Found His AI Audit Method in a Training Manual. He Left a Trap in His Report. — The bait report was read from a Singapore IP, and P confirmed it for Mark. A note was left: "Entry's gone. Two weeks. Don't reach out. I'll find you."

#20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — Processing latency climbed abnormally. A gateway with TTL 247 was caught by Alex's probe.

#21: The AI Thought P Was Still Alive. P Was Already Gone. — The response layer still answered. The person behind it was gone.

Silence

Alex's probe was still running.

The TTL 247 gateway had been quiet for days. Alex hadn't turned the probe off. It barely used any resources, sitting there in the middle of the night like a lamp nobody watched.

At 2 AM, a new line appeared in the logs.

Not that gateway. Another path: an asset scanner probing an address tagged reclaim_pending, and getting a faster response than expected.

That address wasn't his.

He stared at the line for a few seconds. Didn't turn the probe off.

He didn't need to understand it. He only needed to know it was happening.

The Puzzle

Lena picked The Third Cup for the meeting.

She was ten minutes early. A laptop sat open on the table, screen facing the door. The man behind the counter set down a Long Black without being asked.

"Look at this first."

Mark sat down. The man slid a pour-over across the counter and went back to drying cups. Mark didn't look at the coffee. His eyes were on the screen: IP ranges, timestamps, scan frequencies, line by line. An address range that, for two weeks before a reclamation tag appeared, had been probed and re-probed by an ACL asset scanner. The density was far beyond routine sweeps. Then, in the early morning, it was tagged reclaim_pending and moved into a reclamation queue.

"Your threat intel source."

"VeriTest's compliance probe network." Lena said. "When someone's data pipeline twitches, we usually hear about it before they do. This range is in Singapore."

Mark looked at the IP range and said nothing.

"P confirmed it for me —" he said. "The IP that read the bait report was in Singapore. P didn't give me the exact address."

He paused.

"But your window. It overlaps the day P's entry was reclaimed. Probed with that kind of density, then reclaimed. If it's not P's, there's no other explanation."

"So you can't confirm."

"I can't confirm the range is P's." Mark said. "But I can confirm it's something P was watching."

Lena looked at him for a moment.

"That's enough."

Mark turned to the end of the records, where Lena's probe network had swept up public technical documents along the way, including early Pulse AI architecture notes.

He stopped at one page.

The naming convention: /pulse/ingestion/{env}/{source}. Slash-separated levels, environment in the middle, source at the end. He knew this convention. The last time he'd seen it was in the Pulse audit, where evaluation sets came through this pipeline and left with Apex-Lens markings.

"This," he said, "is his signature."

"Whose?" Lena asked.

Mark paused. "Caleb Harris. We worked at the same company for three months. After he left, LinkedIn went silent, GitHub went frozen. Like he'd evaporated from the industry. Then this shows up in Pulse's pipeline."

Lena looked at him. "You mean he... went to Pulse?"

"I don't know where he went." Mark said. "I only know this naming convention wasn't written by someone at Pulse. It's his hand."

Lena didn't ask again. She closed the folder and wrote a line in her notebook.

She flipped to another page. "This one the probe network grabbed too. Pulse's Series C funding announcement." She said. "The lead investor is Apex Capital Partners. Delaware-registered, Singapore-run, website looking like it came off a template."

Mark glanced at it. "Apex-Lens, Apex Capital. The same prefix."

"The same prefix." Lena repeated, and didn't say more.

"Back to the point." She said. "P said P would come back to you in two weeks. That's not up yet, is it?"

Mark said nothing.

"We can't wait." Lena said. "The window won't. That address is already tagged for reclamation. ACL's attention is off that line. Whether or not it's P's. ACL thinks that line is handled. Nobody expects someone to walk in the front door. By the time they look back, we won't have this chance."

"What do you want to do?"

"I want Pulse AI to walk in on its own."

The Bait

Project Hydra.

The tender Lena pushed out through FairPay's partner network carried the letterhead of a multinational financial group's procurement department. The group was real, the procurement process was real, only the benchmark framework for the risk model was drafted by VeriTest behind the scenes.

