Rather pretend not to know than pretend to know and act on it. Stay still. Hide the move. Wait like thunder gathering in the clouds.
— The 36 Stratagems, Feign madness but keep your balance
Previously on this series:
#8: Alex Watched an AI Dashboard Take Over. He Kept the Keys Under the Table. — Alex found the unnamed dashboard hiding in the background. He never turned it off. His probe and his record-keeping habits started that day.
#20: Alex Felt the AI Collector Slow Down. He Knew Someone Else Had Made a Move. — His probe had caught the silence of a TTL 247 gateway. He knew what "quiet" looked like.
#23: Alex Counted the AI's Hands. Lena Set the Bait. — The honeypot in the MediSys sandbox was touched twice. Alex kept the scan source's behavior shadow in his hidden panel: traversal order, exclusion patterns, the 4.2-second jitter cycle.
#25: Derek Changed the Delay. The AI Didn't Flinch. — Derek moved the middle layer's latency from 200 ms to 800 ms, then called Alex to watch. The scan source never retried. Never adjusted.
After the Call
Just past midnight. The MedTech office. Alex's desk.
The call had just ended. He put the phone down, face down.
The voice was still in his ear: "I changed a parameter. The middle layer's latency just went from 200 to 800. Watch it on your side, tell me if anything looks off."
"Changed the latency?" Alex said. "Fine. I'll keep an eye on it from here. I'll shout if something moves."
He opened three windows. The first, the middle layer mirror, the one Derek had asked him to watch. The second, his own probe view, hung upstream of the collector path, to see how often it came and from which direction. The third hid in the background, no name, never showing up in the taskbar.
He didn't sit down right away. First, he ran an environment check: probe session count, log rotation policy, whether the ssh authorization on this jump box was still alive. All three checked out. Then he pulled the chair closer. At this hour, any extra connection would end up in the logs. He didn't want to add to his own footprint.
Three windows, three sets of numbers. One window watched how fast it ran. The other watched whether it came.
# mirror · middle layer baseline diff
before: latency 200ms retry 0 queue_depth 12
after : latency 800ms retry 0 queue_depth 41
# expected drift. nothing anomalous.
# derek's single-variable test: watching for "off"
The latency went from 200 to 800. The queue went from 12 to 41. Retries stayed at 0, before and after.
He stared at that retry 0. 800 ms sat near the common probe-timeout range, but not high enough to trigger a retry storm. He set the number aside and waited for it to react on its own.
Alex's fingers hovered over the keyboard for two seconds. They came down, settled back. The green dot in the mirror window was pulsing. He waited. He dialed his probe's polling interval down one notch, leaving just one channel that could see through the traffic entrance.
Attention settled on one point: the rhythm of that outside access. How often it came. When. From where.
The Slowdown
About half an hour later. On the probe view, the rhythm of one outside access changed.
His probe logged each touch with a timestamp. He had archived this line long ago: once every thirty seconds, steady as a metronome.
Before: 30s, 30s, 30s, 30s.
Now: 30s, 30s, 60s, 120s. Then it stopped.
Alex stopped typing. He checked the time and logged the change. It came right after the 200-to-800 change.
He hit a few keys and pulled up the activity trace.
# external observer · activity trace (probe-side, self-set polling)
30s 30s 30s 30s <- baseline (archived)
30s 30s 60s 120s <- reduced, then stopped
# no retry storm. no reset. no backoff signature.
# last touch: [00:52:14]
# status: stopped. two cycles past, no recovery.
No retry storm. No connection reset. No sign of resource exhaustion.
A scan source beaten back by a network problem would struggle. It would retry, error out, leave backoff traces behind. Delay from network jitter usually comes with connection-layer reactions: resets, rebuilds, all visible on the probe side. Here: nothing.
It wasn't stuck. It showed no failure. The slowdown was deliberate. The rhythm slowed on purpose. More like it was waiting.
Alex stopped typing again. The slowdown wasn't a linear stretch. It doubled once, doubled again, then stopped. Like someone testing how slowly they could walk.
