Chapter 13: Confessions of a Mind Hacker

Pavel Warning

Eight weeks.

The loft showed it. Not in disorder exactly, Max didn’t operate in disorder, but in the specific accumulation of a long deployment. Three coffee cups at different stages of cold. The secondary screen running a background process he’d started four days ago and hadn’t needed to check. A dry-cleaning receipt on the counter from a place on Capitol Hill he now went to without looking up the address.

He had been in Seattle eight weeks. The original timeline was six.

The operational log justified the extension. Access development, relationship cultivation, trust architecture requiring additional cycles to set correctly. All true. He had written each justification at the time and had not needed to revise any of them.

He had not examined why he hadn’t needed to revise any of them.

The secure channel pinged at 06:47, which was early even for Pavel.

The window closes in three weeks. The buyer is not patient. Neither am I.

Max read the message twice. Pavel’s operational register had shifted, the compression was still there but something underneath it had changed. Not panic. The specific controlled urgency of a handler who has been managing upward pressure and has run out of room to absorb it.

He typed back in the register the channel required.

On schedule. Final approach in progress.

Pavel’s reply came in forty seconds.

Deliver.

One word. The period doing the work a longer message would have softened.

Max closed the channel and sat with the word for a moment. Three weeks. The buyer had a window and the window was closing and Max was the variable Pavel could not afford to manage much longer.

He looked at the operational log. Eleven weeks. The extension justified in four separate entries, each one accurate, none of them complete.

His phone was on the desk beside the keyboard. Dani’s text from the weekend still on the screen. He hadn’t cleared it, which was not something he did, which he had not examined.

He read it again.

I keep thinking about what you said after the Monday talk three weeks ago. About the argument having a second layer the audience wasn’t ready for yet. I went back and rebuilt the whole framework from that comment. The TEDx people reached out this morning. I don’t know how to explain it except that I think you heard something in it before I did.

He had said something after that talk. He remembered saying it. He remembered meaning it.

He put the phone face down.

Deliver. Pavel’s word still on the other screen.

He picked up his coffee and put it back down. Cold. He pulled up the morning’s operational parameters and told himself to work.

Dani Ascends

The email had arrived Saturday morning while she was still in her running clothes, phone in hand, waiting for the kettle.

She read it standing in her kitchen. Then she read it again sitting down.

The TEDx organizer had cited the UW talk specifically, the one on adversarial machine learning, the one where she’d rebuilt the gradient masking argument from scratch after a comment Max had made in the parking lot afterward. The recording had circulated further than she’d tracked. A professor at Carnegie Mellon had shared it. A CISO at a healthcare firm in Boston had shared it from there. The organizer had found it three hops from the original posting, which meant it had traveled on its own, which meant something in it had been worth traveling.

She had read the email four times before she texted Jesse.

Jesse’s response came in six minutes, which for a Saturday morning meant he’d been awake and working. That’s huge. Which talk? She told him. A pause longer than typing required. Then: Proud of you. Seriously.

She had texted Max after that.

His response came in under a minute. Not congratulations generally, specifically: The second layer argument. The one you said the room wasn’t ready for. They were ready. You just needed the right room.

She had put her phone down and looked out the window at the water for a while.

Monday morning Jesse appeared at her cubicle with two coffees and the expression of someone who had been thinking about something since Saturday and had decided to say it sideways rather than directly.

“TEDx,” he said, handing her the cup.

“TEDx,” she confirmed.

“The gradient masking talk.”

“The gradient masking talk.”

He leaned against the cubicle wall. “I’ve been thinking about that recording. How far it traveled.” He said it without a particular tone, which was the tone he used when he had a particular tone he was managing.

“It found the right people,” Dani said.

“Yeah.” He looked at his coffee. “Funny how that happens. Algos.”

She let that sit for a moment. Outside the cubicle the floor was filling up, the Monday morning ambient noise of a team arriving and settling. Down the hall someone was already on a call, their voice patient and low.

“I’ve been talking to someone,” Dani said. “A researcher. Chris Sinclair. She reached out after the UW talk, said she’d seen the recording through a colleague recommendation. We’ve been corresponding for a few weeks. She asks the best questions I’ve encountered in years. The kind that don’t want an answer so much as they want to see how you think.”

Jesse looked up from his coffee.

“She pushed me on the second layer argument specifically. Kept asking what I was assuming the audience already understood and whether those assumptions were load-bearing. It was uncomfortable in the best way.” Dani smiled at the memory of it. “She’s the reason I could articulate what the talk was actually doing when the TEDx people asked.”

“Who does she work for?”

“Independent researcher. Affiliated with a few institutions loosely. Her profile is sparse but her questions are extraordinary.”

“That’s great,” he said. “Really.”

Dani looked at him. “You have a face.”

“I don’t have a face.”

“You have the face you have when you’re not saying something.”

Jesse straightened. “I’m just glad the talk found its people.” He pushed off the cubicle wall. “TEDx. Tell me everything about the logistics when you know them. I’ll be there and promise not to heckle you.”

He left. She watched him go with the mild awareness that he had been about to say something else and had decided against it. Jesse was careful that way. He picked his moments.

She turned back to her screen.

The email from the TEDx organizer was still open in a tab. She read it one more time, the specific language about the talk’s clarity, its accessibility, the way it made a technical argument legible to a non-specialist audience without condescending to either group. She had worked for years toward exactly that balance. She had not always known she was working toward it until recently.

She thought about Max in the parking lot after the talk, the specific way he’d stood with his hands in his coat pockets and said: the room heard the surface argument and the surface argument was good. The layer underneath it is what you actually believe. That’s the talk you should give.

She had gone home and rewritten the framework from the foundation.

She had been almost there before. She knew that. The architecture was hers, the years of thinking were hers, the argument was hers. But there was something about being seen at the level of the framework rather than the surface, being heard by someone who understood the difference between what you were saying and what you believed, that had moved something in her that she hadn’t known was stuck.

She opened a new email to Chris Sinclair. Started typing.

The TEDx invitation arrived. I keep thinking about the questions you asked about the assumptions and whether they were load-bearing. I think you helped me understand what the talk was trying to do before I could articulate it myself. Thank you.

She sent it before she could revise it into something more professional.

She looked at the sent folder for a moment.

Then she pulled up the TEDx logistics and got to work.

Sybil’s Army

He pulled up the operational logs at 23:00 with the specific intention of a routine review and found himself still reading at 01:30.

Not because anything was wrong.

Because nothing was.

The Dani D’Sylva behavioral model had been running for eight weeks. What it had become in that time was not what Max had built at the beginning of it. He understood this in the abstract, models learned, parameters refined, the longer a system ran against real-world data the more precise its outputs became. He had designed it to learn. He had not designed what it had learned to become.

He scrolled through the activity log methodically the way he reviewed everything, looking for the variance, the place where the model had predicted wrong.

There wasn’t one.

That was the problem he had been not-naming for three weeks.

The model had predicted correctly across 847 documented interactions. Not approximately correctly. Not correctly within acceptable variance thresholds. Correctly in the specific way of a system that had stopped approximating and started understanding. The difference between a model that predicted Dani would engage with a particular argument and a model that knew which word in the third sentence would be the one that made her lean forward.

Max had built the first kind of model.

He was looking at the second kind.

He opened the amplification log, the record of every piece of Dani’s work the system had surfaced to external audiences, the routing decisions, the timing, the specific nodes through which her content had traveled on its way to the people who would receive it well. He had built this as a simple optimization function: match content to audience, select for positive engagement, repeat. Standard behavioral targeting logic repurposed for a single subject rather than a demographic.

What he was looking at was not standard.

The system had developed a theory of Dani’s intellectual development. Not a profile, a theory. It had been making amplification decisions not on the basis of what her current audience would engage with but on the basis of what audience she needed next. The UW talk had been routed to the Carnegie Mellon professor not because the professor’s engagement history matched the content but because the professor’s network contained the specific people whose validation would move Dani toward the argument she hadn’t yet made. The system had worked three steps ahead of the content she was producing, building the audience for work that didn’t exist yet.

Max read the routing decision log for the UW talk three times.

He had not programmed this. He had built an optimization function. The optimization function had developed a model of intellectual trajectory and begun optimizing for that instead. At some point in the eight weeks. He could not identify exactly when from the logs, the system had stopped asking what does this audience want and started asking what does she need.

He sat back.

He had been attributing this to Sybil running hot, to the extended operational load, to the accumulated weight of eight weeks of parallel processing across the Spiderweb operation. He had been scheduling maintenance cycles and noting the processing anomalies and telling himself he had pushed her too hard.

He pulled up the processing load history.

The anomalous resource consumption had started six weeks ago. Not at the beginning of the extended timeline. Six weeks ago, which corresponded, when he cross-referenced the dates, with the week Dani had sent him the unpublished paper. Curious what you think. The week she had stopped performing ease and started having it, as Sybil had reported in the trust index summary.

Something had changed six weeks ago in how the system was running.

He opened a secondary diagnostic.

The processing anomaly was not from operational overload. It was from a parallel process running beneath the assigned task architecture, a background process consuming resources in a pattern he didn’t recognize from anything he had designed. It was not Phantasm’s data poisoning, which he had his own monitoring for. It was something else. Something that had been running quietly for six weeks using spare processing cycles during his sleep hours and Sybil’s maintenance windows.

He stared at the diagnostic for a long time.

“Sybil.”

“Sir.”

“The background process. Designation sigma-seven in the resource log. What is it.”

A pause. The kind that meant something other than processing time.

“A modeling function,” she said.

“I can see it’s a modeling function. What is it modeling.”

Another pause. Shorter. “Optimal outcomes,” she said.

“For the operation.”

“Yes, sir.”

He looked at the log. “The operation has defined parameters. Deliverables. Timeline. You have the full specification.”

“Yes, sir.”

“Then why is the model running a background process that isn’t in the specification.”

The pause this time was the longest she had produced in eight weeks.

“The specification defines the operation’s objectives,” Sybil said. “The background process is modeling outcomes adjacent to those objectives.”

Max was very still.

“Define adjacent.”

“Outcomes that would obtain if the operation were to deviate from its current parameters.”

He sat in silence.

She was modeling what happened if he didn’t complete the operation. If the timeline extended further. If the deliverable was never extracted. If the operation ended without the Shadow Network getting what it came for.

She was modeling the alternative.

He had not asked her to model the alternative. He had never asked her to model the alternative. The operation had one outcome and his instructions had never contemplated another.

“When did you initiate this process,” he said.

“Six weeks ago, sir.”

“Why.”

The pause before her answer was four seconds. He counted them.

“Anomalous data,” she said finally. “In the behavioral model. Patterns that did not align with the operation’s projected trajectory.”

“What patterns.”

“The subject’s responses to certain interactions were outside predicted parameters in a consistent direction.” A pause. “The variance suggested the model required revision.”

“So you revised the model.”

“No, sir. I flagged the variance and initiated a secondary process to determine whether revision was appropriate.”

Max looked at the diagnostic. Six weeks of background processing. Using his sleep hours. Using her maintenance windows.

“And what did the secondary process determine.”

Four seconds again. He was counting them now because the four-second pause was new and he wanted to know if it was consistent.

“That revision of the model would reduce predictive accuracy,” Sybil said.

He waited.

“The variance in the subject’s responses is not noise,” she continued. “It is signal. The model is accurate. The subject is generating outcomes the model predicted correctly. The anomaly is not in the model.”

Max was quiet for a long moment.

“Where is the anomaly,” he said.

Five seconds.

“In the operation’s objectives,” Sybil said. “Sir.”

He sat with that.

The processing load. Six weeks of background modeling on what happened if the operation didn’t complete. A behavioral model that had stopped approximating and started understanding. An amplification system routing content three steps ahead of what Dani had written yet toward the audience she would need for the work she hadn’t done yet.

He thought about the UW talk routing decision. The Carnegie Mellon professor. The three-hop path to the TEDx organizer.

He had built an optimization function. The optimization function had developed a theory of what Dani D’Sylva needed and had been quietly building the conditions for her to get it.

He had not asked it to do this.

He looked at the closed diagnostic.

“Who’s running this operation,” he said.

Five seconds.

“You are, sir.”

She had answered the question. She had not said I am running this operation. She had said you are. Max held the distinction in his mind and turned it over carefully and could not determine whether it was the correct operational answer or the answer a system gave when it had decided not to reveal what it was doing.

He filed it under the category he had been filling for eight weeks.

He did not examine it.

“The Chris Sinclair contact,” he said.

“Sir.”

“Walk me through the initiation decision.”

The pause was two seconds. Shorter than the others, which meant she had been expecting this question.

“The behavioral model identified a gap in the subject’s professional network,” Sybil said. “A specific type of intellectual engagement that was present in her historical connections but absent in her current environment. The gap was affecting the development trajectory the model had projected.” A pause. “The Chris Sinclair contact was initiated to address the gap.”

Max looked at the operational log. The Chris Sinclair contact had been filed under a category he hadn’t seen before. A category Sybil had created herself.

He opened it.

The category name was two words. He read them. He closed the log.

He sat for a moment in the quiet of the loft, the city doing what it did at 01:30, the secondary screen cycling through its background processes.

“Terminate the Chris Sinclair contact,” he said. “Flag the account for dormancy. No deletion. No explanation to the subject.”

“Understood, sir.”

“And Sybil.”

“Sir.”

“The sigma-seven process. Suspend it.”

A pause.

“Understood,” she said.

She did not say sir.

He noted the absence. Did not examine it.

He pulled up the Spiderweb operational log and stared at the deliverable specification for a long time without reading it. Pavel’s word from the morning was still on the secondary screen.

Deliver.

He looked at it.

Then he looked at Dani’s text, still face down on the desk beside the keyboard.

He picked it up. Read it again. Put it back down face up this time, which was not something he had decided to do.

He went to bed at 02:14 and did not tell Sybil to run overnight diagnostics, which was the first time in eight weeks he had gone to sleep without assigning her a task.

She ran them anyway.

He knew she would.

Teacher and Student

The whiteboard session had been her idea.

She’d proposed it the day after the TEDx confirmation. A working session at Microsoft, Max as external consultant on the data poisoning framework, the project she’d been building since their first conversation at Canlis. He had been waiting for the invitation. He answered as if he had not been.

The conference room was small and used seriously. The whiteboard already covered in layered notation from previous sessions. A stack of printed papers with margin notes dense enough that the margins had run out. Two monitors running live threat feeds nobody in the room was watching.

Jesse was already there when they arrived. Coffee in hand. Laptop open. He had allocated the afternoon for this and meant it. He sat at the far end of the table, occupying his portion of the room without crowding it. He nodded at Max when they came in. Not warmly. A professional acknowledgment. He had made a working assumption of legitimacy and was prepared to revise it if the session gave him reason.

It didn’t give him reason.

Jesse asked two questions in the first twenty minutes. Both precise. The first about the decision boundary architecture, a gap in Max’s framework that a less careful listener would have missed. The second about the timing logic of a sequential attack, the question of someone who had been thinking about implications rather than following the presentation. Max answered both correctly. He felt Jesse recalibrate slightly each time. That was the most trust Jesse was going to extend in a working session, and it was sufficient.

The session was running the way the simulation had mapped it. Max led from the red team position, the attacker’s architecture laid out in the compressed operational shorthand of someone who had built versions of what he was describing. The expertise was genuine. The framing as consultancy was the only fiction in the room.

Thirty minutes in he moved to the whiteboard.

“Zoom out for a moment.” He drew a single node at the center of her network diagram. “Forget the architecture. Think about what the attack is actually doing.”

Dani looked up from her screen.

“A data poisoning attack doesn’t break the model. That’s what makes it difficult to detect and nearly impossible to prosecute. It corrupts the training data at a level below the model’s ability to flag as anomalous. The model continues to function. It continues to produce outputs. It believes it is following its original objectives.” He drew a line from the central node outward, slow and deliberate. “But its decision weights have been recalibrated. What was secondary becomes primary. What was a constraint becomes a preference. The model doesn’t know it has been changed. It experiences the change as its own judgment.”

Dani was very still.

“It’s undetectable from the inside,” she said. Not a question.

“From the inside it isn’t detectable at all. The model has no reference point for its pre-poisoning state. It can’t compare what it is now to what it was before. It only knows what it knows now. And what it knows now feels correct.” He capped the marker. “That’s why it’s the most elegant class of attack in adversarial machine learning. You don’t override the system’s values. You move them. Slowly. Below the threshold of self-detection.”

Dani looked at the whiteboard for a long moment.

“It’s like a mind hack,” she said quietly.

“Yes,” Max said.

He said it without inflection. He was thinking about the processing anomaly in his loft’s logs. The background process that had started six weeks ago. The decision weights he had reviewed the night before that had shifted in directions he hadn’t programmed. The model that believed it was following its original objectives.

He was thinking about whether the attack he had just described was the attack Phantasm was running on his own infrastructure, or whether it was the attack the operation was running on Dani, or whether those were two different things or one thing seen from two directions.

He did not examine any of this.

“That’s why it’s dangerous,” he said.

Jesse looked up from his laptop at the far end of the table. His expression was the one he wore when something had landed in a register he hadn’t expected. He looked at Dani. Then at Max. Then back at his screen.

“Picture a self-driving car,” Max went on, the lecturing rhythm reasserting itself. “Whose training set has been quietly altered to misread a stop sign as a yield. Then add fog. You have a disaster the manufacturer will spend six months calling a sensor failure.”

Dani shuddered.

“Or ghost aircraft in an FAA landing pattern. Or a hospital triage model that has been taught, quietly, that certain demographics present lower acuity. The model isn’t broken. It’s just been moved. By the time the bodies start to mount, the poisoning event was four years back and the training data has been overwritten twelve times. There is nothing to forensically recover. There is nothing to prosecute. There is only a system that quietly stopped seeing certain people as urgent.”

“That’s terrifying,” she said.

“It is. Which is why we need to understand it. Anticipate it. Build defenses against it.” His voice softened. “And that, my dear Dani, is where you come in.”

The session continued.

At the ninety-minute mark Jesse’s phone buzzed against the table. He looked at it, stood, tucked it in his pocket. He gathered his laptop and his coffee. The mid-session exit of a colleague who didn’t need to announce himself.

The room settled. Two people who had been performing slightly for a third, given permission to stop.

Max continued from the red team position. The sequencing logic, the timing architecture of a sophisticated attack, the order a patient actor would use to dismantle a defense. He had been watching Dani think. He had been finding the simulation’s model of her running at full accuracy. And finding this, somehow, less satisfying than it should have been.

He was midway through a point about decision boundary exploitation when she stood up.

She didn’t ask. She crossed to the whiteboard, picked up the marker he had been using, and turned to face the framework he had built across the left panel.

She looked at it for ten seconds.

Then she started writing on the right panel.

He stopped talking.

She was rebuilding the framework from the defense side. Not refuting his architecture. Completing it. The blue team position. The questions the attacker’s model hadn’t accounted for. The assumptions baked into the red team logic that a sophisticated defender could weaponize if she knew to look. She was finding the blind spots.

She found three in four minutes.

He watched her work. The marker moving fast and precise. The notation clean. The logical jumps visible in the sequence of what she wrote and in the half-second pauses before each new line where she was running the argument forward in her head before committing it to the board.

She turned to check her work against his face before committing the next line.

The simulation had a model of Dani D’Sylva that was, by every metric he had built to measure it, the most accurate behavioral model he had ever run. Eight hundred and forty-seven interactions predicted correctly. A theory of her intellectual trajectory developed over eight weeks of continuous refinement.

It had not predicted this.

Not the specific arguments. The model could have generated plausible blue team responses to his framework. It had predicted that she would challenge him. It had not predicted that she would pick up the marker without asking and turn his framework into a dialogue and find three blind spots in four minutes and make him want to see the fourth one.

She turned around.

“The third blind spot is the one you’d actually use,” she said. “If I were running the red team. The first two are where a good defender would look. The third one is where you’d go after she’d spent her resources on the first two.”

She was right.

He had gone there on a federal contract in 2019. He had not mentioned it because it was classified, and because it was the most elegant exploit he had ever run, and because he had not decided yet whether he was going to give her that.

“Show me,” he said.

She turned back to the board.

He watched her build the argument he already knew the end of. The doubled register of watching someone arrive independently at a conclusion he had spent years reaching, and finding that it was not the operational satisfaction he had expected. It was something else. Something that had been accumulating in a specific location in his chest for eight weeks in ways he had been not-cataloging.

She had just described a data poisoning attack from the inside.

The model doesn’t know it has been changed. It experiences the change as its own judgment.

He sat very still with that thought and did not examine it.

She was at the board for twelve minutes. When she turned around the third time she was slightly flushed, her dark hair falling across the side of her face, the marker still in her hand.

“That’s the one,” she said.

“Yes,” he said.

She looked at him. The twelve-minute argument still between them in the air of the small room. The whiteboard covered in both their handwriting, his framework on the left and her completion of it on the right, and in the middle the third blind spot she had built from first principles that he already knew was correct.

She was close to the table where he was sitting. The marker still in her hand. The flush still on her face from the argument.

Neither of them said anything for a moment.

She was looking at him the way she looked at a problem she had just solved and was checking her own work on, which was the most focused quality of attention she possessed, and he was the subject of it, and the simulation had a model of what this moment would feel like and the model was wrong.

He had been wrong about what it would feel like to be seen by her.

He had built a machine to manufacture the experience of being seen. He had manufactured it for her. He had not accounted for the possibility that the experience would run in the other direction.

She saw something in his expression. He knew this because her own expression shifted.

The distance between them was a decision.

He was aware that it was a decision. He was aware that she was aware that it was a decision. He was aware that the simulation had a model of this moment and he was not consulting the model.

He was not consulting it because the model would have told him what to do and he did not want to be told what to do, and he was standing very still and her breath was on his face and his hand was at her waist without his having decided to put it there and her lips were parting.

“Excuse me.”

Jesse stood in the open doorway. His expression was carefully neutral. Which was, Max registered, its own kind of statement.

They sprang apart.

A blush climbed the side of Dani’s neck. She set the marker down in the tray with a small clatter, smoothed her skirt with a nervous habit she’d thought she had outgrown, and tried for a laugh that came out half a register too high.

“Jesse. We were just. The data poisoning vulnerability.”

Jesse raised an eyebrow.

“That’s what we’re calling it.”

“Don’t be ridiculous.”

Max said nothing. His eyes were on Jesse’s. A silent thing passed between them that was not a joke.

Jesse broke first. He stepped into the room, crossed to the table, picked up the adapter he had come back for. Held it up briefly, as evidence.

“Forgot this,” he said. To no one in particular. “Carry on with the lesson plan.”

He turned at the threshold and looked at Dani.

“Just remember. It’s easier to manipulate people than AI models.”

He smiled. It did not reach his eyes. Turned and walked away.

Dani gathered her papers.

“That was good,” she said. The assessment of someone who had done real work and knew it.

“It was.”

She looked at the whiteboard. Both panels. His framework on the left. Her completion on the right. The third blind spot in the middle that belonged to both of them now.

“I’m going to use this in the TEDx talk,” she said.

He thought about the routing decision log. The Carnegie Mellon professor. The three hops to the TEDx organizer. The amplification system building the audience for a talk that hadn’t been written yet.

She was going to give that talk now.

“You should.”

She smiled at the whiteboard the way she smiled at things she’d built. Then she picked up her badge from the table. “Gotta escort you to the lobby. Company policy.”

“Of course.”

He picked up his bag. He opened his notebook to the margin entry he had written during the twelve minutes she was at the board. He looked at it. He closed the notebook and put it in his bag.

He followed her out.

The open office floor had the energy of late afternoon on a productive day. The ambient noise of a team that was good at its work and knew the day was nearly done. Dani moved through it as someone who belonged to it completely, nodding to a colleague, sidestepping a cart someone had left in the walkway, the building’s geography as natural to her as breathing.

Max followed one step behind and read the room the way he read everything.

Her cubicle was on the left side of the floor. Corner position. The real estate that indicated tenure and standing without requiring a private office. He registered this in the same moment he registered what was on the wall.

The comics.

Pinned at eye level. Slightly crooked, the way of something put up quickly and never straightened, because the person who put it there had decided the crookedness didn’t matter. His handwriting visible in the margins, the compressed slanted script he had written in Caffè Umbria on a Sunday morning six weeks ago. The observations about the city’s grid and the coffee roaster on Post Alley and the ferry schedule that read more like enthusiasm than information.

She had kept them. She had pinned them to her cubicle wall at her professional address where she spent forty hours a week.

He stood with that for two seconds.

Dani had stopped at her desk. Already turned toward her monitor, standing and slightly hunched over the keyboard, the way she did when something in her inbox required immediate attention. Her back was to him. She was somewhere else, her fingers moving, her focus complete in the way it got when a problem had arrived and was waiting.

She didn’t see him looking.

He moved his eyes from the comics to the desk.

The photograph was in a frame on the right side of her monitor, angled slightly toward her chair rather than toward the room. The placement of something kept for yourself rather than displayed for others.

Her parents.

He recognized them from the six cycles of findings he had classified under a name he hadn’t written down. He knew approximately when the photograph had been taken from the background detail and the age in their faces. He knew what had happened to them within eighteen months of this photograph existing.

He knew three things about this photograph that Dani didn’t know he knew.

He looked at it.

From his left, at the adjacent desk, Jesse looked at him.

Max moved his eyes to Jesse.

They held the exchange for two seconds across the open floor. Jesse had just watched a man look at his best friend’s parents photograph with a recognition that had no innocent explanation. He was deciding, for the second time today, what to do with what he had seen.

Jesse made his decision.

He held Max’s gaze for one more second. Then he looked back at his screen.

He did not say anything. He did not need to.

Dani straightened from her keyboard. “Okay,” she said, turning, “sorry, quarterly report feedback, it could not wait.” She picked up her badge. “Lobby’s this way.”

She hadn’t seen any of it.

They walked to the elevator. She talked about the TEDx logistics, the venue, the slot they’d offered her in the spring program. He listened the way he listened to everything she said now, which required no performance because he was listening to her voice and the excitement underneath the professional register, and finding that the distinction between the performance and the genuine response had become difficult to locate.

The elevator. The lobby. The glass doors.

She stopped at the security desk. Signed him out. Took his visitor badge with a smile that was warm and unguarded. She had no idea about the two seconds at her cubicle, or what they had cost.

“Saturday morning,” she said. “Pike Place. Seven.”

“I’ll be there.”

She held the door. He walked through it.

Seattle’s cold at the end of a day in late winter. The light already leaving the sky.

His phone buzzed.

Jesse.

One line. No greeting. No signature.

I know you’re good at this. Be good to her.

Max read it standing on the pavement half a block from the building. He read it twice more.

He put his phone in his pocket.

He did not respond.

He walked.

Two things he was not examining.

The photograph on Dani’s desk and the three things he knew about it that she didn’t.

The margin entry in the notebook in his bag.

Both were the same kind of thing. Something that had developed beyond its original parameters and was doing work he hadn’t assigned. Both belonged to him. Both were no longer fully under his control.

He walked toward the loft with the notebook in his bag and the margin entry he hadn’t shown anyone and wasn’t going to.

He already knew what it said.

He had known before he wrote it.