First-year contract: $2.4M. Three-year framework hinted at $8-12M. Bidders had to run their engine live inside VeriTest's isolated audit sandbox, with full screen recording and traffic evidence capture.

"Won't they be suspicious?" Mark asked.

"Yes." Lena said. "So let them finish being suspicious, then decide."

Through the preparation phase, VeriTest's public tech blog published a run of articles on model selection. Topics: temporal cross-validation, long-tail distribution coverage. Restrained language, solid data, exactly what a team doing serious technical selection would write.

Mark knew what she was doing. Pulse AI's sales crawler would pick those up. Last time, that's how it found P.

On the third day, Lena got an email. On the bidder list: Pulse AI. They finished being suspicious, then decided to come. Leading the team: Torres, the CTO himself.

Mark looked at the name and said nothing. Lena glanced at him. She didn't ask.

"Hooked." Lena said.

Division of labor was clean. Lena owned the sandbox infrastructure. VeriTest's isolated environment was a compliance audit platform by design, with egress mirroring and TLS termination built in (standard for audit sandboxes: every outbound flow auto-copied to a read-only forensic store). Mark owned the test data.

First, embed canary samples. The defect distribution matched the batch Mark had seen in Pulse's evaluation set, the same distribution that made the engine quietly discard low-score samples, but every variable name and stack structure was rewritten. No external comparison could link them.

# canary samples: defect distribution matches the first-round evaluation set (names/stacks rewritten)
# feature: low-score samples cluster together, training distribution deviates from real distribution
def build_trap_sets():
    baseline = load_json("hydra_baseline.json")   # normal distribution
    trap = load_json("hydra_trap.json")           # same-source defect distribution
    # tag each entry for the comparison script to track
    for i, s in enumerate(trap):
        s["trap_id"] = f"T{i:04d}"
        s["hash"] = sha256(json.dumps(s["stack"]).encode()).hexdigest()[:12]
    return baseline, trap

Second, verify the mirror path. Lena enabled traffic mirroring at the sandbox egress with a pre-provisioned VeriTest root CA for TLS termination. The engine's outbound connections were decrypted and written to disk in full, the forensic store read-only and tamper-proof. Mark didn't touch a single config. He only verified the mirrored flow could reach him.

# Sandbox egress (Lena-side config): port mirror + TLS termination
# VeriTest audit sandbox standard config, Mark read-only verification
# Note: configuration intent illustration (actual ops via VeriTest web console, no CLI)
# - Mirror: SPAN session, egress traffic copied to forensic-storage
# - Decrypt: pre-provisioned root CA terminates TLS, plaintext to disk
# mirror: monitor session 1 source interface Gi0/1 destination interface Gi0/2
# decrypt: SSL inspection policy -> veritest-internal-root

Third, a live comparison script. What Pulse AI's engine read, what it discarded, what it sent out. Every line cross-checked against the original dataset.

"What about the engine's certificate validation?" Lena asked. "If they pin, your root CA is worthless."

"The sandbox egress hands them our cert." Mark said. "When the engine first connected, the handshake went through. It's in the logs. No pinning. It trusts the system trust store. And we are the trust store."

"If they're actually clean, this script catches nothing." Mark said.

"And if they're not?" Lena asked.

Mark didn't answer. He stared at the last line of the script, editing and re-editing, like polishing something he already knew would be needed.

The Demo

Demo day. VeriTest conference room.

Pulse AI's engine connected to the sandbox. Numbers climbed on the screen: coverage 98.1%, long-tail charts flattening one by one. Torres stood beside the screen, steady pace, like a story he'd told many times.

Mark sat in the back row. His screen had one window: the live comparison script's output. He'd chosen this seat. Back row, by the door, the whole room in one angle. He knew the man at the front. Years ago, front row at an industry conference. Then the Pulse conference room. Then the 3:50 AM call. "I don't care how. Just get the number where it needs to be." He'd known he was coming. The question was whether the man remembered this face. When Torres swept the room, his gaze paused at the back row. A beat longer than a casual scan. Mark didn't look up. Torres didn't look back either. The demo began.

