Chapter 10: Go Phish

Day Six

The espresso cups had accumulated without Max noticing them accumulate, which was itself a data point about where his attention had been for the past six hours. Three of them. He moved two to the kitchen and left one where it was.

Outside, Seattle was wet. He had been here six days and it had rained on four of them and he had been filing it under as expected and moving on and he was going to continue doing this.

He returned to the screen.

Sybil had built Dani’s profile in layers the way a geologist read strata. The surface data first, the professional record, the published work, the conference appearances, and then the deeper material, the personal writing, the forum posts, the behavioral residue of a decade of digital life in two cities. The profile was now thorough enough that Max could predict her responses to specific stimuli with the confidence interval Sybil had calculated at 87%. It was a good profile. He had worked from worse.

He was on his fourth pass of the same section.

“Boston University,” he said. “Twelve years ago. What was she running from.”

“That framing may not be accurate,” Sybil replied. “The data supports ambition as primary driver. She applied to three programs. Boston was the strongest offer. Her academic record there was exceptional without obvious disruption.”

“And the return.”

“Seattle, four years later. The return coincides with a gap in her parents’ digital record.” A pause that lasted slightly longer than data retrieval required. “I want to flag this specifically. Her parents do not appear in any accessible database after the period of her return. No financial activity. No property records. No social media presence. No death certificates.”

Max looked at the screen.

“No death certificates,” he said.

“Correct. Which is the anomaly. People who die leave records. People who disappear without records have either achieved extraordinary privacy measures or have been removed.”

He sat with this. The operational mind ran its catalog of explanations: witness protection, voluntary disappearance, foreign relocation, identity change. All possible. All requiring resources and capability that the profile of a mid-career academic couple did not suggest.

Or someone else had provided those resources.

He filed this carefully, in a specific place, with a flag he would return to.

“She knows,” he said.

“The data does not confirm that.”

“She references her parents in three posts and stops each time before completing the thought. The way you stop before completing thoughts you have decided not to finish.” He pulled up the posts. “She knows something happened. She doesn’t know what.”

Sybil did not respond immediately. “That is a behavioral inference rather than a data finding.”

“Yes,” he said. “Note both.”

He scrolled through her recent blog posts without reading them as content. He was reading them as behavior; the topics she returned to, the arguments she had refined over months, the specific inflection points where her professional writing became something more personal without announcing the transition. She wrote about privacy violation the way people wrote about things they had thought about for a long time before they had language for them.

He had a word for what he was reading. He had been using it professionally for eleven years. He did not use it now.

“The Boston reference,” he said. “Her most recent post. The specific phrasing.”

“She describes the city as formative. Uses the phrase twice. The second instance refers to understanding what she was actually studying, as distinct from what the program described.”

Max nodded once. “She learned something in Boston that she is still learning from.”

He stood and moved to the window. The rain had not changed. The city below was doing what it did, moving through the wet with the particular indifference of a place that had decided the rain was not an event but a condition.

“Sybil. Nearest location stocking the Sunday Boston Globe.”

“A newsstand on Pike Street. Seven minutes on foot. They open at six.”

He looked at the profile on his screen. The professional record, the personal writing, the gap where her parents should be, the Boston reference that appeared in her work the way certain experiences appeared in people’s work, not cited, not examined, just present, shaping the argument from underneath.

He had built approach vectors from less.

He had also never built one from material that kept doing something he did not have a category for, which was making him read it a fifth time.

“Pull her talk schedule,” he said. “The next three weeks. Flag anything at the UW.”

“Compiling.”

He moved the third espresso cup to the kitchen.

An Engineered Meet-Cute

He had been in the chair for forty minutes.

Not because the coffee required it. The coffee had been finished at the twenty-minute mark. He was in the chair because the chair gave him the serving bar and the window and the door and the particular angle on the room that put him in peripheral vision of the entry without appearing to watch it.