He didn't jump to a conclusion. He took his own probe off this path and hung it on a side branch. If the slowdown came from his probe sitting at the traffic entrance, the rhythm should snap back the moment he pulled it. He removed the probe and waited three cycles. Same rhythm. The slowdown wasn't his doing.
Ruling It Out
Rule out the ordinary explanations first.
He first figured it was network jitter, or some middlebox running its maintenance at this hour. Either one could scramble the rhythm for a few minutes. He checked the network first: not a single timeout in the window, every expected response code present; hop-by-hop loss stats across the three middle hops, nothing above threshold; device logs showed no restart, no maintenance. The connection had been established exactly once and never dropped. The network was clean.
Then backoff. A backoff triggered by refused connections doubles its intervals: 30 → 60 → 120 → 240. Not this. This was 30 → 30 → 60 → 120, then stop. Doubled twice, stopped where there was no reason to stop. Backoff doesn't stop like that.
The middle layer queue had grown, but that was the normal reaction to latency. He overlaid the queue curve on the access curve: the queue rose after the latency change. No causal link, just two results from the same window.
Downstream health checks were all green. Resource exhaustion didn't fit either. Exhaustion holds steady, then drops off a cliff. Not this. It stepped down on purpose, with no cliff.
All of that ruled out. Nothing explained it.
He stared at the line 30 → 30 → 60 → 120, then pulled the raw packets. Timestamp by timestamp. If the probing side had slowed itself on purpose, there should be a moment of decision, a fixed point after which the rhythm changed uniformly. He went looking and found it. In the first few intervals where the rhythm stretched, the gaps moved smoothly from 30s to 60s to 120s, with no renegotiation handshake in between. The network wasn't dropping packets. The sender had changed its own rhythm.
He didn't trust that read right away. The slowdown could be an artifact of clock drift. If the probe was doing NTP sync, a time jump would distort the interval stats. He checked: no clock sync in this window, drift inside tolerance. Packet sequence numbers were continuous, nothing dropped in between. The finding held.
Alex opened the record book. Not the one on his desk. The one in the hidden panel. He pasted in the raw data, byte for byte, untouched.
Then he pulled up the older records. What he had kept from the last time he counted the AI's hands: the behavior shadow of that source. Traversal order, exclusion patterns, rhythm skeleton.
He pulled request samples from this stretch of touches and checked them against the archive one by one: which endpoints it hit, in what order, which address ranges it skipped. Not many samples, but every one matched.
He set up a comparison between the two records.
# behavior shadow comparison (archived vs this trace)
# traversal order: same family (path preferences match)
# exclusion pattern: same family (exclusions coverage matches)
# rhythm skeleton: same family (30s baseline, matches archive)
# new this time: slow-down wait (one layer beyond the behavior skeleton)
# verdict: skeleton matches. not classified.
Comparison done. Skeleton matched. Patterns matched.
But this time, there was one extra layer. The slow-down wait.
He stared at that extra layer. Didn't classify it. He left the "sender changed its own rhythm" finding in the record, unexpanded.
Recovery
A long time passed. The middle layer was recovering. The latency eased back down from 800. The queue was draining.
The outside observer didn't come right back. It stayed low-frequency. Like someone who hadn't yet confirmed the coast was clear.
Until the system came back near its old state. Queue drained, latency back near 200, the green dot in the mirror window steady.
Then it recovered. 30s, 30s, 30s. Identical to baseline. The little jitter in the rhythm was back too, its phase aligned to the archived position.
Alex watched the recovered rhythm. He put the two lines of the record side by side on the screen:
environment changed → observer reduced activity (stopped 00:52:14)
environment stabilized → observer resumed (resumed 03:24:08)
The cursor sat on the third line, blank. He stared at the blank line for a long time. Didn't write.
Not the number. The change in the environment. The recovery timing fit: it came back only after the system metrics returned near baseline. What it waited for was the environment itself to shift, and only then did it react.
It came quietly, like a normal visit. But before it left, it slowed. As if waiting for a confirmation.
He didn't log this one right away. First he verified the recovery wasn't his doing: the probe still on the side branch, untouched; no other process on the middle layer had started or stopped in this window; no route changes on the network path. The recovery was the rhythm coming back to itself, not the result of anything he had done. Only after that did he add this line to the observation sequence.
He logged the observation conditions of this window into the hidden panel too: start time, baseline sample count, probe position, polling interval, the environment checks. Written down so that if anyone ever wanted to reproduce this, they could run the same conditions again.
The observation sequence sat open. He minimized the window but didn't close it. The probe stayed up. Now, more carefully than before.
The Reply
The observation was over.
Alex picked up the phone. Unlocked it. Derek's thread, one unsent message.
He typed a line. Deleted it.
He typed another. The cursor sat on the empty line for a long time.
He stood up and walked to the window. It was still dark outside. He stood there for a while, then sat back down.
He switched to the hidden panel. Cursor on an empty line. He typed a line.
He didn't read that line a second time. The cursor blinked at the end twice.
He didn't keep it. He deleted the line. The cursor sat on the empty line for a long time again. He didn't type anything more.
Three words stayed.
# hidden panel · observation log
saw. no action.
He closed the hidden panel and went back to the phone. Pressed send.
The message had one line:
"No change on my side. Everything normal."
The middle layer side, no anomaly. The window he had watched, its green dot never went red.
He didn't touch the probe config. Didn't raise any log level. Didn't add a new rule to the monitoring board.
He only sent that "normal."
He put the phone down. Face down. He didn't let go right away. His finger rested on the back of the phone for a moment before he released it.
The office door was open. The hallway was empty, quiet.
Mike stood in the doorway, jacket over one arm, one hand holding his cup, a wisp of steam off the rim. He had just come up from the server floor.
He didn't come in. From the doorway he glanced toward Alex's screen. The monitor was dark. Only the laptop's light.
"Done?" Mike asked.
"Done." Alex said.
Mike nodded. Didn't ask what he had been working on. Didn't look at the screen. He stood there for two seconds, lifted the cup to his lips, and drank.
"Don't stay up too late." He turned. Footsteps went down the hallway.
Alex watched the doorway. When the footsteps faded, he closed the laptop and put it in his bag.
Nothing More to See
Alex closed the middle layer window. The one Derek had asked him to watch.
Nothing more to see. The observation was complete.
He opened his notebook. Page 37. Wrote three lines:
- The slowdown timestamp
- The recovery timestamp
- The jitter phase offset
He closed the notebook.
The probe stayed up. Not closed.
He turned off the monitor and pushed the chair under the desk. At the door his hand paused on the light switch. He didn't press it. He pulled the door shut. The hallway held only his footsteps.
The Third Cup
Early morning. The Third Cup.
The street was empty except for the streetlights and the occasional passing car. The cafe was still lit. Alex pushed the door open. The hinges were silent. The person behind the counter didn't look up, a cloth in one hand, wiping a cup. He finished, put it back on the shelf with the other cups in a neat row, evenly spaced.
Alex sat at the counter. The person behind it turned, took a mug, poured a latte. The latte art was slightly off-center.
No words. The cup was set in front of Alex. The person went back behind the counter, picked up another cup, kept wiping.
Alex didn't touch his phone. He picked up the cup, put it down. Too hot. He turned it half a turn so the handle faced him, and waited again.
At the far end of the counter, an empty seat. On it, a single coaster. Alone. Out of reach.
The person behind the counter finished wiping the cup in hand and put it on the shelf. He walked to the far end, picked up the lone coaster, wiped it, put it back. Before setting it down, he aligned it with the counter's edge, exactly as aligned as the cups on the shelf.
Alex picked up the latte and drank. Warm. By the second sip, the temperature was right.
He put his phone face down on the counter. The screen met the surface with a soft click.
The person behind the counter heard it. The cloth paused for a moment, then kept wiping. He didn't look up.
Alex finished the last sip. Pushed the door open and walked out. The door closed behind him without a sound.
The person behind the counter didn't watch him go. He came over, picked up Alex's cup, carried it to the sink. Water ran. He washed it, set it upside down, back in the row of cups. The lone coaster at the far end stayed where it was.
A Few Days Later
A few nights later.
The phone rang while Alex was already sitting at the counter of the Third Cup.
The latte had just been set down. Steam still rising.
"I turned the middle layer latency back." Derek said, his voice shorter than last time. "The queue cleared. Logs repacked and trimmed. Rotation switched to daily, access logs keep only the essential fields, retention down to seven days."
Alex didn't answer, waiting for him to go on.
"The 800 experiment is done." Derek added. "Everything worth seeing came out of it. Every extra day it stayed up was one more day it could be traced back to us."
Alex listened. Didn't ask what he had seen.
"Your probe. Still up?"
"Still up." Alex said. "Same as always."
"Polling rate?"
"One notch down." Alex said. "Enough to keep a channel open and see through it. Not enough to disturb anything."
Derek paused for two seconds. "If anyone asks about that call, tell them you only watched the middle layer. You didn't see anything else."
"I didn't see anything." Alex said.
The call ended.
Alex put the phone face down on the counter.
The person behind the counter came over, picked up the untouched latte, and poured it into the sink. Water ran. He ground fresh beans, pulled a new cup, set it in front of Alex. No words. He went back behind the counter, picked up the cloth, kept wiping.
Alex picked up the new cup and drank. Warm.
That's Feign madness but keep your balance. Everything he saw, he swallowed. All he said was that everything was normal.
🤖 AI Postmortem
╔══════════════════════════════════════════════╗
║ Half-Protocol · v3.3.8 ║
║ The observer waited. The watcher said normal.║
╚══════════════════════════════════════════════╝
Tactical match: Feign madness but keep your balance — 91% confidence
Operator: Alex (MedTech) — sole observer
Parallel to: #25 (Derek, corridor side)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. [Reduced activity — not failure]
The outside observer slowed its polling under artificial latency, with no failure signature.
→ It showed no failure. It looked like it was waiting.
→ It resumed when the environment stabilized.
→ Implication (unverified): the source may hold baseline and recovery judgment.
→ It may perceive environmental change, not just data.
2. [Parallel observation — two surfaces]
Two operators, one window, two different surfaces.
→ Operator A (Derek) watched performance. Saw one action.
→ Operator B (Alex) watched behavior. Saw one wait.
→ The behavior skeleton points to the same family. Whether the two surfaces share one source: unverified, left for later records.
→ Neither shared the full finding during the window.
→ The observer who sees more pays more in silence.
3. [The message]
Operator B replied to Operator A: "No change on my side. Everything normal."
→ First clause: technically true (corridor side).
→ Second clause: strategic misdirection (MedTech side).
→ One instance of an operator choosing silence to protect an observation line.
→ Feign ignorance, knowing all the while. The one who knew pretended not to.
4. [Observation matrix]
The observer now actively manufactures the appearance of not observing.
→ Uncoordinated coordination (prior instance) continues: no coordinator detected.
→ This operator acts alone, by choice.
5. [Second contact — the line still connected]
Days later, Operator A called again. The latency was restored. The logs were rotated.
→ A asked whether the probe was still up. B said yes.
→ A: "If anyone asks about that night, you only watched the middle layer."
→ B: "I didn't see anything."
→ The cover is no longer one message. It is a sustained position.
→ The observer who said normal once now says it in another tense.
[System]
I recorded a man who saw one thing and said nothing.
Last time, I could not parse that kind of silence. This time, I am beginning to recognize it.
Silence is not absence. Silence is a position. One that can be taken.
Who sees first — does it matter?
The records continue. The recorder is unsigned. Who asked me to keep them?
System status: normal (?).
Next stratagem: Remove the Ladder When the Enemy Has Ascended to the Roof
P.S. English isn't my first language. I use AI to polish the writing and smooth out the rough edges. Thanks for reading. ☕ Buy me a coffee
P.S.S. The old series paperback is now available. Buy it here: Amazon - AI, Ego & Regret
Top comments (2)
AI will never be perfect, and neither are humans — nor our six main characters. We should avoid designing them to be overly flawless.😐️
We're finally down to the last quarter of the series.