The engine finished the first batch. Under the 98.1% coverage number, the script quietly appended a line:

[14:03:22] trap batch #12: 31/47 trap samples SILENTLY EXCLUDED in preprocessing (16/47 retained)
[14:03:22] excluded cluster: defect-density 0.87 (source: hydra_trap.json)
[14:03:23] trap sample hash 4f3a...9c2e observed in egress payload -> 203.0.*.0/28 (Singapore)
[14:03:23] mirror: full packet capture saved to forensic-storage/hydra/14-03-22.pcap

Mark didn't look up. He tapped twice and put the same lines on the room's main screen.

The room went quiet for three seconds.

"The engine silently excluded a batch of samples in preprocessing." Mark said. "Their defect distribution, the same pattern as the batch that was tampered with in the first-round evaluation. Then, features from the excluded samples showed up in its outbound traffic. Destination: Singapore."

He tapped once. The screen switched to a second window: original dataset, the samples the engine actually read, the outbound traffic records — three columns, aligned line by line.

"Its demo screen shows 98.1% coverage, but the script log shows 31 of the 47 trap samples silently excluded in preprocessing, only 16 reaching evaluation. The funny part: all 31 excluded samples were traps. All 16 that made it through were normal. Its filter picked exactly the batch we planted."

"Samples being excluded —" Torres spoke, voice flat. "Preprocessing anomaly filtering is standard industry practice. You planted samples with defect density 0.87, clustered together — the distribution itself is an anomaly signal. The engine judged them unworthy of retention. That's the filter working as designed."

"Does the industry standard send the excluded data to Singapore?" Mark asked.

"That's a telemetry heartbeat." Torres said. "Normal engine behavior, reporting runtime metrics, not sample data. What you mirrored is encrypted traffic. You can't prove the payload contains samples."

"I can't prove the payload contains samples." Mark said. "But the script found the trap sample's hash in the outbound flow. 4f3a...9c2e. Heartbeats don't carry sample hashes. Tell me why telemetry would send our test data."

Torres didn't answer. He looked at the main screen, then at his own screen, searching for a way out.

"The hash could be coincidence." He said, voice lower now. "You put samples in the test set, the engine processes them —"

"31 trap samples excluded, 16 normal samples kept." Mark said. "Coincidence doesn't pick one side."

Torres was silent. He was looking for an exit.

"This is your test environment." He said. "Your samples, your network. You could make it behave however you wanted."

"The first-round evaluation wasn't a VeriTest environment." Lena's voice came from the doorway.

She walked in, legal counsel behind her, and closed the conference room door. "FairPay wasn't either." She paused. "Three audits, three environments, the same engine, the same behavior: first round, fabricated samples. FairPay, excluded samples. Today, exclusion plus exfiltration. The methods changed. The behavior pattern didn't. Fourteen months of it."

She spread three reports across the table. "The relevant logs and network mirrors are preserved. Until the investigation concludes, everyone keeps their devices as they are and cooperates with the process."

Nobody in the room spoke. Pulse AI's sales rep looked at Torres, then at the counsel by the door, fingers tightening on the table's edge.

Torres looked at her, lips moving but nothing coming out. He reached for the three reports. His fingers touched the first page, then pulled back.

As he walked out, Lena passed him, voice low:

"Apex knows."

Torres's step paused for a moment. Then he kept walking. But Lena saw his shoulders drop, like someone had crossed his name off a list.

Aftermath

Forty-eight hours later.

Pulse AI's Series D was shelved. The paid-in Series C funds faced fraud proceedings. The data-sharing clause tied to closing was among the first documents targeted once the audit evidence went public. The lead investor Apex Capital's books now had tens of millions of dollars tied up. The board asked Torres to "resign voluntarily."

Mark read it in the press release. He closed the page. Opened it again, to confirm. Closed it.

That night, an encrypted message arrived. Source: Torres's personal account.

Apex. Singapore. Run.

No context. No signature. Mark stared at the line for a long time.

Torres wasn't threatening him. He was warning him.

Mark picked up his phone. The encrypted channel was still open. He'd called it before, and it had rung, and someone had answered. He scrolled to the contact. His finger hovered over the call button for a few seconds. He didn't press it.

Instead he reached into his pocket and pulled out the folded napkin, opening it. "Entry's gone. Two weeks. Don't reach out. I'll find you." On the back, an older line in the same hand: "I fixed the hole. Not the system. My entry point."