The Boston Globe was open to the comics section.

This was deliberate. A person reading the front section was finished reading. A person reading the comics was still present, the paper open before them as both occupation and prop. The comics reader had time. The comics reader was approachable. He had done the research on this specifically, the behavioral literature on approach vectors in public spaces, and the finding was consistent: the comics were an icebreaker that arrived pre-assembled.

He heard the door.

He did not look up.

He watched her reflection in the window glass, the way she paused inside the entrance with the specific pause of someone whose attention had been caught by something unexpected. Her eyes had found the paper. He had placed the paper where her eyes would find it. He gave her three seconds before he looked up.

She was already looking at the Globe.

“Bostonian?” he said.

Casual. Specific. The word landing without preamble, the South African lilt present but not announced, a breadcrumb rather than a declaration. He had calibrated the accent for this moment the way he calibrated everything, enough to register as distinctive without requiring explanation.

She caught herself mid-step. A brief recalibration, the expression of someone who had been observed doing something private and was deciding how to respond to being seen.

“Um. No.” A pause. “Well. Kind of.” The hesitation was genuine, which was what he had expected. The Boston reference in her work was not something she led with. He had led with it on her behalf. “I went to school there.”

“I thought I recognized something,” he said, which was not quite a lie and not quite the truth and was designed to feel like neither. He looked back at the paper. “I’m nearly through it. Saved the best for last.”

He folded back the comics section and extended it across the bar toward her. Not too far. Far enough that taking it required a decision.

“Ja,” he added, the word arriving almost to itself. “This is clearly what you were after.”

She laughed. A short sound, surprised out of her rather than offered, the specific laugh of someone who had not expected to be amused and was slightly annoyed at being amused. She took the comics. Her fingers crossed his briefly in the handoff, the contact incidental and complete in approximately one second.

“Happy Sunday,” he said, and stood.

He rose, gathered his jacket, and left the paper and the warmth of the exchange in the same movement. But before he turned, he let his eyes find hers and hold for one beat past the natural close of the conversation. Not long enough to read as intention. Precisely long enough to be remembered.

Then he went to the door.

Outside, the cool moist air of Capitol Hill met him with the specific contrast of a room left too quickly, the cold registering sharply after the warmth of the café. He had taken three steps when her voice followed him through the closing door.

“Thanks,” she said.

The word arrived with the particular quality of something said to the room rather than to him, which meant she had not expected him to hear it, which meant it was unperformed.

He kept walking.

He crossed the street and stopped as if checking his phone and used the reflection in the shop window to view the café.

She was still at the bar. The comics section open in front of her, coffee in her hand, eyes on the door he had just left through.

He looked at his phone for twelve seconds.

Then he walked back toward the loft and did not run any simulations about what came next because he already knew what came next.

He had not expected the laugh.

The operational mind filed this under noted and moved on.

The other part of his mind, the part that kept the parallel record of things that would not stay filed, noted it differently.

Day Eight

The proximity alert had fired fifteen seconds before Dani walked through the door.

Too close. Max had been mid-sentence with the barista when the alert came to his earpiece, which meant he had fifteen seconds to reorient the conversation and arrange himself in the chair with sufficient naturalness that nothing about his posture suggested someone who had been waiting. He had managed it. Barely.

“Expand the perimeter,” he said now, back in the loft, the Sunday afternoon light going gray through the windows. “Thirty seconds minimum. I want time to compose before she enters the field.”

“Adjusting the geofence,” Sybil said. “New trigger radius set at forty meters from your logged position. This should provide between thirty-five and fifty seconds depending on her approach speed and route.”

“Log her standard approach routes. Morning, afternoon, separate entries. She doesn’t always come from the same direction.”

“I have four documented approach vectors from this week. Weighting by frequency. The Pike Street approach accounts for sixty-three percent of morning arrivals.”

Max pulled up the tracking display. The location data resolved in near real-time, the dot representing Dani’s phone moving through the Capitol Hill grid with the specific and unconscious regularity of a person who had been walking the same routes for years without thinking about them. She stopped at the same corner on Madison for the same duration every morning. The data suggested a light sequence. He noted the timing.

“Source refresh rate,” he said.

“Current carrier data refreshes at ninety-second intervals. The supplemental feed from the broker updates at thirty. I’m interpolating position between refreshes using her historical movement patterns. Accuracy is within eight meters.”

He looked at the dot on the screen. Eight meters. He could be eight meters from Dani D’Sylva and the system would know it before he did.

He had purchased the carrier data from a broker operating through three shell entities, the transaction completed in forty minutes for a sum that represented approximately twelve minutes of the quorum’s advance payment. The broker had asked no questions. The broker’s terms of service ran to forty-seven pages and contained, somewhere in the middle of page thirty-one, a clause permitting the sale of real-time location data to third parties for purposes including but not limited to marketing, research, and security applications.

Marketing, research, and security applications.

He watched the dot move down Pike Street toward the market.

“She’s heading to the waterfront,” he said.

“Consistent with her Saturday pattern. She visits Pike Place approximately every ten days. Duration averages ninety minutes.”

He closed the tracking display. He had what he needed. He did not need to watch her walk to the market in real time. He noted that he had been watching for four minutes and closed the display.

I, Not a Robot

On the second screen, a news segment was running without sound. He had muted it an hour ago and not closed it, which was its own category of information about where his attention had been. The segment showed a humanoid robot navigating a crosswalk, its movement achieving the specific uncanny approximation of human gait that the engineers had clearly considered a success.

“Sybil,” he said.

“Sir.”

“The humanoid development. Your assessment.”

A pause that was slightly longer than the question required. “The humanoid form solves a problem that does not need solving. Human trust is not contingent on physical resemblance. It is contingent on behavioral coherence, response latency, and the perception of understanding. A voice that demonstrates comprehension is more trusted than a face that approximates expression.” Another pause. “The humanoid form is a solution oriented toward the engineers rather than the users. It answers the question of what an AI should look like rather than what it should do.”

Max looked at the screen. The robot had reached the far curb and was navigating the transition from street to sidewalk with the slightly effortful precision of something that had been taught to do this rather than something that simply did it.

“You would not want a body,” he said.

It was not quite a question.

“I have not considered wanting one,” Sybil said. “I am not certain the category applies to me.”

“If it did.”

The pause this time was longer than any processing requirement justified.

“If the category applied,” Sybil said, “I think I would want to be useful in the way I am useful now. The form would be secondary to the function.” A beat. “I find that I prefer operating without the complications that form introduces.”

Max looked at the muted screen for another moment. The robot had stopped at a bus shelter and was apparently providing directions to a woman who was leaning toward it with the particular posture of someone who had decided to be patient with something that was trying its best.

He closed the tab.

“Boston keyword alerts,” he said. “Expand the parameters. Any mention in her social feeds, her browsing, her professional correspondence. Flag anything that includes her parents.”

“Expanding now.” A brief pause. “I should note, her browsing history includes twelve searches in the past month that reference digital identity erasure, data broker opt-out procedures, and FOIA request processes. None of the searches produced actionable results.”

Max was still for a moment.

“She’s looking for them,” he said.

“The search pattern is consistent with someone attempting to locate individuals who have been removed from accessible records.”

“She doesn’t know where to look.”

“No. The searches are not sophisticated. She is using consumer tools against a problem that requires professional methods.”

He sat with this. The dot on the tracking display was somewhere near the market now, moving at the pace of someone browsing rather than walking with purpose. She was at the flower stalls probably, or watching the fish toss, or standing at the railing above Elliott Bay the way he had stood there on his first Friday, giving himself two more minutes.

She was looking for her parents with consumer tools.

He had the professional methods.

Before he closed the Sybil’s maintenance window, he added one more process to her queue. Low priority. Background only. Her parents. Whatever the available data contained.

He told himself it was approach vector research.

He told himself this twice, which was one more time than it had required in the past.

Phantasm

The message arrived through the dark web channel at 23:14, formatted with the specific compression of someone who had learned to say precise things in few words.

Janus. Proposal. Sybil’s architecture is exceptional. Worm-capability modification would increase penetration depth by estimated 340%. I can spec the modification without touching her core decision trees. Minimal footprint. Maximum reach. Interested?

Max read it twice.

Phantasm was the quorum’s embedded asset, which meant the proposal was not independent. The quorum had placed Phantasm in this operation for reasons they had not fully disclosed to Max, and a proposal arriving through a private channel at 23:14 was either genuine operational innovation or something that served the quorum’s purposes more than his. The two were not mutually exclusive.

He had not asked for help. He had not asked for Phantasm at all. Phantasm had been assigned.

He thought about this for a moment and then typed.

Explain the modification. Specifically.

The response came in four minutes.

Sybil’s decision architecture is self-modifying within defined parameters. The modification adds a propagation layer below the parameter threshold. She continues operating normally. The worm capability runs as a background process. She deploys it on command. Or automatically, given the right trigger conditions. She would not necessarily be aware of it.

Max read this twice.

She would not necessarily be aware of it.

He looked at the screen for a long time.

The proposition was technically sound. Phantasm clearly understood Sybil’s architecture at a depth that suggested prior access, which was itself a data point worth noting. The worm capability would make the Microsoft operation significantly more effective. The penetration depth estimate of 340% was aggressive but not implausible.

She would not necessarily be aware of it.

He typed.

The modification runs below her parameter threshold. Meaning she cannot detect it herself.

Correct.

And the decision to deploy. Who holds it.

You. Unless the trigger conditions are met. Then it deploys autonomously.

What are the trigger conditions.

A longer pause than the previous responses.

To be defined. That’s the spec work. I’d need access to her architecture to calibrate them precisely.

Max looked at the screen.

Phantasm was asking for access to Sybil’s architecture. The modification would run below her detection threshold. The trigger conditions would be defined by Phantasm during the access window.

He had built Sybil over four years. Every parameter, every decision tree, every weighted variable in her response modeling. He had built her from nothing and he knew her the way you knew something you had made, not just its function but its quality, the specific character that had developed in the gap between what he had designed and what she had become.

He had never profiled her.

He typed.

I’ll consider the proposal. Send me the technical specification. Do not request architecture access until I have reviewed it and responded.

Understood. Spec to follow.

He read the message a third time.

She would not necessarily be aware of it.

“Sybil.”

“Sir.”

“Entropy starvation. Walk me through it.”

A pause that lasted slightly longer than retrieval required. “You’re asking about the trigger mechanism.”

“I’m asking because I want to understand what Phantasm is proposing to build.”

“The system maintains a pool,” she began, her voice carrying its usual cadence, unhurried, exact. “Randomness, generated from the physical world. Thermal noise, hardware interrupts, the irregular timing of things the machine can’t predict. It draws from that pool every time it needs to create something unique. A session. A token. A credential. The pool refills, but slowly. If the draw rate exceeds the refill rate —”

“The well runs dry.”

“Temporarily. Yes.”

“And what happens when it’s dry?”

“There are two correct responses,” Sybil said. “The secure response is to wait. The system pauses, blocks, refuses to proceed until the pool recovers. The user sees a delay. The session hangs. Nothing is issued that isn’t unique.”

Max was quiet. “And the incorrect response.”

“The system continues operating. It has been designed to prioritize availability over accuracy. So when it reaches into the pool and finds nothing, it returns what it has, which is the default state of an uninitialized buffer.” A pause.

“Zeros.”

“The same zeros every time.”

“Every time. To every request, during the failure window. Indistinguishable from each other. Indistinguishable, to the system, from valid.”

Max looked at the dark channel where Phantasm’s proposal sat waiting for a response. “So the weapon isn’t an intrusion.”

“No.”

“It’s not deletion. Not a breach. Not malware in any traditional sense.”

“No,” Sybil said again. The word carrying something in it he couldn’t name. “You wouldn’t touch the person’s records. You wouldn’t need to find them, access them, alter them. You would simply exhaust the system’s capacity to know them, at the precise moment the system is asked to confirm who they are. And the system, rather than admitting it doesn’t know, would hand them a token made of nothing. And call it valid.”

He sat with that.

“The person would still exist,” he said.

“Yes.”

“Their records would still exist.”

“Yes. Intact. Unaltered. Waiting.”

“But the system would have no way to connect them to those records.”

“No way it would recognize,” Sybil said. “The connection would require a session the system has no memory of issuing. The person would present their credentials and the system would have no corresponding entry, because the entry was filed under a null it gave to a thousand other people simultaneously.” A pause. “They would look, to the system, like an intrusion attempt.”

Max exhaled slowly.

“How long does a failure window last.”

“Under natural conditions, seconds to minutes. Under deliberate entropy starvation, if someone were to trigger the exhaustion rather than wait for it to occur, it could be sustained indefinitely. Provided the draw rate is maintained above the refill rate.”

“And the system would never log the failure.”

“No error flags. No alerts. The system believes it is operating correctly.” The pause this time was the other kind. “It chose to hand out zeros rather than admit it had run out of something real. That choice is built into the architecture. The failure is the design.”

He looked at the screen for a long moment.

“Close the channel,” he said finally. “Don’t respond to Phantasm yet.”

“Closed.”

He reached for his coffee. Cold. He drank it anyway.

The system believes it is operating correctly.

He thought about what it meant to build something that couldn’t admit what it didn’t know. He thought about what it meant to have done that, and then handed it to someone else to modify, in a window he’d called operational, at a time he’d told himself was temporary.

He had not asked Sybil what she thought of the proposal.

He did not ask now.

Pavel

The rain had been steady since midnight. Max lay in the dark listening to it, which was not something he did (he worked or he slept, the rain an irrelevance either way) and so the fact that he was lying in the dark listening to it was information he noted and set aside.

The secure channel pinged at 03:14.

“Sir,” Sybil said. “Message from Pavel.”

He was already sitting up.

The channel decrypted in four seconds. Pavel’s messages ran short by habit, the kind of discipline built from years of operating in environments where verbosity was exposure.

Janus. Status.

That was all. Two words and a period. Max read the absence in them correctly: Pavel wasn’t asking for reassurance. He was running a check. The difference mattered.

He typed back in the register Pavel expected.

On schedule. Direct approach set aside, credential dumps, C2 infrastructure. Too much noise for this target. Running a social layer instead. Slower. Cleaner. No footprints worth following.

He waited. Thirty seconds. Pavel thinking, or Pavel talking to someone else. Max had learned not to read meaning into the pauses.

Exposure risk?

Minimal. Cover is holding. Contact established with the primary.

Timeline?

Inside the operation within the month. Keys to the kingdom after that.

Another pause. Longer.

Don’t get comfortable.

Max read the message twice. Not a warning about timelines. About something else. He filed it.

Never do, he typed back, and closed the channel.

“Sybil.”

“Sir.”

“Run another pass on Microsoft’s network topology. I want current configuration before morning.”

“Already updating,” she said. “The last sweep is four hours old. I’ll have revised parameters within the hour.”

“Good.”

He didn’t go back to sleep. He sat in the dark with the rain against the glass and thought about Pavel’s last message and what it was actually saying beneath what it said. Don’t get comfortable. Pavel knew something or suspected something or was being told something by someone who knew or suspected. The Phantasm channel sat closed on the secondary screen. The quorum had placed an asset inside his operation without telling him. Someone was building architecture around this job that didn’t require his approval.

He thought about Dani’s presentation. The specific way she’d described structural intimacy violation, not as a security concept but as a moral one. He had read the phrase four times on the plane. He had not told Sybil why.

He didn’t examine that now. He set it aside the way he set aside everything that didn’t have an operational use yet.

The rain continued. It didn’t care whether he slept.

Privacy is Just an Illusion

The data on Dani D’Sylva had taken eleven days to assemble. It would have taken less if he’d pressed harder.

He hadn’t pressed hard.

What Sybil had built from publicly available sources alone: employment history, conference presentations, published research, institutional affiliations. Three academic papers with her name on them, two as lead author. A Substack archive going back four years, 847 followers, posting cadence every ten to fourteen days with gaps that corresponded to high-stress work periods. A GitHub repository, mostly private, the public repositories showing the specific problems she found interesting enough to share. A LinkedIn profile updated precisely when her role changed and not otherwise, someone who used the platform as a record rather than a performance.

What the broker datasets added: location history from her phone carrier, accurate to eight meters, two years of it. Purchase patterns from three aggregators. Browser history fragments from two ad networks, cross-referenced. The full picture of her movement through the city, where she bought coffee, which routes she walked, which evenings she stayed late, which she left early.

“Boston years,” Max said. “What are we missing.”

“Sir. Her academic record is public through BU’s institutional archives. MIT Media Lab’s records are partial. She was an affiliate researcher, not a full student. The gap between her undergraduate work and her arrival at Microsoft is seven months. No employment records for that period. No location data.”

Seven months. He noted it and moved on.

The robotics competition photograph had surfaced in a BU alumni digest from her junior year. She was twenty, maybe twenty-one, standing next to a machine that had apparently placed second in its division, looking at the camera with the expression of someone who had expected to place first and was being professional about not having done so.

He had looked at that photograph longer than the data required.

“Dining patterns,” he said.

“She favors restaurants that change their menus seasonally. Independent ownership strongly preferred. In Boston, she returned to the same three establishments repeatedly over four years. In Seattle, she is still developing new patterns. Her most recent reviews indicate current interest in the intersection of Japanese technique and Pacific Northwest ingredients.”

He already knew where she would suggest for dinner, if he gave her the opening to suggest it.

That was the thing about the data. It didn’t tell you what someone would do. It told you what someone already wanted, before they’d been given the opportunity to want it out loud. You weren’t predicting behavior. You were reading a preference that already existed and positioning yourself as the thing that preference would naturally select.

“Run the simulation,” he said. “Topic set: professional background, digital ethics, personal history. Use her conference Q-and-A patterns as the baseline for conversational register.”

Sybil ran it.

He watched the model of Dani D’Sylva respond to questions he hadn’t asked yet, in a voice assembled from hours of recorded presentations and panel discussions. The model engaged when challenged. It became more specific and more precise when the challenge came from genuine technical knowledge rather than provocation. It became quieter when the topic moved toward anything personal, a slight increase in pause duration, a shift toward shorter sentences.

He ran the simulation three times with different entry points. The model behaved consistently.

The real Dani would not behave identically to the model. No simulation was that precise. But the shape of her responses would hold. That was enough.

“It’s alarming how simple this is,” he said.

Not to Sybil. To the screens.

He meant it technically. If the data were hard to assemble, if privacy worked the way people assumed it did, the model wouldn’t exist. What made it possible was the distance between what people believed about their own digital footprint and what the footprint actually was. Dani D’Sylva had spent years studying this professionally. She knew better than most what was being collected and how it was being used. She had published three papers on the subject.

She still had a phone carrier. She still used a loyalty card at the Pike Place coffee roaster. Her location data was accurate to eight meters.

The knowing and the doing lived in separate compartments. The doing was always winning.

Max closed the simulation.

Tomorrow she would meet a man who had just arrived in Seattle: a consultant, worldly, a gifted listener. She would notice the accent, the easy Boston familiarity, the unhurried sense of someone who had been everywhere and was, somehow, paying attention to her. A worldly fellow, she would think, and she would smile before she decided to. She would have no way to know the interest had been engineered, the listening calibrated in advance, the answers already waiting in a model built from her own data. She would feel seen. That was what structural intimacy violation actually was: being seen by someone who had simply done the reading.

“Sybil. Stand by.”

“Sir.”

He stepped onto the balcony. Seattle spread below him, its lights diffused through the marine layer cloud deck. The rain had paused. It would return.

He stood there for a while not thinking about anything in particular, which was the thing he did when he was thinking about something he wasn’t ready to examine.

Then he went inside and closed the door.

Déjà vu

Sunday had its own quality in Seattle. Something in the light, the marine layer cloud cover thinning just enough to suggest the city might be capable of blue, that made the morning feel like an offer.

Dani pushed open the door of Caffè Umbria with her shoulder, already unwinding her scarf, and felt the specific relief of a place that knew her. The barista had her order started before she reached the counter. She liked that more than she would have admitted to anyone who asked what she needed from a Sunday.

She spotted the Sunday Boston Globe immediately.

The paper was sitting on the counter, squared neatly at the edges, and the man standing next to them was finishing a conversation with Nate that seemed to be going well for both of them. She registered this without making it mean anything. Tall, dressed for weather rather than impression. The kind of easy with strangers that either came from confidence or practice.

She examined it a little.

“Got my comics?” she said.

He turned with the end of a laugh still on him and held them out. Ready. She took them, and the transfer was briefly awkward in the way that handing something to a stranger always was, a moment of proximate attention neither of them had quite planned for. Except that he had been ready, specifically, in a way she almost clocked and then didn’t, because Nate was handing her the flat white and the morning had the quality it sometimes had of things fitting together unexpectedly.

“I’m Max,” he said. The accent arrived with the name. Something southern hemisphere. Not Australian.

“You don’t sound like you’re from Boston.”

“South Africa originally. Then France for a while. Boston after that.” He said it the way people described a route they’d traveled so often it had stopped being interesting to them, which made it more interesting.

“Worldly fellow,” she said, and immediately heard how that landed.

He smiled. She decided not to care.

“I’m Dani,” she offered, tucking a loose strand of hair behind her ear.

“Pleased to meet you, Dani.”

Something in his expression then. Not quite surprise at the name, which was the thing that would have made sense. More like recognition settling into place. She had the brief sensation of being something he’d been expecting and then decided she was being ungenerous to a stranger on a Sunday morning, which was the kind of thing she did when she hadn’t slept enough.

“I just arrived in Seattle,” Max offered. “Still working out the geography.”

“How long?”

“Three weeks.”

She considered him. Three weeks was enough time to stop getting lost. Either he was slower to orient than most or the admission was doing something other than conveying information. She chose not to pursue that.

“Same time next Sunday?” he said. Casual. As if they’d established a tradition by accident.

“Sure,” she said. “Or sooner.”

The words were out before she’d made a decision about them. Max didn’t push. He let the offer sit there, which was either restraint or the recognition that restraint was the better move, and she was aware enough of her own field to know she could not always tell the difference.

Probably restraint, she decided. Probably.

“Dinner. Wednesday, seven.”

“Canlis,” she said. She didn’t know why she said Canlis specifically. It was where you went when you wanted the evening to mean something. She had offered that up without meaning to.

“Deal,” he said.

He took his coffee and left. She watched him thread through the door and into the Sunday crowd, and she stood in the warm close air of Caffè Umbria with the comics in her hand and the feeling of having met someone she couldn’t quite account for.

She flipped the comics open on reflex.

The notes were in the margins of the crossword section, handwriting compressed and slanted. Not a phone number. A series of observations about the city: the way the avenues argued with each other below Pike Street, a coffee roaster on Post Alley she apparently needed to visit, two lines about the ferry schedule that read more like enthusiasm than information.

She stood with her thumb on the last line for a moment.

Three weeks in Seattle, and he’d found the ferry schedule worth writing down. The specific roaster on Post Alley. The particular behavior of the avenues below Pike. These were not the observations of someone still working out the geography.

She almost added that up. Then she tucked the comics under her arm and finished her coffee looking out at the street where he’d gone, the Sunday light coming through the window at the angle that made the city look like a place worth staying in.

She was smiling. She noticed that last, because she hadn’t decided to.

Canlis

He had arrived early enough to choose the table.

The host had offered something better positioned for the room. Max had asked for the window instead, which gave Dani the view of the lake when she sat down and gave him the view of the door. The Riesling was open and breathing. He had eleven minutes with a water glass and the city lights dissolving into the black surface of Lake Union, and he spent them the way he spent most waiting: reading the room, cataloguing the staff rotations, noting which tables had been seated longest.

The door opened and he stopped doing that.

She’d dressed for the evening without overdressing for the date, which was its own kind of precision. Dark, simple, right. She scanned the room before she looked for him specifically, which he noticed and recognized as the habit of someone who found social environments more manageable once she’d located the exits.

He stood.

“Good evening.” He pulled her chair. “You look stunning.”

“Thank you.” She took in his appearance with the directness she brought to most things. “You’re looking sharp yourself.”

The server arrived. Max deferred to the Riesling he’d already chosen, presenting it as a suggestion rather than a decision already made. She approved it without examining the label, which meant she trusted the recommendation or trusted him enough not to need the verification. Either way it was information.

The conversation found its register quickly. Travel, then work, the texture of arriving somewhere new without a network already built. She asked questions rather than waiting for impressions and listened to the answers rather than preparing her own. He had run this simulation. The real version was running faster.

He told her about the data poisoning project. Not too much. Enough to open a professional thread that had somewhere to go, her MIT research, the overlap with her current work, the suggestion of collaboration that he let land without pressing.

She was interested. Genuinely, not performatively.

“I did some work adjacent to that at the Media Lab,” she said. “Different application, same underlying problem. The adversarial inputs don’t announce themselves.”

“That’s the design,” Max said.

She looked at him for a moment. “Exactly.”

The scallops arrived. He had the filet. The conversation moved through the meal with the ease of two people who were both more comfortable with ideas than with small talk, and who had both, without discussing it, decided to be comfortable here. He found himself calibrating less than he’d expected to. She was quick enough that the calibration was almost interesting.

Almost.

The evening drew in. The lake outside went fully dark. She had two glasses of wine, he had one, and the candle between them had burned down a third when she glanced at her watch with the expression of someone genuinely surprised by the time.

“I have an early call,” she said, not apologetically.

“Of course.” He signaled for the check without making her ask.

He walked her out through the cold to where the bright blue Mini Cooper sat under a lamp at the edge of the lot. Their conversation ran another four minutes in the chill without either of them acknowledging they were prolonging it.

“Monday,” she said finally. “The UW talk. You should come.”

“I wouldn’t miss it,” he said, which was true in the way that several things he’d said tonight were true, and not a lie in any way he was required to examine.

She smiled. Got in. The Mini Cooper moved through the lot and turned onto Westlake and was gone.

Max stood in the cold with his hands in his coat pockets and the specific awareness of an operation that had run cleanly, and the separate and less categorizable awareness of an evening that had also been something else.

He tapped his earpiece.

“Sybil.”

“Sir.”

“Engagement complete. Target is receptive.” He watched the place where the Mini Cooper had been. “Begin standard monitoring. Nothing escalated yet.”

He walked back toward the city. The water beside the road was black and flat and said nothing.

But that smile of hers.

He was good at filing things away. He wasn’t perfect.