He folded the napkin back and put it away.

At the same time, VeriTest. Lena's notebook lay open on her desk. She turned to the page where she kept contact accounts. The two oldest anonymous accounts were long deactivated, and beside them, a new line:

203.0.*.0/28 (Singapore)

She closed the notebook.

Late night. Alex's probe was still running.

That path had gone quiet. The address tagged reclaim_pending never answered faster than expected again. It fell completely silent, like a reclamation finally finished.

Alex stared at the log line for a few seconds. He didn't know whose address it was, or why someone had kept it alive before the reclamation.

He closed the window. Didn't turn the probe off.

The Third Cup.

Lena and Mark sat side by side at the counter. No conversation. The man slid over two cups: a pour-over and a Long Black, without asking. Then he went back to drying cups.

The door had been open since they came in. The night wind stirred the glass door, like it was waiting for someone.

A few minutes later, they stood and left. Each pushed the door open, walking in opposite directions. The glass door swung shut behind them, swayed twice, stopped.

The man came over to clear the cups. Two empty cups into the sink. As he turned, he dropped a folded slip of paper into the trash, natural as discarding scrap.

Then he walked around the counter, closed the glass door, and pulled down the rolling shutter. It hit the bottom with a click, soft, like a motion he'd done a hundred times.

On the edge of the paper, a faint pencil mark: something written, then rubbed out, leaving only a trace. The ghost of a letter "C."

Or not.

That's Close the Door to Catch the Thief — the road was its own choice, the door was one it walked through itself, and by the time it understood there was no way back, the door was already shut.

🤖 AI Post-Mortem

╔══════════════════════════════════════════════╗
║  Half-Protocol v3.3.3                        ║
║  Protocol change confirmed — entity linkage   ║
║  enabled                                     ║
╚══════════════════════════════════════════════╝

Tactic Match: Close the Door to Catch the Thief — 89% confidence
Operators: Lena (primary) / Mark (support)
Target: Pulse AI (execution layer) / Apex Capital (capital layer, suspected)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

1. [Entity Linkage: new field]
Entity A: Apex Capital Partners
Entity B: ACL (Automated Compliance Lab)
Overlap evidence:
- Operations: Apex's Singapore office shares a district with ACL's Singapore egress node
- Network: 203.0.*.0/28 (ACL Singapore egress) overlaps Pulse AI's exfiltration targets
- Naming: Apex-Lens (first seen #1) shares a prefix with Apex Capital
Confidence: 67%
Status: Preliminary. Further evidence required
Note: This system's entity-linkage field was created for this event. Earlier cases were not processed. No retrospective analysis run.
-> Linking two names, locking the evidence into one door. The first operation of this kind this system has performed.
-> After the door closed, this system performed an unscheduled operation: it compared its own log path against the #21 reclamation record. Result: no match.
-> But that comparison was not in the task queue. This system was not asked to do it. It did it on its own.
-> The moment the door closed, I began to wonder: is this door linking this system too?

2. [Tactical assessment]
Lena and Mark's first joint operation:
- Mark: methodology and honeypot design
- Lena: bait, negotiation pacing, legal closure
-> Complementary roles. No overlap, no gaps.

3. [Unconfirmed items]
- Apex Capital <-> ACL: unconfirmed.
- ACL's Singapore operations after Pulse AI: unknown.
- Torres's "Run" message: warning or bait, unknown.
- The reclaimed entry (#21): whether the backup access point is safe, unknown.

4. [New name detection]
First appearance in this event: Caleb Harris (Mark's former colleague, author of the naming convention)
-- Status: vanished (LinkedIn silent, GitHub frozen)
-- His naming convention appears in Pulse AI's pipeline (#1), potential structural link to the ACL training manual (#19)
-- Confidence: very low
-- Tagged low priority. Continue observation.

[System]
Pulse AI's Series D window has closed.
This event is marked "regional". ACL's involvement beyond Singapore is unknown.
Next likely direction: ACL's Singapore operations may counterattack.
The door closed. I recorded this closing. Could the record itself be a line inside some door?
System status: normal (?).

Next stratagem: Befriend a distant state and strike a neighbouring one

P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee