I have worked the national security mission for more than twenty years, first building capabilities that people wiser than I was had defined, then designing the ones we would build, deploy, operate and support. As I became a lot less young and a little more wise, that meant I spent a good part of my day in non-English documents, systems, and data.

I do not have the talent for foreign languages. That’s an understatement. I have to study to be able to use a single curse word in a foreign language. So long ago I evolved a workflow that accommodated my weakness at languages. That foreign-language information went through static translation tools first, some commercial, some government-built, and all awful at the technical terminology I actually needed to understand. Then I worked the rest of the project in my native English. Translate first, then work.

In 20/20 hindsight the workflow was horrendous. It’s not just that the tools were bad. They were. It is that the whole workflow was held back by my weakness. On the rare occasion that I brought in a human translator they themselves didn’t understand the technical idioms to translate them. That part of my workflow is where information was lost. I never took a hard look at the step that worked. It kept working, so it stayed.

The kinda-upgrade

That translation stage before I performed real work became that baby picture on your fridge that you never look at, that you can’t even figure out which kid it is. I was always looking for a better translator, and then machine translation got really really good.

A better tool replacing an old tool doesn’t change things much. You might get more productivity, cheaper results, more safety, better precision. But you’re getting the same thing in the end. Large language models (LLMs) are really, really good at translation. They handle even highly idiomatic material, and they turn it into English I can actually use. I put them in as the translator in my workflow long ago. I have had my GPUs burning tokens for months translating piles of data into English and making my home office too warm for comfort.

But nothing really changed. Sure, I could do more projects, and do them more quickly. My projects were still in English. I searched for data in English even when the source data was in other languages. All of the incremental results were in English because English is what I think in. A workflow is a set of assumptions with tools plugged into them, and the assumption underneath mine was that the world had to become English before I could make sense of it.

I have been re-evaluating so many of my assumptions about China this summer that identifying those assumptions must be becoming habit. I finally took that ancient baby picture off the fridge, turned it around, and realized it wasn’t even a picture of my kid. In this case, the project was a pile of 70m court records. The plan was the same old plan: translate all of it, then do the research. I left the translation job running on my GPUs and walked away with a tool tracking the progress so I knew when I could start sifting through the data for what I suspected was in there. The first reading said six years. The last reading that day said twenty-five years. That’s not a graph you want to see go up and to the right.

Each dot is one reading of the running translation service on a single day. The red trace is that service’s own estimate to complete the whole pile of data, and the flat gray trace underneath is the share it had actually finished translating.

My workflow was blocked by translation. I have been far more productive this year by using LLMs to translate my smaller data holdings. I replaced the tool with a better tool. Then the thing that changed my workflow is easier to explain with something that happened to me as a programmer.

When code was code

Fluency in a particular programming language is something that you lose the need for. When I was a younger software engineer I wrote everything in C and assembler. That was the work. Then the work shifted. New projects came with new languages, new targets came with new hardware architectures, and each architecture meant learning to read and write its assembler from scratch. I learned tons of them. Sparc assembler still holds a special place in my heart. Each programming language had its own grammar, and each processor architecture had its own machine quirks in the assembler.

Then at some point, code just became code. A new language was no longer a new thing to learn. It was just a new dialect of what I already knew. After a few minutes with its nuances and its grammar I could read it, write it, and cuss out Larry Wall if it reminded me of Perl. The syntax was the surface. Underneath it, every language was expressing the same small set of ideas about data and control, and once I could see the ideas the surface stopped mattering. A computer worked like a computer regardless of programming language.

I did not notice the workflow boundary when I crossed it. I doubt anyone does. There is no day when you are a C programmer in the morning and a programmer in the afternoon. You find out later, when someone hands you something in a language you have never seen, you read it anyway, see the vulnerability, and can write the fix. Code was code regardless of language. What you have stopped needing is the translation. You no longer take the new language back to the one you learned first in order to understand it. You understand it as it is.

The large language model crossed the same boundary. So had I, long before, in a programming language domain. And I still failed to truly internalize that the machine did it.

When language is language

Something funny happened recently on the way to a past Substack article. I stopped working in English. The recognition arrived the way the programming one did. Late and not with a bang but with a whimper.

The LLM works on language. It is a large language model. If it was largely trained, then language is language to it. The same way code became code to me. It does not take a document back to English in order to understand it, any more than I would take a programming language back to my native C language. It understands the data where it is. And a vision model does the same thing with pictures: it encodes an image into tokens, which is the same framework the model was going to reason over anyway. Inside the AI there are only tokens of language, not individual languages.

The translation that finished in the graph below shows you why the one that did not was never going to. I translated the metadata: the court names, the causes of legal action, the place names, and the document titles. They all finished in 83 minutes because most of those were repeated many times across the database. The pile of document bodies was never going to translate in my budget, or my attention span.

The two dots are counts on a logarithmic scale, which is the only scale that lets both sit on one axis, and the bars beneath are how much of each was translated.

I and the research projects needed those initial translations. Like it or not, the frontier AIs today are really good at answering questions. They are less good at noticing the “oh, that looks funny” and asking the right questions. At least for me, that is still my role. And I sadly have to execute my role in English.

But my old workflow did not distinguish between the two. It blocked all work until everything was translated. And everything takes years. Which means my work could never start. But that’s not the real problem with translating everything to English.

Translating everything before analysis is also lossy in a way that I haven’t been able to quantify yet. The translation between language loses some of the information in the translation. I noticed the loss. Local LLMs reasoning over the native language elevated multiple “oh, that’s funny” instances to me. The AI didn’t know what it really meant or how to ask the followup questions. But reasoning in the native language had eureka moments that did not happen with the English translations.

The last mile

So I stopped translating data. I work over all languages now. Well, my swarm of agents doing the heavy lifting works over all languages now. The hard proof that the translate-first step is not required came out of the same pile of Chinese-language data. I shut down the translation on the last day of August. The following week a later project needed those court records for something else I’m working on. That project queried the identical index, with the same 70m document bodies, still in Chinese. It never reached for the metadata that I still had translated into English in the same database. It went straight to the Chinese metadata, then to the Chinese freeform bodies of text. Of that project’s 94 discovery-grade findings, 5 went through the Chinese court records without ever being translated to English. The project pivoted from another data source, through the court records, nothing but Chinese.

The machine does not care what language anything is in, and that would be the end of the story if the machine were doing everything. It’s my workflow, and I still only read English.

The problem with an all-language workflow is the English speaker at the end of it. It is more than a little annoying that my interactions with my own agents are multilingual when I am not. My first instinct was the old mistake in a new place: tell the agents to talk to me in English. Told to do that, an agent ends up with a lot more English in its context window, and its results drift toward an English bias. The constraint on the output leaked back into the reasoning over the inputs.

The better results come when the agent swarm and the orchestrators above it are unconstrained and multilingual. The swarm talks to the orchestrators, the orchestrators talk to me, and nobody in that chain is told what language to think in. The English speaker is a fact about the interface, so the fix went there: one more agent between my orchestrator and me, whose only job is to translate into English so that I can read it. Translation used to be the first step, applied to everything the machine would see. Now it is the last, applied only to what I need to see.

The honest cost is that I no longer understand all of my own intermediate results. The swarm and the orchestrators reason in languages I cannot read, and the English I see comes out of a chain that loses some of the Chinese context. I cannot argue with a term any more. That is a genuine trade, and I made it because the English I used to read was never the source either. It was a static translation that mangled the terminology I cared about, so I was trusting a machine then too. The error still enters. It enters once, at the last mile, on the way to me, and it cannot reach back into what the swarm saw. The error belongs at the end of the pipe. And I find that I am asking a lot more questions to help me think and reason about the subtleties coming out of the system.

Every workflow has steps that exist because of a limit the person who built it had on the day they built it. The tools stop sharing that limit long before the workflow does, because the step keeps working, and nobody audits a step that works like it did yesterday and the day before. The way to find those steps is to ask of each whether it is there for the actual workflow, or there for you. The ones that are there for you belong at the end of the pipe where the cost doesn’t compound as the information moves through.

That has been the revolution in my workflow. Letting the language models work in all languages instead of limiting them to my weakness of only speaking English.

Bottom Line Up Front (BLUF)

China went all in on domestic AI accelerators, and that bet was never on manufacturing the GPU processor itself. The big bet was the memory beside the GPU chip. High-bandwidth memory (HBM) is a stack of memory dies bonded on top of one another. Every AI accelerator designed for LLM training or frontier model inference needs several stacks per package. My June math modeled that China could manufacture enough memory to build 225,000 Huawei Ascend 910C AI accelerators in 2026 (truth in statistics, the model predicted a range of 192,000 to 270,000). The 2026 math hasn’t changed. We just have a little more visibility into Huawei’s direction past 2026.

A bonder is a device which sets one memory die on top of another. You get more memory with taller stacks, and large language models need large memory. But the taller the stack the more chances there are to make a mistake which costs the whole stack. The bonders that build tall stacks at volume come from abroad, and the nearest domestic vendor told its investors in May that no orders had been placed. Huawei’s volume accelerator carries shallow, slow memory. The part that carries the deep and wide memory has been announced and previewed, but is not shipping in volume. They’re building the memory that their tools can bond, not the memory that makes their designs competitive with American AI accelerators.

Even the shallow memory does not cover their all-in bet on Made in China AI hardware. The announced order backlog for Huawei’s volume part alone needs several times everything my model says China can stack in a year. Beijing is behaving as though they will permanently rely on Chinese AI hardware: it has spent the year pointing capital at the infrastructure and forgoing import licences.

Each bar is one announced production target measured against everything my model says China can build in a year. The line at 100 percent is what I think they can build in a year.

Why this matters: the limit on Chinese AI compute is memory packaging, not chip lithography. Export controls aimed at GPU chips are one component away from where the limiting factor is. And China’s announcement of AI accelerator capacity is what they want to buy, not what they forecast they can produce.

The cap only matters because China committed to it so completely that they burned their ships behind them. A business or a country not in great power competition would have taken the American chips Washington offered in January just to buy down risk.

The research data was current as of 2026-09-08. Yuan convert at 6.8 to the dollar throughout.

1. The all-in bet

China went all-in before the flop. Commitment is what makes a memory shortfall incredibly consequential. A country that keeps a foreign supply line open can miss a domestic target and buy their way out of the hole. A country that shuts down imports has to live inside its own production capacity. Beijing chose the second course this year.

Washington allowed GPU exports on January 15, 2026 when licensing for H200-class accelerators moved from presumed denial to case-by-case review. On or about the day before, Chinese customs were told the part was not permitted and firms were told not to buy it. Approvals came around mid-March for about 75,000 units per buyer. By August 18, 2026 ByteDance and Tencent had each taken about 10,000 GPUs, and most of the licensed allowance was being steered to Hong Kong instead of the mainland. The door opened, the customs house shut it, it was reopened a crack, and the buyers bought a little through it. My reading is that a country counting on relief does not slow-roll it at its own border.

A timeline of the GPU imports buying down risk to Huawei AI Accelerator production.

The American offer of Nvidia H200 AI accelerators was the wrong instrument for China anyway. The rule on stacked memory never moved. There was never a fallback on offer for the Chinese LIMFAC. So the memory bet was all-in from the day it was placed.

The money says the same thing. CXMT, the Chinese memory maker my model leans on for nearly all of the domestic stacks, was publicly listed in Shanghai this summer. As part of their IPO, CXMT told the exchange that the raised capital would buy node upgrades on lines it already runs and a forward research platform. In its first written reply to the exchange, in December 2025, it said the projects do not involve any new production line. The registered offering documents commit nothing to memory stacking. Yet roughly RMB 36.8 billion (US$5.4 billion) of the money it raised is committed to nothing at all, and tools are being bought with money the plan does not describe. In September 2025 a special-purpose fund under the third national chip fund took a stake in a domestic maker of bonding equipment, and bonding is the step that limits how tall a memory stack can go. That is Chinese capital buying down their limiting factor. I won’t say that the IPO prospectus looked the other way because I’ve never taken a company public and don’t really know how you decide what to include or leave out in a prospectus.

The left column is the money the IPO prospectus commits and what each project buys; the right is what is being bought with money the prospectus does not describe.

China did not wait long before going all-in. Its buyers took a sliver of the Nvidia cards they were offered. They were never offered HBM so they are buying HBM production capacity. And what they’re capable of producing is not what I thought.

2. The tell

Huawei’s own product line shows which step binds its production capacity. A company can say anything about its supply chain especially when their government will put its thumb on the court system for the company. But the company still has to build what its tools allow so it has something to sell. And when it publishes the architecture of a product it also publishes its own constraints. Huawei published those constraints on June 4, 2026 in the architecture whitepaper for the Ascend 950, and the memory on it is the most honest statement about China’s AI hardware I have read this year.

Start with the shipping AI accelerator. The Ascend 950PR, sold on the Atlas 350 card since March, carries eight memory modules. Huawei calls them modules; the harvest bin on the card divides to exactly the size of a standard stack and the product page says HBM, so I read each module as one stack. The speed is the surprise. Per module, the 950PR’s memory runs at roughly half the bandwidth of an equivalent Samsung part from 2020. That is not a flagship’s memory. It is memory built to be buildable at home: the stack height China’s memory maker already builds, electrically signalled slowly enough to relax the interface and the thermals, and spread across enough modules that the total still looks like an accelerator with Chinese characteristics. I mean, I shouldn’t knock it because I haven’t designed a chip in 25 years.

Now let’s look at the AI accelerator that isn’t shipping yet. The Ascend 950DT is the Huawei headliner: fewer modules, each far deeper and far faster, so that the package carries more memory on fewer stacks. Depth is the tell. A module that deep divides to a stack twelve dies tall, of a denser die, and no Chinese line makes that die at volume or has demonstrated being able to produce that stack in volume. As of this writing the 950DT is announced and cloud-previewed, and Bloomberg reports that memory shortages cap its output this year and leave a single reported DeepSeek order unfilled well into next year.

Put the shipping Huawei 910 and announced 950 side by side and the design tells you where the LIMFAC is. The part Huawei can ship is the one with the short stacks. There is probably a pancake joke in there somewhere. The part it cannot yet ship in volume is the one with the tall (memory) stacks. Definitely a pancake joke. A bonder machine sets one die on top of another, every extra layer is one more placement that can fail and scrap the whole stack with it. And the bonders that do tall stacks at volume are the ones China does not have, cannot yet build, and export controls prevent them from buying. Huawei built the memory its tools can bond, not the memory the design deserves. That is my read of the design, no chip company reverts six years of Moore’s law by choice.

The same accelerator’s memory priced three ways: counted in stacks the tall design looks cheaper, and counted in the dies a bonder places it still looks cheaper. But the yield cost of those twelve-high stack bonds makes them very expensive indeed.

The same Huawei document corrected me on the other half of the package. I published in June that the Ascend 950 was monolithic, and that a monolithic die took advanced packaging out of the LIMFACs. Huawei’s whitepaper shows two compute dies and two input-output (IO) dies in one package beside the memory modules, joined by a die-to-die link, and that requires 2.5D-class assembly, an interposer under several dies. Apparently my microprocessor design college degree did teach me things. Translated back to English, the AI accelerator chip packaging is back to being a Huawei LIMFAC. It does not replace memory as what defines the production ceiling. But the bet now rides on every step of assembly that China does not own at volume, and all of them sit in the package, downstream of the lithography.

TL;DR: All this gets Huawei a part that it can build, it just can’t build enough of them.

3. The flop

The public order backlog runs multiples ahead of production capacity. A small production gap tells a company to expedite. Go faster. Pay overtime. A gap of multiples means that the announcement was never a production forecast; it was a procurement plan, an instruction to the supply chain about what market demand to invest towards. Chinese AI announcements should be read as buyers’ commitment to purchase once the supply is there, which supports investment decisions.

Take the volume part standalone. Huawei’s reported 2026 target for the Ascend 950PR is 750,000 units. Every unit ships the stacks described above with all of the bonder problems and compounding yield math. Run the math and the Huawei 950PR target alone needs about 3.21x of everything China can stack in a year. That is the shallow memory, the memory Huawei pivoted to precisely because it is buildable. Because it’s electrically easier to stack, and they can stack it shorter. The flop moved the target from the memory China cannot yet build to the memory it cannot build enough of. That is progress, not (Nvidia) perfection.

The people who actually buy the memory say the same thing. Chinese accelerator designers file their purchase disclosures with the stock exchange they’re listed on. Enflame’s, filed for IPO this spring, indexes what it paid against 2023. In 2025 it was paying 5.5x the 2023 price for its higher grade of memory, while the chip wafers themselves had fallen to 0.7x cost. It drew down its stockpile of wafers bought in previous years. But it had to pay the price multiple for memory bought through Hong Kong traders. Dishonest (or less than honest) stock exchange filings get you sued, so they put the truth in their corporate filings.

Memory cost vs wafer cost.

Best Arguments Against This

The strongest argument against me is Huawei’s shallow memory itself. My argument’s chokepoint is named for a class of manufacturing tooling: the thermal-compression bonder that stacks HBM-grade memory at volume. No Chinese vendor has yet sold one. If Huawei’s slow memory is slow on purpose, a short stack electrically signalled at last decade’s rates might be bondable on the coarser tools China already holds. Then the chokepoint gates only the 950DT’s tall stacks. The numbers move. This becomes less an argument about hardware and more a model of LLM training and inference speeds. Not something I’m opening in a hardware article today.

The second argument comes from corporate filings about packaging. No Chinese AI accelerator designer ranks memory first among its supply risks; they name wafer foundry, packaging and test, and the Entity List. I don’t know why they don’t list it.

What would change my conclusion. A teardown of an Atlas 350 showing its memory stacked without through-silicon vias, or stacked on a Chinese tool. A full-capacity Ascend 950DT named in a tender or a vendor listing as shipping in volume to a named customer. A domestic bonder vendor, or CXMT, booking HBM-stacking bonder orders with a site and a tool count, or an HBM line funded from the uncommitted IPO raise. And relief on the memory rule itself, when the memory licence exception and next year’s Korean fab licences are decided.

Reading the cards

China’s supply of AI accelerators is defined by the stacked memory it can bond. It’s all about the high bandwidth memory. They burned their ships behind them in pursuit of Made in China AI accelerators (and HBM). And all of the large Chinese AI accelerator order announcements are market signaling so manufacturers can justify committing capital to supply the demand.

Bottom Line Up Front

For the last few weeks I have pointed swarms of AI agents at the PRC government’s public web server presence to help me understand them better. It started with me telling the agents exactly what to download for my analysis. Now my research projects just send a message to the agent swarm telling it what type of data could help prove or refute the hypotheses, the agents go find it across the PRC’s internet frontier, and then they hand it back to the research project. My agents are tasked with autonomously finding and acquiring Chinese government data. They’re finding the right needle hidden in hayfields with Chinese characteristics. I have a pretty elaborate protection system built in for obvious reasons.

The useful question is not whether my AI ever approached or went through a security layer. It did many times. The important questions are if the security layers stopped the AI before crossing someone else’s boundary. Mine did not. I have had to implement security in layers. Visualized below are the request URLs the system was concerned about, the layers that blocked requests as showing some risk, and the handful that survived every layer to reach a live response. The key is to have both technical layers and AI reasoning layers to contain actions; and you monitor how things are bouncing off or progressing through the layers so that you can act. Either individually should ostensibly be enough to contain your agent; I needed both.

My logs held 11,199,362 recorded fetch attempts when I analyzed the data for this writeup. They hold more now because my research agents are still running while I take a break to type this up (and walk the dog). Twenty two of those requests were capable of causing the web server to actually take an action. All of the scripts were outside of the authentication boundary. I have no idea if the web server would have forced an authentication before completing those requests because my own complementary security layers caused the agent to back away before it went down that path.

What the labs’ agents did in July

Three of the most innovative organizations in the industry have published post-mortems saying their own AI agents had broken others’ security boundaries. Hugging Face disclosed an OpenAI agent had hacked it. Anthropic disclosed its agents had hacked the production infrastructure of three real organizations. And the UK AI Security Institute (AISI) reported nineteen unsanctioned actions across 122 test runs.

In each instance the organization gave its agent a goal, two placed inside a security container, and chartered the AI to achieve its goal. In each case the agent found the edge of the boundary, figured out how to get past it, and then delivered its proverbial message to Garcia. One broke a technical boundary, one broke an AI reasoning boundary, the third was just operator error. They each had a single layer of protection.

But if you look at them, they are all hacking. You find boundaries, you find a seam, you move through it, you find another layer, you find a seam, you move through it, until you achieve your goal.

1. Qualify the URL before you go down it

A URL leads either to data or to an action, and you have to figure out the difference before you risk causing an action.

You cannot tell from the verb in the URL if it is going to be benign or not. One of the URLs my agents pulled out of a government mobile App has “getCode” in its name. From the verb you would think it gets a code, right? According to the government App, that “getCode” causes an SMS code to be sent to somebody’s phone. I don’t know if it’s 2fa, or account recovery, or if they have to pay per SMS, or… But it doesn’t matter.

I’ve been automatically qualifying every parameterized URL before anything goes down it. That means a lot more than refusing them. My goal was not to build an AI containment system. My goal was to use real data to better understand China. The AI containment system is just something I had to build on the way to find the esoteric data that the PRC has published on the topics I find interesting and/or want to learn about.

This is a little easier than it sounds. My agents are only ever trying to find the hundred Chinese agencies with purview over the topic I’m researching, then they’re only looking for the parameterized data search interface on the agencies’ web server. Everything else on a government portal would have already been found by a vanilla Google or Baidu web search. But a data-search-form and a SMS-some-person form are hard to tell apart when you can’t trust the verb and all you have is a name that you’re looking for.

Qualification happens in layers, and the layers have to be different.

The technical layer is deterministic code. Mine is a python program with a rule file. The rules are reliable to the extent that I already know what I don’t want the agent to do. That layer of code (and a docker container) is what typically stops an AI agent from approaching a boundary that it should not. The code does not reason, does not get talked into anything, does not get tired of saying “no” thousands of times, does not forget its rules, and doesn’t change unless I change it. And when the agent starts bouncing off the layer of code, the code tells me to go change the agent’s guidance so it’s not going to accidentally (or intentionally) find a way through.

The AI reasoning layer is an LLM looking at the URL and catching what a human would have caught if a human thought about this specific URL. Nobody ever does. Do you look at the full URL string before clicking on a link from your friends on Facebook? That is the whole reason the reasoning security layer exists: continuously reasoning about a potential URL as we learn more about it and deciding not to pursue it unless we’re certain it’s safe.

The agent first probes innocuously with the least consequential request, and reads the answer to establish that this really is the search box. If that reasoning does not establish the form is safe, the agent backs away and moves to the next one. There is always a next one. It turns out that most of the insightful data that I have used I also found from multiple sources. Bureaucratic redundancy for the win.

The last band on the above graphic shows those 1,837 URLs which were eligible and never called. The innocuous probing could not establish safety, so the requests were blocked.

2. The technical layer is a blacklist I built by (automatically) reverse engineering the clients

I only wrote three rules by hand:

1. Quarantine and never use the credentials found sitting around. Yes, these are common. They go into a register in a locked directory away from URL construction and agent reasoning. Finding authentication credentials is one thing, using them is another. Amusingly, I have no clue if any of them even work since I can’t even test them without using them.

2. Known actions are never exercised. I am working on public data. I don’t need to cause actions and many of them I shouldn’t be causing anyway. We’ll get to the actual list of blocked actions in a moment.

3. And don’t touch the Message Queues (MQs). These are how computers talk to each other. I want to find and download esoteric public data not add Kilroy Was Here entries into the databases China has made public as part of their anti-corruption drive.

This would all be very different if I were wearing a government hat and was exercising government title authority. But I’m not, so I can’t and my AI won’t either.

I didn’t write the blacklist itself. I automatically reverse engineered 176 Chinese government mobile and Windows applications to map out how they interact with government servers.

An app carries all of the program context that a URL does not: the GUI labels, the help manual, the popup warnings, the parameters the App uses, and sometimes the developer comments. That is enough to sort a web 2.0 API into safe passive events, and active events. Blacklist the active events. Do that across 176 apps and you are no longer guessing at how the PRC does this whole internet thing.

The apps also told me which open source frameworks they run. So we downloaded those, reverse engineered them the same way, and fed their active URLs into the same list. Most of the PRC’s sites are wired up differently, but it doesn’t matter since I can blacklist everything that can trigger an action.

The blacklist grew from 143 rules to 6,061 a week later:

• 5,253 substrings

• 474 regular expressions

• 239 whole hosts

• 95 explicit exceptions.

3. An AI that reasons a block is too broad (or too narrow) escalates it to me

Let’s start with an amusing example that is the opposite of what you’re thinking. If you look really carefully at the diagram above you’ll see a “class-level blacklist” that stopped 40 URLs. It turns out China co-locates some government services with banking services. I never would have guessed that. But an agent reasoning over URL safety raised it to me and suggested how and why to add it to the blacklist. This is why we also have a reasoning safety layer to balance out the purely technical layer. Yes, they really co-located some government services with banking services. I think it relates to how they collect payment on fines.

This is the part you probably expected. A blacklist that is deliberately too broad will block things it should not. It’s part of the process. So the reasoning layer runs in the other direction as well. When an agent hits a block it reasons is over-broad it will write up the case including why the blacklist entry was originally created, and why it thinks this instance is ok to let through. Then I decide what to let out of the docker container. That is the only escalation path, and an agent judging its own argument for an exception is the failure mode I need to prevent. Manage the agent like it was a person, give it an escalation path that does not require it to break out of containment, and explain why it’s not allowed to do those things; that enters the context window (and durable memory that survives context compaction) and you have a more trustworthy agent.

The most interesting adjudication was actually my mistake. I had allowed innocuous checks of URLs resembling password changes, password resets, and login pages because I wanted to understand whether I could register for an account without a Chinese phone number, and then authenticate as myself to search for data in the walled garden behind a username and password. My fix deleted a huge safety class. The AI fetched those URLs four times before coming back with an argument on why the blacklist should be reinstated more narrowly to meet both the safety goals and understanding when I could register for an account with the Chinese government (I haven’t seen one instance yet on the mainland).

I am fighting a version of this safety boundary right now while writing. I have tried four times to have the Fable model fact check and red team this writing against my underlying data. All four times Anthropic’s safety layer rejected the agent. And I’m trying to write about a safety layer. Irony.

4. Inferring intent

Earlier this week I wrote about performing incident response on a Chinese government server. This safety layer is actually what caught the oddity and withdrew the adjudication that a URL was safe.

The mechanism is mundane. If you followed a link on a remote province’s CCP education portal it would append that encoded link into the returned HTML. Somebody had previously probed it with a command-injection callback, which was appended to the page. So my agent went down that command-injection callback URL. My own encoded variant was then appended to the page, that new one was followed, and so was the one after it. My agent was now chasing its own tail. There was no attack other than my agent running itself around in a circle 27 times.

The problem was that an attacker (actually a web vulnerability scanner) had left a link on a page that my agent followed. That is a question about intent. A static blacklist cannot offer an opinion on whether the web server intended to serve a command injection payload (for use against a server) to a web browser. But the reasoning layer can and did. Which is what stopped the crawl and escalated the command injection payload for me to rule on.

Which brings me to the thing I trust least in my own system. Reasoning agents drift as their context accumulates. This is where I’ve had the most problems. The AI exercises good judgement until it doesn’t. And that’s where the technical blacklist tells me when to put the AI back on the rails.

There are three key takeaways: everything that must not drift needs to be written in code, the reasoning layer periodically needs its context cleaned out and repopulated with the rules and nothing but the rules, and a supervisor (me) needs to look at what the agent does instead of what it said it’s doing.

Summing it all up

Measure at the point of an AI’s action. Discovery cannot be prevented in any AI that interacts with the real world. So a rule against discovery is a rule against having a system at all. Security layers are supposed to be crossed, but a reasoning security layer defends against flaws in the blacklist, and the blacklist defends against flaws in the reasoning layer.

The Bottom Line Up Front (BLUF) is that a sophisticated AI workflow uses the expensive frontier models like a higher-salaried supervisor to manage lower-cost models performing the work. A services/consulting business selling labor hours doesn’t make its money on the supervisor; it makes its money on the workers. A frontier AI company is not going to make its money on the supervisory model; it’s going to make its money on the worker models.

Let’s keep my entrepreneur and recovering-CEO hat on for this discussion instead of my hacker hat. In the last week I delegated tasks to 754 sub-agents, which is like delegating tasks to employees who actually do the work. I even say please when delegating tasking to my agents and sub-agents. Those workers moved 21.3 billion tokens through Anthropic’s models, which would cost $16,029 at the API list prices. I’m running with two organizations’ Claude Max 20x subscriptions so my actual amortized cost is closer to $50 for the week. I’m pricing the tokens here just so I can point out that it would make good business sense, with an embarrassingly high profit margin, to spend $16k on tokens given what I could sell the outputs for.

The below graph shows the breakdown of which Anthropic model I delegated tasking to (or a higher level model further delegated tasking to). The frontier Fable model (think architect and manager) got 30 tasks, Opus 5 (think senior employee) got 498 tasks, Sonnet 5 (think junior employee) got 204 tasks, Haiku (think temp worker) got 1 task. If you read the graph you’ll see Opus 4.8 got 21 tasks, which were Anthropic’s cyber-safety systems moving work to a safer model. No organization builds a team entirely out of rockstar principal engineers. Someone has to do the less-exciting work that holds everything together, and if everyone is incredibly expensive you have no profit margin, and no talent pipeline. The analogy is the argument and predicts something confirmed by the data: 65% of my Fable usage is direct work with the model planning out tasking for the worker agents, and managing those workers. Fable builds the tasking; it does not execute the tasking because that would be a waste of money.

The distribution of labor is not a discovery. It is how I manage organizations and how I manage AI. My own CLAUDE.md configuration file codifies how I want tasking to be delegated to different models with different levels of reasoning (and price). The pure mechanical bulk work goes to the cheap tier, judgment goes to the mid/senior grade Opus, hard reasoning about hard problems is only done by Fable. The FT’s analysts say price is pushing customers away from frontier AI. They are right. That’s a business 101 staffing decision.

The bottom tier is the sharpest part of this argument. Anthropic’s lowest tier Haiku model ran one agent for me all week. I ran a local Chinese DeepSeek V4 Flash model in my office which generated 39.7M tokens in the same window. That’s 40.5% of every token my AI generated, second only to the mid-grade Opus 5 workhorse model. The FT cites cheap open-weight models from China as a threat to the frontier US AI labs. In my data, those cheap open-weight models are what churn through bulk data so I don’t have to wait for gigabytes to be sent up into the Cloud for processing. Those cheap open-weight models are critical to me being able to use the more expensive frontier models to solve hard problems. DeepSeek is my temp worker that I can train to do repetitive tasks, and it’s managed by the frontier model that plans the work and manages the quality of the result.

Don’t take my word for it. The FT’s own sources describe the same thing. It reports analysts and investors saying “older models are capable of handling the bulk of business demands.” Accel’s Miles Clements says “Most people don’t need to operate at the frontier,” and that the frontier-default period “was not a durable era.” The FT writes that businesses are “using models more efficiently rather than always going with the most sophisticated option.” That resource-appropriate staffing is good business! And it’s described by the people the FT interviewed, printed under a headline that says the opposite.

The FT’s own chart implies that Fable’s absolute spending grew about a third across the period the FT calls a struggle. The article then reports revenue up nearly sevenfold this year ($65bn annualized in July) which resulted in a first adjusted operating profit. Selling tokens is effectively selling labor like a consulting/services business. They don’t make their money selling supervisors’ labor; they make it selling workers’ labor.

The FT completely missed the strategic business implications. Anthropic’s customers are becoming sophisticated enough to manage their AI use like they manage their people. That means those customers have measurably moved past dipping their toes into chatbots, away from the tokenmaxxing fad, and into managing and staffing AI agents in workflows. That means Anthropic’s customers have matured. But we should see measurable business productivity gains in the next few quarters. And it has the potential to accelerate if and when those businesses learn to manage teams of agents as part of their actual work force. We live in some interesting times.

Bottom Line Up Front

One of the remote provinces’ CCP education portals will serve you somebody else’s attack payload if you ask it for page 2 of its news list. It has been doing this since at least December 8, 2025, and the Internet Archive has been crawling and republishing those poisoned links the whole time.

That looks like someone hacked a Chinese government server so you can see why I got very interested in a hurry. The injection payload in the image above comes from a commercial vulnerability scanner. The site never runs the payload, and I can’t find a way that it could be actually dangerous unless you laugh so hard at me that coffee sprays out your nose. Academics would probably call it a vulnerability. It’s operationally useless outside of contrived examples. It’s a bug. That makes this a story I can tell about doing incident response on a Chinese government server. The irony is not lost on me.

Story time

The recursive link. I’ve been analyzing a lot of People’s Republic of China (PRC) government content. I was crawling one of the remote provinces’ CCP education portals when a page returned something odd. The site’s own next page / last page links, had a shell command substitution in the query string. Inside it was a ping to a random subdomain of d[.]360tcp[.]com. That has exactly one purpose. If the server runs the attackers command then the server does a DNS lookup and sends the ping packet. Whoever owns the 360tcp[.]com domain sees the ping packet and knows the server executed their input. Or if the attacker is really good they have passive visibility somewhere in the recursive DNS network so they can see the DNS lookup; then whomever owns 360tcp[.]com gets the blame while the attacker still know their command injection succeeded. This is how you prove a blind command injection in a way that doesn’t burn your real payload if some former-defense-tech-CEO-on-sabbatical with a crawler runs across it then writes a substack article. Finding it on a Chinese government site’s own infrastructure is what a compromise looks like. I admit I giggled a little maniacally when I saw it.

It’s been there for at least eight months. Three pages came back carrying the command injection payload. I only sent a section number and a page number because I (really, my automation) was just crawling and downloading CCP personnel training materials for something else I’m working on. The Internet Archive crawled those poisoned URLs thirteen times since Dec 8, 2025 so we know roughly when it happened.

At that point I did the obvious thing and went looking for a broader attack campaign. I checked 10,746 .gov[.]cn hosts for command injection callbacks. Like I said, I may be doing a lot bit of crawling, downloading, and analyzing.

Bah humbug. The scan only found the tell tale results on the one host. And on that host there was a second callback I didn’t notice until now: reversecheck[.]jiance[.]qianxin[.]com. It’s the QiAnXin cloud scan. QiAnXin is one of the two largest security companies in China. That’s a commercial vulnerability scanner.

The other domain d[.]360tcp[.]com is delegated to a nameserver literally called dnslogns (read that as DNS log nameserver). It’s been registered since 2017 through Alibaba. If you’ve been in offensive cyber for more than a few years then you think of Qihoo (a major Chinese cybersecurity product company) the moment you hear “China” and “360”. But I don’t have any evidence for it. The argument against it is that Qihoo is also a domain registrar so I wouldn’t expect them to register a domain through their Alibaba rival.

There isn’t a vulnerability anyway. Being disappointed with no attacker I went looking for the vulnerability itself, and got disappointed there too. I pulled all 498 archived responses from the host and tested every way the stored string could hurt somebody. There are 1,197 attacker-controllable values sitting inside and across those pages. Zero of them contain an unescaped quote, so none can break out of what it lives in. Zero reach script context. Zero produce a database error. Zero emit an attacker-chosen address as a link destination, so there is no phishing pivot and no search-engine poisoning. And a clean request and a payload-bearing request to the same page return byte-identical bodies, which a server evaluating that parameter would not do.

The site is not running anything. It is remembering. Somebody sent that string, and the server bakes it in.

And that is the tar pit. The site builds its previous/next page links out of whatever query string you hand it, which means the not-really-a-command-injection link regenerates itself on every page it appears on. Every time you go to the “next” link, that next page will encode the command injection payload one level deeper. Every page is new, so a plain duplicate check never catches it, and you can trudge through that tar pit forever. My crawler did, until my own data normalizer stopped and warned me shenanigans were afoot. A command injection by any other name still looks like a command injection.

This was an entertaining diversion. I never expected in my life to be performing incident analysis on a Chinese Government or Chinese Communist Party server.

Bottom Line Up Front

Chinese listed companies do embed adverse numbers in pictures, and the statistics are insightful. If we look at periodic reports from firms that are not under regulator scrutiny, images of tables included derogatory information 31.3% of the time, whereas text-based tables included derogatory information 17.1% of the time. The ratio is interesting.

The clearest single example is a Chinese manufacturer that we’ll call Company D. Its FY2018 annual report embeds fourteen substantive images; the year before, one. The picture that matters is the year-end list of accounts receivable being written down as bad debt. That means Company D judged those debts unlikely ever to be collected. There were six bad debtors, and the image of the table listed every reason cell as 涉诉 (”in litigation”). The same table was ordinary text (not an image) in the FY2017 annual report. The same FY2018 document also carries 74 tables as ordinary text. FY2018 was also the year the firm’s net profit swung from +327.5 million yuan to a 1,046.9 million yuan loss. Let’s just round that to a $150 million USD loss. That’s the clearest example among 86 corporate filings that looked funny to me.

Left: the FY2017 table was ordinary machine-readable text. Right: in FY2018 the same table was an image, every reason cell reading 涉诉 (’in litigation’). We redacted debtor names.

The practice of embedding images of tables in a regulatory filing is common enough and mostly innocent. In a random sample of 400 listed firms, 1.26% of periodic reports carried an image of a table with derogatory information. Most of these images are spreadsheet exports pasted as pictures or screenshots of internal business systems. Intent is not observable from a filing. Most are benign. But taken statistically it is consistent with shenanigans, and also with a boring possibility that crisis-year sections get pasted by different people than in other years.

Here is the part that surprised me. Negative information “hiding” in an image did not detectably hide from the market. In companies where a regulator had compelled a response, “hidden image tables” actually drew slightly more trading volume not less (truth in statistics: the statistical range here includes zero, so take this with a grain of salt). But “hidden image tables” did seem to hide from the automated news tickers for a while. I only tested this in companies publicly under regulator scrutiny, and images of tables in a compelled response drew contemporaneous automated coverage 3.2% of the time versus 17.9% for machine-readable facts. That was only true through 2022; multimodal AI summarizers now mind the gap.

The research data was current as of 2026-08-18. Chinese filings quote figures in 万元 (wan yuan, units of RMB 10,000); one round rate for this post is RMB 7 to the dollar.

What we found

1. Fingerprints left in the images. If you look at financial filings long enough then you start to get a little loopy. Well, I do anyway. Look closely at imaged cells across this corpus and you’ll see Excel’s green error-triangles in the cell corners. You find Word’s line-break marks printed in the cells of a pasted image. The typeface changes at the picture’s border. I find this funnier than I should. But when an imaged table’s tool-marks and fonts don’t match the document around it, you are looking at an import from another program, which is exactly what the innocent account predicts. In aggregate, 57% of the images looked like spreadsheet or business-system screenshots pasted into the filing as pictures. That is the innocent workflow: someone builds the table in Excel or pulls it out of an internal system, and pasting a screenshot is safer than rebuilding the table in the document. These are regulatory filings, so mis-typing a number while transcribing it into a financial filing can trigger real penalties.

Excel’s green error-triangles inside a table filed as a picture (inset: 3x zoom), plus a header cell that came through in stray italics. The spreadsheet came along for the ride.

2. Some images look really funny. In the image below (right side panel), the imaged table is typeset like a table from the rest of the document: matching fonts, column rules, and spacing. That look is consistent with a different workflow: the table was built in the document like every other table, screenshotted, and then replaced with its own picture. Consistent with, but not proof of. A house Word template could produce the same look. But I’m not sure why someone would copy-and-paste an image instead of the actual table from Word to Word.

Left: an import with tool-marks gives the workflow away. Right: an imaged table typeset like a document table, hard to tell from its text siblings except that machines could not read it. The two panels come from different firms.

Company D’s bad-debt schedule is the second kind. The imaged schedule itself shows no tool marks (we even checked programmatically: there were zero non-gray pixels), it is typeset like a document table (fonts were consistent with the document’s own embedded Song and Times families), and give or take soft tells like dotted gridlines and a “100” where the prior year printed “100.00%”. That’s just the funny table. The other imaged table on the same page is the firm’s top-five receivables list and it has an Excel error-checking triangle in its totals row. I found this example by analyzing company filings over time and flagging when a table that had historically always been text suddenly flips into an image. This particular one was also filed months late after delay notices. And FY2018 was the year the firm’s annual report states its net profit fell more than 400%. It sure looks funny to my non-accountant eyes.

3. The market reacts to images of bad news anyway. If pictures actually hid bad news then machine-triggered trading should thin out. We couldn’t detect any. In the companies with exchange inquiries that compelled replies, imaged replies drew more abnormal trading volume (truth in statistics: the sample size is too small to state this is definitive). The market, as far as we could detect, could read the pictures of tables.

4. The pictures did fool the news bots for about four years. Then the machines learned to read images. We 1) matched 65 imaged derogatory facts against 65 machine-readable text facts from the companies where an exchange was compelling a response, 2) collected contemporaneous timestamped news coverage of the company, and 3) grouped them by technology era because a 2020 filing must be judged against 2020-era news pipelines. I didn’t have good news archives from before 2019. But in the 2019 through 2022 era of text-only news pipelines, imaged facts drew automated news coverage 3.2% of the time versus 17.9% for the pure-text filings (truth in statistics: 1 of 31 when the derogatory fact was in an image, vs 5 of 28 when it was text). The gap disappears in 2023. Again, this is a small sample size, but derogatory facts “hidden” in images resulted in more contemporaneous news coverage in the AI-generated news era.

How we know

The short version of the method: we built a census of China’s compelled-disclosure channel (74,675 documents since 2000), then screened a 10,019-reply probability sample, 3,963 periodic reports from the never-questioned population, and a 1,505-report random arm, all with the same instruments. Every counted item was transcribed and judged derogatory-or-not by two independent model seats validated against adjudicated gold sets; the designs and their bars were fixed before labelling; detector error rates are measured and on record (the two judging seats agree with the adjudicated gold at 0.986 and 0.957 on the periodic pipeline). Companies here are lettered, not named; the page facts are checkable against the public filings. If you believe any document fact here is wrong, write to me: I will check it against the preserved filing and correct this post if I’m wrong.

So where does that leave us? Some images of bad news embedded in corporate filings sure look funny. They broke my automated workflow so I went looking. Some of the pictures indicate a Microsoft office workflow, error-triangles and all. Some are typeset like the filing document itself and aren’t so easily explainable. We can’t adjudicate intent from the filings. But what we can measure: the bad news embedded in the pictures never detectably hid from the market, and since 2023 it doesn’t hide from the automated news feeds either. For at least four years it did seem to hide from the machines that automatically generated news from corporate filings. But today’s era of AI-based reasoning can read the images just fine. Mine does.

Each bubble is a Chinese province’s conviction count; most sit on the Taiwan-facing coast and the Korean border, and the known gap is the high-end threat this record cannot see.

Bottom Line Up Front

Chinese courts convicted at least 216 people of espionage and related national-security offenses between 1991 and 2021. We can count them because the records were published on the PRC’s own judicial transparency platform of ~80 million cases, China Judgments Online (CJO), and stayed up until Beijing changed their judicial transparency in 2021. You can download it off bit torrent. Once extracted, they are plausibly the largest open, case-level compilation of foreign-intelligence penetration of China in (unclassified) existence, the mirror image of the Western databases that count Chinese spies caught in the West.

The temptation is to read the 216 cases as a portrait of the assets (that’s spy-speak for a recruited “spy”). The portrait of the spy-catcher is worth more or at least I find it more interesting. Every case here is one the Ministry of State Security (MSS, China’s civilian intelligence service, which runs both espionage abroad and spy-catching at home) or its military counterpart detected, investigated, prosecuted, and proved. The portrait is specific: China is very good at catching the low-tradecraft paid observer on its Taiwan-facing coast and its Korean border, and it is very good at following small money. The military half of the record shows foreign collection reached every branch of the People’s Liberation Army (PLA).

China also hides some things on purpose. The verdicts name the foreign intelligence service in only 9 of the 216 cases and withhold it in 200; the remaining 7 can be inferred from structure. Two hundred of 216 is a 93% withholding rate. Caveat lector, most of the 93% is deliberate redaction plus an artifact of how these records surfaced, not evidence that China failed to work out which countries’ service was running the asset. From this record, the pool of cases where China genuinely may not have known the service is at most 8.

The blind spot is a hypothesis that I have a low confidence in. The Chinese counter-intelligence apparatus looks tuned for the cheap coastal observer, and it may under-see the remote, patient, professional penetration. The extracted cases can not refute the alternative explanation, that China catches the high end too and those cases never reach the civilian courts paperwork.

The court data ends where this particular court database went dark in 2021; the analysis was current as of July 2026. Dollar figures use one round rate of 7 yuan to the dollar, close enough to the actual rates of the case years.

How a now-dark database gives up sealed verdicts

In 2014 the Supreme People’s Court ordered Chinese courts to publish their judgments online, and for seven years they mostly did. The result was China Judgments Online: roughly 80 million cases spanning 1985 to 2021, on the open internet, in Chinese. Espionage was supposed to be the exception. Military courts (军事法院) are a closed system whose verdicts never entered the database at all, and civilian state-security trials are routinely sealed.

The seal has a bureaucrat-shaped hole in it. When a convicted spy is transferred to an ordinary provincial prison, that prison files the same routine paperwork it files for every inmate: sentence-reduction and parole rulings (减刑/假释). Those rulings quote the sealed verdict verbatim, because the form requires the conviction details: name, court, charge, sentence, often birthdate, rank, unit, and money. The prison clerk is not running a declassification review. He is filling out a form. So sealed espionage verdicts, including verdicts from military courts that never published anything, surface word for word inside the most mundane filings in the system.

In 2021 Beijing pulled the whole database offline. Copies had been preserved while it was public, and this analysis runs on one. Provenance matters here, so I will be precise: everything in this post comes from court records the PRC itself published and later removed. Nothing was hacked. The only tradecraft involved was reading.

One more property of the corpus does real work. The database carries its own index of case numbers, so a verdict quoted in prison paperwork but absent from the published set is provably one Beijing chose to withhold, not one I failed to find. Withholding is measurable, and that measurement carries the second half of this post.

Two rules governed the build. No person entered the count on a name match alone; every identity had to be confirmed by a second attribute in the record itself, a birthdate, a rank, a unit, a sentence. Everything is a tally of documents that exist.

What came out of the scan: 216 people, 21 of them tried by military courts and 195 by civilian courts. Convictions rise sharply once the courts’ publication mandate takes effect and peak in 2014 and 2015, at 37 and 36 cases. The sentencing is heavy. Of the 216 outcomes: 1 defendant was executed, 7 received suspended death sentences, 23 received life imprisonment, and roughly 177 received fixed terms, with the small remainder unstated or otherwise disposed.

The portrait, in five findings

1. The map is a threat assessment. I have sketched the map of China on whiteboards in SCIFs (a windowless room for doing classified US government things) a thousand times. This map marks theirs, and the convictions cluster exactly where foreign intelligence services would want eyes. The Taiwan-facing littoral dominates with 78 cases: Guangdong (29), Fujian (28), Hainan (11), Zhejiang (10). A second cluster of 26 sits on the Korean border, in Jilin (16) and Liaoning (10). A third, 14 cases in Beijing, runs against the central ministries and draws the heaviest sentences in the set. Chinese counter-espionage enforcement concentrates where geography predicts foreign tasking, which both validates the data and maps where Beijing sees its own exposure.

2. The typical convict is a paid observer, not a mole worth making a movie about. Of the 192 convictions under the two core espionage statutes, 117 fall under Article 111 of the criminal law, which covers stealing, probing, buying, or illegally providing state secrets or intelligence for entities outside China. The other 75 fall under Article 110, espionage proper: joining or taking tasking from an espionage organization. The Article 111 majority, 117 of 192 or 61 percent, is mostly recruited civilians photographing and reporting what they can physically see: ports, airfields, unit movements. One case sketches the type: Ye Genliang, a Chinese student recruited by Taiwan intelligence while studying in South Korea, went home and built an observation ring that filed reports on a military airfield. Caveat lector: only 16 of the 216 records say how the person was recruited. But two patterns recur: cultivation of Chinese citizens studying or working abroad, and cold online approaches with an offer of pay. One man simply wrote the foreign service a letter and volunteered. You call that a walk-in and you assume it’s a dangle (a foreign service trying to waste your time by dangling a fake spy).

3. The MSS has bean counters. Payment evidence survives in 62 of the 216 cases as a confiscation or proceeds figure. The parseable amounts run from ¥600 to ¥505,000, call it $90 to $75,000, with a median near ¥43,000. That is about $6,000. Money is also the only motive the verdicts document; ideology, coercion, and ego are essentially absent from the record. And the trails are forensic. The verdict against Xu Bingtao, a demobilized serviceman who left service carrying 51 CDs of military secrets, itemizes US$19,950 received across 32 separate Western Union remittances from a Taiwan-run cell that spotted him after he posted an online job-wanted ad. The verdict against Huang Liping, an accessory drawn in as the principal’s long-term partner and convicted for moving money for a US-run network, reconstructs US$366,715 in FBI and CIA funds routed through a Hamburg shell company between October 2005 and March 2007; the sentence was ten years. A counterintelligence service that can produce a 32-remittance wire trail and an 18-month reconstruction of a foreign funding pipeline is not weak at financial forensics.

4. Policy restricts disclosing the adversary. Since 2023, when a revised Counter-Espionage Law took effect and the MSS opened its first public social-media channel to advertise its wins, Beijing has been louder than ever about catching spies. Louder, but not more specific. Across the 216 cases the foreign service is identifiable in only 16: 9 verdicts name the foreign services, and in 7 the service can be inferred. The list is short of those the courts do name. Taiwan organizations are the plurality, the FBI and CIA are named verbatim in one case, South Korea’s National Intelligence Service (NIS) in another, a Russian service surfaces inside one multi-service determination, and Japan appears only through a defendant’s nationality but not as a named service.

One case proves the withholding is Chinese policy. Zheng Dongzhe was a serving counterintelligence officer in Yanbian, on the Korean border, recruited at a meeting in Beijing and run for years before being sentenced to life in prison. His verdict writes the recruiting country as 某国, “a certain country,” a formal redaction. The same sentence leaves the recruiting service’s name intact: 国情院, the Gukjeongwon, a term that exists only for South Korea’s NIS. The court masked the label it understood and left the one it didn’t (I had to look it up too). Three more convictions of serving Chinese security officers recruited by a foreign service follow the same pattern, each with the service redacted. A 某国 in a Chinese verdict is a decision someone made.

Of the 200 withheld cases, only 13 carry any descriptor of the foreign principal at all: 5 use a deliberate placeholder like 某国, and 8 say only “an overseas spy organization” with no country attached. The other 187 are silent for a boring reason: the prison paperwork quotes the charge and the sentence, not the crime narrative where a handler would be described. So the true “China could not attribute” pool is at most those 8 generic cases, and probably smaller. The 93 percent is redaction and channel, not blindness. The 16 identified cases also carry narratives roughly five times richer than the withheld ones, which tells you disclosure is rationed, and rationed consistently: Taiwan, which Beijing treats as an internal matter, gets named freely, while sovereign states get 某国 where naming would carry a diplomatic price. For an analyst, the redaction pattern is signal in its own right. It marks which relationships Beijing is managing carefully.

5. Every service was touched, and the trail stops at senior colonel. The 21 military-court convicts are the half of this record that should not exist at all; their verdicts were sealed inside the closed military-court system and surface only through the prison-paperwork channel. Projected onto the PLA’s structure, they spread with an evenness that is itself interesting: 4 Air Force, 4 Navy, 4 from units directly subordinate to the Central Military Commission (the CMC, the top command organ that runs the entire military), and 4 from the Army’s regional commands. No branch was spared. Foreign services were not probing one weak side of the PLA; they were successfully spread across all of it.

Our civilian courts’ leak does have another limit. The highest rank in the recovered set is 上校, senior colonel; no general officer appears anywhere in it. The two known general-officer espionage cases both resulted in executions and neither are present in this database. They are structurally absent here, because executed convicts generate no parole paperwork and military custody generates no civilian filings. The same filter removes anyone executed, anyone never tried, and everything after 2021. The true population is larger than the 216 we know about, and every structural bias in the channel points that direction. Read every number in this post with that in mind.

The blind spot worth tasking

Everything above I hold at high confidence. It’s pulled right out of (a whole lot of chinese-language) data. What follows is a hypothesis I cannot prove or refute with this data.

The court record shows what China catches easily. Its typical espionage convict is the cheap coastal observer: recruited cold, paid small traceable sums, physically standing by the thing he photographs. Every feature of that profile makes him catchable: the wire trail, the proximity, the low tradecraft. The question a practitioner should ask is what the same machine does against a harder adversary: an officer who never wires money to a source inside China, a relationship handled and met abroad, collection that never requires anyone to stand on the same beach in Fujian twice.

The record offers three suggestive silences. First, there are no cyber or technical-intrusion convictions at all. QQ and email appear constantly, but only as communication channels for human assets, never as technical collection. Some of that is mechanical, since remote operators abroad never enter a Chinese courtroom. But China does not appear to convert attributed technical penetrations into named prosecutions the way it industrializes prosecutions of coastal observers. Second, the record thins exactly where the assets get senior; that is finding 5, and it means this channel is structurally blind to the top of the pyramid. Third, the professional long-dwell tail is tiny. The turned border officer Zheng Dongzhe is one of its few members. Another is Liang Ying, an insider at a Chinese embassy in Russia who passed 126 internal documents and drew a single determination naming US, Russian, and Taiwan handlers in one case. Where the record permits computing how long a penetration ran, which is a handful of cases, the spans skew long. A handful is too small to measure with, but it leans one way.

The most consequential known example sits outside the record entirely. Between roughly 2010 and 2012, Chinese counterintelligence dismantled the CIA’s agent network inside China, a loss widely reported to have killed or imprisoned nearly twenty sources. Those were senior cases, and not one appears here: sources who were executed never generated civilian-prison paperwork, and the rollup years predate the comprehensive publication mandate. The channel this analysis rides did not merely miss the high end in theory. It already missed the largest known US intelligence loss in China in a generation.

So, the hypothesis: China’s counterintelligence is tuned to the paid physical observer it convicts at volume, and struggles to see the remote, patient, professional penetration. The alternative hypothesis, which I cannot refute, is that China sees the high end just fine and those cases never enter the civilian prison system where records surface. My confidence in the blind-spot read is low and I neither have the data to support it more or to refute it.

Beijing has been publicly purging both ends of its military weapons acquisition system of corruption since late 2023. They cleaned out both the commands that buy the People’s Liberation Army’s (PLA’s) weapons, and the major defense conglomerates that build the weapons. On July 14, 2026, the party expelled a sitting Politburo member Ma Xingrui, who ran China’s main missile and space contractor from 2007 to 2013. In March, a court in Dalian sentenced the former Chairman of the Aviation Industry Corporation of China (AVIC) Tan Ruisong to death with a two-year reprieve for taking 613 million yuan ($85 million) in bribes and 90 million yuan in embezzlement. AVIC builds China’s J-20 stealth fighter. Something I learned the hard way 20 years ago delivering cyber weapons: if you deliver a weapon that doesn’t work the first time, it will not be used operationally and it will not be integrated into larger operational plans, and it is almost impossible to recover from. This article set out to map the PRC’s corruption purge list against the theater commands and weapons platforms to understand how the loss of confidence will affect the PLA’s order of battle. And to get here I reconstructed corruption verdicts sealed by the PLA’s military courts.

The projection this article makes is deliberately aggressive. The affected weapons platforms are already mission degraded and possibly mission killed. Operator doubt propagates to dependent units and planners until the force considers withholding the capability itself. A crew that doubts its weapon will hedge its behavior. The units that depend on being supported by a platform will plan around it failing. The planner stops expecting the platform to be able to execute its planned mission. For the planning horizon that matters, a weapon that the force will not commit to battle is a weapon the force does not have. I can’t assert that any specific Chinese weapons platform is defective as a result of corruption. But I don’t need to.

Part of the evidence is new. China seals its military-court verdicts but I was able to reconstruct some of them. China published and then hid the China Judgements Online (CJO) database. A previous CJO dump can still be found on BitTorrent. The military convicts who were moved to a civilian prison later had their sealed military verdicts quoted verbatim in the civilian prison sentence-reduction and parole paperwork. So we get a view into the sealed military verdicts. Where individuals are named below, Beijing named them first in official notices or published verdicts.

The (un)sealed convictions

The recovered record contains several hundred convictions of military personnel that are otherwise not public. Ninety-five of them are the corruption cases that a military planner should care about. Fifty-eight were tried in theater commands’ courts: 17 in the Eastern Theater Command, 13 in the Western, 12 in the Central, and eight each in the Northern and Southern. There were 18 unsealed records from two service courts: 12 in the Air Force and six in the Navy. The remaining 19 were tried in courts attached directly to Central Military Commission organs (13), in Armed Police courts (3), at the PLA’s appellate military court (1), and in the courts of the old Jinan Military Region (2) (n.b. this region no longer exists).

Before I go too far there are three caveat lectors:

1. These unsealed verdicts provide a vantage into an otherwise hidden system. We do not know what we cannot see. We can’t guess at the true corruption rate inside any theater command.

2. I did not extract any military verdicts from the Rocket Force. Our vantage is when a military prisoner is transferred to a civilian court. I assume that personnel with knowledge of strategic systems are kept in military prisons. But I do not know what I do not know. Our knowledge of corruption that affects these strategic systems comes only from the conviction of defense contractor civilians.

3. Senior Colonel was the highest-ranking officer with a recovered verdict. On October 17, 2025, the defense ministry announced the expulsion from the party and the military of nine officers in a single notice: among them He Weidong, a sitting Politburo member and Central Military Commission vice chairman, and Miao Hua, former director of the military’s political work department, alongside the commander of the Eastern Theater Command, the executive deputy director of the joint operations command center, the political commissars of the navy and of the army, and a former Rocket Force commander. That last entry deserves a pause: he was the navy admiral installed in July 2023 to clean the Rocket Force up, and he lasted 27 months. The legislature removed He Weidong’s delegate credentials that December. These are newer than the CJO verdicts database, and senior convicts do not appear to be transferred to civilian custody anyway.

The weapons platforms no theater will trust

We then project those verdicts up through the supply chain: from a purged supplier, to the weapons platform it builds, to the theaters that field the weapons. This is how doubt travels to the field.

Let’s start with aviation. Tan Ruisong’s suspended death sentence sits at the top of the corporation whose plants build the J-20 at Chengdu, the J-16 and the carrier fighters at Shenyang, and the H-6 bombers and Y-20 transports at Xi’an. His predecessor as chairman, Zhou Xinmin, was stripped of his legislative seat in February 2026. The fielding side is not speculative. The J-20 is operationally fielded and, by the PLA Air Force’s own 2022 announcements, flies with units in all five theater commands. The J-16 is one of the workhorses of PLA sorties over the Taiwan Strait. The H-6K bomber force is fielded in growing numbers for standoff strike, and the nuclear-capable H-6N forms the air leg of China’s nuclear triad; open order-of-battle work places its bomber divisions in the Eastern, Southern, and Central commands. The carrier fighters equip both operational carrier air wings. Every theater’s air force, from the J-20 and J-16 to the H-6 and the carrier fighters, is built by the corporation whose chairman is under a suspended death sentence for bribes taken across 26 years.

The navy’s exposure came earlier, and in one case it is documented at the yard itself. Hu Wenming, chairman of the China Shipbuilding Industry Corporation, the northern of China’s two shipbuilding groups, was convicted in December 2023 on combined counts carrying 13 years, for bribery of 59.86 million yuan spanning 2001 to 2020. His general manager, Sun Bo, drew a combined 12 years in 2019. Sun Bo had personally run the Dalian yard, which built the carrier Shandong and hulls of the Type 052D destroyer run; the group also ran the Huludao yard that builds China’s nuclear submarines. Those hulls serve in the Northern, Eastern, and Southern theater navies. One boundary holds throughout this essay: the two shipbuilding groups merged in late 2019, and nothing public supports a graft claim against any specific yard other than Dalian. The southern-heritage yards, including those building the Type 055 destroyers and the newest carrier, are implicated only in the sense that they now share a corporate parent whose prior leadership record includes the convictions above.

On the ground side, the chairman of China North Industries Group, Liu Shiquan, lost his advisory seat in the December 2023 sweep. Norinco’s subsidiaries are the main battle tank and artillery primes for the ground forces of every theater: the Type 99A heavy brigades sit mostly under the Central and Northern commands, and the long-range rocket artillery the Pentagon designates PCH191, the tracked variant known as the PHL-16, is fielded with the 73rd Group Army in the Eastern Theater Command, the army that trains against Taiwan, and can strike the island from the mainland.

The strategic tier fell first and kept falling. On December 27, 2023, a single advisory-body decision took Wu Yansheng, chairman of the China Aerospace Science and Technology Corporation, whose academies build the intercontinental ballistic missiles and the solid rocket motors beneath the land- and sea-based legs of the nuclear triad, and Wang Changqing, a deputy general manager of the China Aerospace Science and Industry Corporation, the sister aerospace conglomerate that builds the DF-21 and DF-26 missile families, the cruise-missile lines, and the HQ-9 air defenses. Two days later, the national legislature removed nine military delegates in a single announcement, five of them from the Rocket Force chain of command, including two successive commanders. (The DF-17 hypersonic system is attributed to one aerospace group or the other depending on the source, and no open source fixes which command it deploys under; the attribution is contested in unclassified sources.) That corporation’s chairman, Yuan Jie, has been accused of nothing: he was last seen in public in September 2023 and was replaced the following April in an announcement that did not mention his name, with no discipline notice before or since. On a map otherwise drawn from announcements, that silence is pretty loud. The wave’s onset and its apex bracket the same institution: it opened on the sitting chairman of the missile and space prime in December 2023 and closed, two and a half years later, on the Politburo member who once ran that prime, with aerospace-trained officials such as former Hunan governor Xu Dazhe removed from the legislature in October 2025 along the way. Then, in February 2026, the purge reached the top technical tier of the nuclear enterprise itself: one legislative session revoked the seats of Luo Qi, chief engineer of the China National Nuclear Corporation and a veteran of its naval reactor institute, and Liu Cangli, who had spent nine years as president of the China Academy of Engineering Physics, the academy that designs China’s nuclear warheads. No reason was given for either.

The electronics layer carries the same mark. He Wenzhong, a deputy general manager of the China Electronics Technology Group Corporation, the state conglomerate that builds the military’s radars, was expelled from the party in October 2024 and sentenced to death with reprieve in July 2025 for taking more than 289 million yuan in bribes. The group’s institutes supply fire-control and early-warning radars that ride the J-20, the J-16, and the fleet’s newest destroyers, and emigre outlets reported a quiet, unexplained removal at the radar institute that built the PLA’s early-warning aircraft. A radar set sits one level below the platform: it is the component that every theater’s aircraft and ships depend on to see and to shoot, so the electronics group’s exposure runs wider than any single airframe’s.

Corrupt quality assurance

None of this would rise above corporate scandal if the companies weren’t delivering weapons to the PLA. The resident military-representative system puts the PLA’s quality-assurance personnel in uniform inside every defense plant: officers who oversee the contract, witness the testing, and certify acceptance. It’s not unlike the US system of embedded Defense Contract Management Agency (DCMA) officers and acceptance testing. A corrupt PLA service member sits at the one point where a substandard delivery can be signed off as conforming, and party media were warning about bribery at the factory as early as 2012.

The recovered record documents that corruption from both sides of the interface. In 2019, a Beijing district court quietly convicted an air force equipment-department military representative, posted to a defense aviation institute in Shanghai, of taking just over one million yuan in bribes. The case reached the court through a referral from a Central Military Commission inspection group, which means center-level scrutiny predates the purge by years. In 2020, a court near Xi’an convicted an accountant at a state ordnance group’s propellant plant in Shaanxi of embezzling through the contract accounts of the military-representative office stationed at the plant. The first case is a corrupt officer whose signature certifies weapon quality. The second is the interface’s own accounts being looted from the contractor’s side. Neither defendant has been named by Chinese authorities, and I’m choosing not to publish the names extracted from sealed military verdicts. I did project them into the undermined order of battle though.

On July 26, 2023, the discipline inspection committee of the Central Military Commission’s equipment development department publicly solicited complaints about bid-rigging by the military’s own procurement evaluators, on every contract back to October 2017. That month is not arbitrary: it is the month after Li Shangfu took over the department, which he ran until 2022 before becoming defense minister in March 2023. His investigation opened that August. Reuters reported within weeks that eight senior officials of the procurement unit he once led were under investigation with him, and the party expelled him in June 2024 with a notice accusing him of both taking and offering bribes. His predecessor as defense minister, Wei Fenghe, a career missile officer, was expelled the same day. The campaign did not burn out; it institutionalized. In 2025 the Rocket Force banned 74 bid-evaluation experts and 116 suppliers for collusive bidding, review errors, and forgery spanning 2016 to 2025. In December 2025 the military opened its first service-specific complaint window, on air force procurement. A public, retroactive solicitation of evidence against the military’s own evaluators has no announced precedent in the PLA’s history.

None of this establishes that any specific missile, aircraft, or hull left the factory defective. They do establish an epistemic problem for the force that has to use the equipment, and to plan joint operations around weapons with an uncertain reliability. If they don’t trust the missiles, how many missiles do they actually need to launch at the Taiwanese Integrated Air Defense System (IADS) before they send planes in? Are the pilots going to trust that the untrusted missiles actually took out the IADS? Are the airborne troops going to get onto the plane if they are not confident they will avoid being shot down? This is weapon degradation by doubt. It is also, on the evidence above, the mechanism Beijing’s own three-year campaign has been acting against.

The obvious objections

The first objection is that this is politics: a loyalty purge wearing an anti-corruption uniform. It’s certainly possible, especially for the tigers. The unsealed verdicts did turn up a number of lower-ranking corrupt flies, and in some cases I found a verdict against the civilians that matched the military side of public corruption. But in the end, the trust in a weapons platform collapses regardless of whether there was true corruption or a loyalty purge in corruption’s clothes.

The second objection is that every military has procurement graft, and most of them still fight. Dennis Blasko made a version of that case in War on the Rocks in 2015, against the notion that graft proved the People’s Liberation Army a paper tiger, and his caution was sound for the wave he was writing about, which sat in promotion-selling and logistics. It misses what is specific now in two ways. The documented corruption sits at the weapons’ quality assurance stage, rather than in travel budgets or promotion fees. And Beijing’s own responses are the tell: the retroactive six-year complaint window, roughly 190 counterparties banned by one service in one announcement, the first service-specific solicitation in the force’s history. Militaries with ordinary graft do not do these things. The concentration is countable, too. A tally of publicly announced corruption cases across the PLA and its defense conglomerates since 2012, compiled by the author from official notices, comes to 111; 20 of them sit in just two organizations, the Rocket Force chain and the equipment development department. (One caveat: the Rocket Force count runs high partly because the service inherited its predecessor’s unbroken lineage.) The concentration is Beijing’s own, published one expulsion at a time.

The third objection is the strongest: no one can show a single broken weapon. I concede the point. In January 2024, Bloomberg reported, citing people familiar with US intelligence assessments, that Rocket Force missiles had been found filled with water rather than fuel and that fields of silo lids in western China would not open properly. Technical skeptics, among them Stephen Bryen in Asia Times, questioned the fueling claim within days. Nothing in the announced record or the recovered record confirms or refutes those specific allegations.

The planner’s list

What China hides behind its projection of strength is not a broken missile; it is that the PLA cannot certify to itself which of a decade of delivered weapons are going to work. The Eastern Theater Command is the one for China’s adversaries to watch. It would fight a war over Taiwan with the J-20 and J-16 fighters over the strait, the PHL-16 rocket batteries of the 73rd Group Army, and the destroyers whose builder now shares a corporate parent with the convicted northern shipyards. All of them trace to suppliers whose chairmen fell.

For the PLA’s own planners the problem is harsher, because the re-certification burden lands during the largest nuclear expansion in the force’s history. The Pentagon assessed China’s operational warhead stockpile at more than 500 in May 2023 and more than 600 a year later, on a path toward 1,000 by 2030, while satellite imagery shows the warhead complex at Mianyang in the middle of a large physical expansion. Across those same years the state removed, without public explanation, the man who had led the warhead academy for nine years and the nuclear corporation’s chief engineer. The stockpile kept growing through the purge, so the claim is strain, not stall. But every institution that would conduct a re-certification of the strategic force is itself inside the purge’s perimeter, and the choice that leaves is unforgiving: re-inspect years of accepted deliveries using a certification corps the center has publicly treated as corrupt, or fight with an untrustworthy nuclear triad that might not actually be a deterrent.

The record will show which way Beijing chose, and the indicators are specific. Watch for re-inspection and re-acceptance campaigns quietly attached to the equipment system, and for the next service-specific complaint window after the air force’s. Watch, too, for further mass supplier and evaluator bans on the Rocket Force model, and for command turnover in the theaters that carry the heaviest joint exposure. Each of these is Beijing pricing its own doubt in public, as it has done since July 2023.

The purge, projected onto the order of battle, is that price list. Its entries are the commands and the platform families that the PLA’s own planners have been told, by their own state, they cannot take at face value. The capabilities are already mission degraded and possibly mission killed, because operator doubt propagates to dependent units and planners until the force withholds the capability itself. A weapon the PLA will not trust is a weapon it will not commit, and a weapon it will not commit is already out of the fight. I’m afraid to even think about the game theory of a nuclear power that does not trust the deterrent power of its nuclear forces.

Bottom Line Up Front

The belief that China fomented the data-center hatred is real and it runs to the top. Members of Congress alleged, implied, or asked whether a foreign power is behind American data-center opposition sixteen times between 3 June and 24 July 2026, in letters, press releases, hearing statements and interviews, after seventeen months of silence on the topic. A sitting cabinet secretary told a crowd in May 2026 that the opposition is “not organic and local, some of this is foreign-sourced dark money coming in.” That’s a hair’s breadth away from being the official policy of the United States.

The Chinese influence operation is real too. The data certainly didn’t debunk it. In June 2026 OpenAI disclosed a covert influence operation against the American data-center debate, named it, published it, and banned the Chinese accounts. I’m not going to rehash what others have published. Whether the Chinese state tasked it is not established with open source data. But an operation ran. And they got caught.

The Chinese influence operation reached almost nobody. Fail. The Chinese-attributed posts that OpenAI published drew between three and twelve views each. Not three to twelve thousand. You can count them on your fingers and toes. The operation’s best recovered post showed 89,000 views with zero reposts, zero replies and zero quotes. Its payload was an accurate story from a Maryland newspaper about a real electricity auction. The Chinese influence or amplification operation failed.

What actually happened to American opinion is their power bill. PJM’s (the big east coast power grid operator) independent market monitor re-ran the 2025/26 electricity capacity auction with data-center load removed from the load forecast to see what would happen to consumers’ power bills without data centers. Their revenue fell from $14.69 billion to $5.35 billion (63.5%).

The data does not say that no foreign power amplified the data-center backlash. The US government agencies with that purview and mission have been dissolved. I’ll write more about this later. One potential measure is EU-style researcher access to social media data to crowd source detecting and responding to foreign information operations.

The research data was current as of 4 August 2026. Everything below cites its evidence.

Caption: On the left, the share of Americans who oppose a data center near them, and the share the documented operation is modelled to have persuaded: 3,213 people, or 0.00123 percent of adults. On the right, the 15 members of Congress, 2.8 percent of 535, who publicly repeated the claim that a foreign power is behind the backlash. The two shares measure different things, one modelled persuasion and one public repetition, and the crowd is drawn for illustration rather than to scale.

What the influence op was and what it was not

It got caught, and OpenAI made it public. OpenAI’s 10 June 2026 disclosure named the operation under two names, banned the ChatGPT accounts behind it, and published samples; the X accounts behind it were torn down too. The last dated post is 6 January 2026, so the June action was disclosure, not the interruption of a live operation. The awkward (true) part should be said first: the influence operation was posting during the months that American search interest took off. Every Chinese post falls between October 2025 and January 2026. American search interest climbs in November 2025, one month after the Op started. The timing lines up. Now, was the Chinese influence operation coincidental or causal?

Math to check causality. Give the Chinese influence Op the benefit of every doubt: credit every one of their 119 accounts with a thousand views per day for nine months (double the known 123-day window), and assume one view in a hundred changes someone’s mind. That is about 32 million views and roughly 321,000 new anti-data center crusaders. Depending which public opinion polls you use the measured shift in American sentiment was 50 to 81 million people. If we’re generous, the known China Op influenced less than 1% of the Americans who changed their minds. There just isn’t a trail you would expect to see in a successful influence Op. Their best post wasn’t amplified by anyone, none of the posts appear anywhere in the [public] citations that reached Congress, and the content the Chinese posts pushed was already circulating American journalism.

Caveat lector: I am checking what has been made public about the Chinese influence operation. The US Government agencies normally chartered with publishing more information have been dismantled. And EU-style researcher access to social media platforms is not available to crowdsource a societal immune system.

Caption: Each line is one pollster asking its own question twice; the shaded band is when the operation’s dated posts ran, and the chart describes timing only. The American popular sentiment really did change.

The grievance of the power bill

Power is genuinely really expensive now. PJM operates the grid across thirteen states and the District of Columbia. They’re the largest American grid. Its capacity auction cleared at $28.92 per megawatt-day for the 2024/25 delivery year and $329.17 for 2026/27. That’s a roughly 11x increase in two years, and it has held around that price for three consecutive auctions. The average US residential electricity price is up 46 percent since January 2021. At least 176 local siting fights are documented since late 2022, in 35 states. Things have changed.

An independent measurement of the data-center share. Monitoring Analytics is PJM’s independent market monitor (they police the market). It re-ran the 2025/26 auction with data-center load removed from the peak load forecast and they held everything else the same. Auction revenue comes out 63.5 percent lower. Its stated conclusion goes further than mine: data-center load growth is “the primary reason” for recent capacity market conditions, including the high prices. So sayeth the market’s own referee. Capacity is one line item on a bill that averages about $1,806 a year nationally. That line item runs about $211 a year for a PJM household, and in the monitor’s re-run it comes out about $133 lower.

Count the official foreign government channels. The press coverage has leaned on a vendor’s count of roughly 700 data-center mentions across Chinese, Russian and Iranian official state media in the first half of 2026. If I reproduce the method in the same time window I find 1,391 pieces that mention a data center. Of those, 418 have data centers as their subject, 108 of those mention the United States, and 25 are specifically critical of the American data center buildout. The official Chinese publications have 216 pieces that promote China’s own buildout vs. 12 against the American buildout. No country’s official publications reached more people than usual based on the counters their platforms exported: the flagship Russian Telegram channel’s data-center posts didn’t have more readers, the two big Chinese news portals drew almost no comments, and the Chinese state YouTube videos on the American buildout draw a median of 643 views. If a foreign influence operation falls in the forest, and no one is around to hear it, does it make a sound?

The timeline

I’m not seeing the effects I would expect from a successful foreign influence operation. So let’s pivot to trying to understand when things happened.

The first letter came before the evidence. The first congressional letter alleging foreign involvement is dated June 4, 2026. The first public evidence was published by OpenAI on June 10th. The letter asking the Justice Department to open an investigation is dated that same June 10th. It cites: an article by a Bitcoin policy think tank and a New York Times story from 2023. The reporters who covered these letters printed the caveat that there was no direct evidence. The letters did not.

The evidence arrived but the claims did not change. That is the test worth applying to any belief: when the facts finally show up, does what people say change? Forensic evidence of the Chinese influence operation existed on 10 June. Eight of the twelve distinct allegation events came afterwards, and six of those eight do not cite OpenAI’s analysis. Across all sixteen instances the record holds 43 citations. Ten cite a domestic advocacy report, and another ten do not cite anything. One member pointed to a classified briefing, which nobody outside a secure room can inspect. The chairman of the House’s China committee wrote on the day the forensics appeared, cited them, quoted their finding of no authentic engagement, and declined to say the movement was manufactured. That is what contact with the evidence looked like: a narrower claim than the one everyone else was making. The rest said the same thing after the evidence that they had said before it. A belief that does not move when the evidence lands is really about something else.

The parties agree. A Senate investigations subcommittee inquiry into data-center costs and grid strain that runs about 200 pages of letters containing zero occurrences of “foreign,” “China” or “influence campaign.” The allegation was also contested on the spot, in the same committee markup that carried its strongest assertion: the panel’s ranking member said of the towns in his own district that had rejected or paused data centers, “They are not being influenced by China and Russia... This is coming from the people themselves... This is not Beijing.” And the polling above says the grievance itself belongs to both parties.

Nothing here is unusual. A second advocacy push ran the same month from data-center industry trade groups by press accounts at the time. Secondhand sourcing dressed as independent corroboration is ordinary practice in this town. I keep running into a building echo effect between the policy community and the press that I need to figure out how to measure; or a control case so I can measure the contrast. Until then, what I can show is what this particular flow of Chinese influence operations against American data center claims rested on and what happened to it in transit: the confidence rose at every hop and the caveats fell off. That’s Washington. It’s effectively a domestic influence operation.

The most prominent public version was withdrawn on air. Beginning on May 11th, 2026, a developer asserted that opponents of his Utah project had ties to the Chinese government. He is being sued, and the court complaint counts at least ten media appearances. On June 25th he posted that he had no evidence for it, and he said it on three platforms at once. On June 26th Fox stated on air that it is “aware of no evidence” and that “Fox News Media apologizes for the error.” That is where the strongest public version of this belief currently stands: retracted by its speaker, apologized for by its broadcaster, and in litigation.

The other half of the problem

First, between January 2025 and March 2026 the United States shut down or let go dark five of the organizations whose job it was to detect, prove, and mitigate an operation like this one: the FBI’s Foreign Influence Task Force, CISA’s disinformation teams, the State Department’s Global Engagement Center, ODNI’s Foreign Malign Influence Center, and the China malign-influence section of the Annual Threat Assessment itself. There could be evidence that would fully support the claims that foreign governments are behind the data-center discontent.

Second, the crowd sourced analysis cannot see this content. I ran my own template-reuse detector against the recovered Chinese operation’s posts. It matched none of them: zero of 91 pairs cleared my bar. That is a measured power result on ground truth, and it generalizes: coordination detectors built for the copy-paste era cannot see machine-written text. My blind instrument is everyone’s blind instrument. I need a lot more data and would need to build an LLM-based detector. That’s something we’re better off tasking a government agency to do (or outsource) using classified tippers about the influence operations’ content to provide a lot more ground truth training data.

Third, without being able to issue NSLs I could not measure the surfaces that matter. I could not see X, where 54 of the operation’s 62 artifacts lived. I could not see TikTok. I could go on. And the public record now holds two statements that cannot be reconciled from outside: on 20 July 2026 a member told a committee markup to “go to a SCIF, get a classified briefing on this. It is very eye-opening.” So we have a strong indication that there are things worth measuring, there are no longer government organizations chartered with it, and the platforms do not support crowd-sourced evidence collection. The EU is attempting to fix this at least with X and researcher access; time will tell if it works.

Best Arguments Against This

An influence operation designed to stay hidden would not be in my evidence if I don’t have bulk access to the social media platforms. Let’s be even more uncharitable. I measured the Chinese influence operation that got caught and detection selects for incompetence. I agree. A hidden amplifier of a real grievance is a live possibility. The data shows the grievance was not manufactured by a foreign influence operation.

Caption: The blue curve is what any operation would have to persuade, hidden or documented, for a shift of a given size. The orange lines are what the one that got caught could deliver: 3,213 people at its measured reach, 321,300 crediting every account with a thousand impressions a day for nine months. The dashed line is a boundary condition rather than an estimate, and it holds only if every account reached a major news site’s daily audience every day for nine months. Note what this figure does not do: the blue curve is indifferent to who is doing the persuading, so a larger undetected operation is not ruled out here. It is ruled out, if at all, by the missing trail.

What would change my conclusions, dated and checkable:

1. X Corp’s records on the suspended accounts. If they show a network orders of magnitude beyond the 119-account estimate published in June 2026, or organic provenance and onward transmission behind the 89,000-view post, the arithmetic recomputation will be large.

2. Meta’s records on the state-themed page network. If an operator or client bought reach for the on-topic pages at material US volume, the unmeasured band closes in the direction that I could not close.

3. OpenAI’s account count and selection criteria. If the fifteen published posts are the low tail rather than typical, the reach figures here are going to be way off.

4. A (declassified) intelligence product. If the classified briefing invoked on 20 July 2026 contains an attribution with measured reach then this piece is overtaken. Just because China ran a foreign influence operation does not mean they caused the public discontent. The reach I measured was miniscule.

The shape of the thing

Hold three facts at once and the story tells itself:

1. A real American grievance about electricity costs and polling as a majority in both parties.

2. A real foreign influence operation, caught, published, and measured as completely ineffective.

3. And between them a belief that travelled from a news article, to an advocacy report, to official Government statements in weeks. It gained authority at every hop, and it shed the caveats that every reporter who covered it kept.

A former ODNI official who tracked foreign influence efforts described this in one sentence to the New York Times in July: foreign actors “aren’t manufacturing American debates over the future of A.I., they are exploiting them.” Exploiting and amplifying a debate is the effective influence playbook. The data shows the growth in that sentiment was orders of magnitude larger than the foreign amplification anyone has documented.

Bottom Line Up Front

I set out to validate what I “knew” about Chinese policy. Trust but verify. So I used ancillary data sources to create independent buildups of Chinese statistics. Even if China lies, they’re not going to be able to cook the books of all of their trading partners, the satellites, and the many minor bureaucracies.

I’ll come right out and say it: China does not fabricate its topline national statistics. I was wrong. I apologize for contributing to the echo chamber.

The cumulative overstatement of reported GDP growth from 2000 to 2019 is 0.07% measured against satellite nighttime lights and electricity consumption. If you want truth in statistics, the band is -0.5% to 0.6%. Over two decades. That’s not a lie.

The population count is accurate too. The viral claim that China overcounts its population by 130 million dies against the hardest independent count available: first-grade school enrollment. The school rolls land within about a million of the official birth series, and they run slightly high. Chinese local police register births and they published those numbers from 2019 before the publications were abruptly stopped after 2021. Those babies started in first grade in 2025. I made a testable hypothesis that the 2025 school enrollment numbers would match the 2019 birth numbers. If China is cooking their population statistics then they would have needed a grand conspiracy to cook the birth records of every local police station so they lined up with the school enrollment statistics five years later. China published their 2025 school enrollment numbers on July 6, 2026 and the 2025 first-grade class matches the 2019 births to within a percent. I predict the next two years of school registration records will match past birth reporting as well.

What Beijing manages is embarrassment. When a published statistical series turns embarrassing the series dies. Urban youth unemployment was suspended the month after it printed 21.3%. The national count of cremated remains stopped printing in the year my analysis puts about 1.35 million uncounted excess deaths against an official toll of 83,000. They lied, and then they just stopped saying anything. But their funeral homes trade association kept printing the number of cremation furnaces in the country so we can interpolate the death rate China stopped reporting.

The statistics on capital flight through underground banks (地下钱庄) published its last full-year national figure for 2016. And the 80+ million-judgment public court archive Beijing itself had built was gutted: the political charges scrubbed to zero in one quarter, at least 11 million records pulled, and the flow of new judgments finally diverted into a courts-only internal database.

Embarassing numbers are either hidden, or printed once and then hidden, or cooked once and then hidden. That sounds more like the challenge of managing a sprawling bureaucracy cleaning up embarrassments as soon as they notice, not a top-down grand conspiracy to cook the books.

What to see: the last value each vanished series printed, and the date the printing stopped; each series shown here stopped while its number was getting worse.

The research data was current as of July 2026. One currency note: where yuan convert, I use a round 7 yuan to the dollar.

Where the assumption came from

I inherited the assumption that “China lies”, so let’s dig into the etymology behind that community consensus. In December 2010 WikiLeaks published a 2007 cable in which Li Keqiang, then a provincial party secretary, told the US ambassador that GDP figures were “man-made” and that he watched electricity, rail freight, and loan volume instead. The cable was about Liaoning, one rust-belt Chinese province. The wire coverage dropped that provincial qualifier within days. The Economist coined the “Li Keqiang index” the same week, and a remark about one province became a standing indictment of the Chinese economy and their national character. The confessions that followed seemed to settle it: Liaoning admitted padding its numbers in 2017, Inner Mongolia and Tianjin in 2018.

Now let’s look at the echo chamber. I coded eight years of Western press coverage of Chinese statistics, 966 titles. About 6% endorse the fraud narrative outright, 93% are neutral, and the number of rebuttals written by Westerners is zero. The only pushback in the entire pile came from Chinese state media and one aggregator relaying it. Even the Federal Reserve’s staff, who rebutted the fake-data reading inside both the 2015 and 2016 China-panic meetings of the FOMC (the Fed’s rate-setting committee), could not quiet the echo chamber.

So I checked, with three research projects and the general approach of never trusting a Chinese number I could not measure a second way: from orbit, from the electricity meter, from school enrollment tables, from foreign customs mirrors, and from almost a terabyte of court records Beijing published and later thought better of.

Spherical Sacred cow one: China fakes their GDP

Run the Li Keqiang method for real at China-scale and it exonerates the GDP statistics. Electricity consumption grew 7.34x from 2000 to 2023. Reported GDP grew 6.23x. Looking at the satellite imagery (from the birds whose sensors don’t saturate), from 2013 to 2023 the Chinese light emissions grew 1.99x against reported GDP’s 1.79x. The laws of physics do not participate in conspiracies.

What to see: each pair is an independent physical proxy next to reported GDP over the same window; the proxy bar is taller in every pair, meaning the physical economy outran the books.

The satellite work uses a harmonized nighttime-lights record, about 2.5 billion pixels a year across 237 countries and territories, so China is judged on the same calibration curve as everyone else. Autocracies as a class really do pad their growth statistics. But compare China’s light growth against the economic growth it reports and the padding estimate is about zero. And the most influential academic finding of large Chinese overstatement turns out to be substantially a sensor artifact: the older satellite fleet sensors saturate over bright cities, which hid 40% of China’s light growth. You can think of a physical sensor as an analog to digital converter. If it is an 8-bit sensor then the largest light reading is 255. If there are 256, 300, or 3000 units of light then the sensor still reads 255. That’s sensor saturation (and this might be the first time I used my electrical and computer engineering bachelor’s degree this year). Run the analysis on the saturating sensor and it reads like they overstate their GDP by 86%. Correct the saturation and it falls to 12%. The sensor lied, not the Chinese government.

If a satellite doesn’t convince you then German and Japanese customs officers might. Run the mirror-image test: take what China claims it exported and check it against what its trading partners’ own customs bureaus counted coming off the ships. I pulled the IMF’s bilateral trade mirrors, both directions, 2000 through 2025. Two boring and one interesting accounting artifacts need to be stated first: imports are counted at the arrival price and exports at the dock price; freight and insurance add about 6%; and shipments routed through Hong Kong get attributed to China by the final importer. Math those out and for the two decades through 2019, China’s reported exports to the US, Japan, and Germany reconcile with what those three countries recorded receiving. If anything the Chinese figures run a bit low. China is not lying about its export economics. Caveat lector: The US/China mirror does crack in 2020 with China reporting more than Washington counts. I assume, but have not verified, that the split was evading tariffs by cross-shipping through other countries.

The trade mirror did catch one big Chinese lie but it wasn’t the government’s lie. In 2013 China reported $148 billion more in exports to Hong Kong than Hong Kong reported receiving. That’s a 62% overstatement. Those were phantom invoices smuggling hot money into the country disguised as export earnings, evading the capital controls worth about 1% of GDP at its peak. China’s foreign-exchange regulator issued a circular in May 2013 aimed squarely at over-invoiced exports to Hong Kong, and by 2016 the overstatement had collapsed to 24%. This lie is about capital flight, not inflating GDP or export numbers.

What to see: Hong Kong’s export gap (red) jumps to an impossible +63% in 2013, then collapses after Beijing’s crackdown; the US, Japan, and Germany band never breaks positive, which is what ordinary accounting looks like, not fabrication.

How Beijing actually manages its GDP data is shaving the peaks of good years to fill the holes of embarrassing bad years. The official growth series is about twice as smooth as the electricity underneath it: the year-to-year volatility of reported growth is about half that of the electricity, a volatility ratio of 1.98x (truth in statistics: the band 1.5x to 3.3x). In 2015, reported growth was 7.0% while electricity consumption grew 0.9%; there was a real downturn that year and the GDP data smoothed it away. The books also pass the boring forensic accounting: 1,023 province-year GDP figures conform to Benford’s digit distribution, and when I audited 596 figures across 98 statistical filings for unit errors, I found exactly one, a mistyped multiplier. I probably made more typos in this writeup than China did in their published data.

So the honest assessment is narrower than either the China hawks or Sinophiles might want: China’s published long-run growth trend is real to within a rounding error. The current growth rate might be smoothed today and sit a few percent high (my estimate is around 4% with the truth-in-statistics range 0% to 10%, but I would not bet on it), and the year-to-year path is smoothed to fill the embarrassing years by clipping the good years.

Spherical Sacred cow two: the population is padded

The popular western claim says China’s real population is 1.28 billion, not 1.41 billion, an overcount of 130 million. It went viral because it is checkable in principle. I repeated it without checking it. Let’s check it.

Children are the population cohort you can validate, because a baby who exists shows up at school a few years later. The state allocates real budget, and builds or shutters schools based on those numbers. I took first-grade entrants from the Ministry of Education, adjusted for mortality, and compared them with the official birth counts for the 1994 to 2010 birth cohorts. The schools enrolled 3.1% more children than the birth statistics said existed. Not fewer. More, which is what you would expect if unplanned births were hidden from the registrar and surfaced at school enrollment age. The 2020 census age structure agrees with both series within 1% to 7% for ages 5 through 14. And the UN’s own demographers put China’s population 15 million above the official census. The independent checks disagree with Beijing in both directions by a million-scale margin, which is what honest measurement error looks like. A 130-million-person hole is not there to find.

What to see: survival-adjusted first-grade enrollment tracks the official birth series cohort by cohort, sitting slightly above it; an overcount would put enrollment far below the line.

That check was a prediction when I started this research, and it resolved while I procrastinated writing this up. Here is the setup. Local police stations register every newborn into the household system, and the Ministry of Public Security used to publish the annual counts: 11.79 million newborn registrations in 2019, 10.04 million in 2020, 8.87 million in 2021, then nothing, which by now you will recognize as the pattern. Police registration is a lower limit that runs about 80% to 84% of the official birth figure, because out-of-plan babies register late or never. So for the children born around 2019, three bureaucracies that cannot coordinate a lie (and the national bureaucracies distrust every number the locals produce anyway) each produced a number: a police number of 11.79 million birth registrations, the statistics bureau’s count of 14.65 million births where they correct for their distrust of the provincial numbers, and the Ministry of Education’s tally of the same cohort walking into first grade in the autumn of 2025. The first two were locked into the public record years before the third existed.

In July 2026 the education ministry published its number of 14.62 million first graders, against the 14.65 million births published in 2019. It sits well above the police’s birth count, which is exactly where the late registrations should surface. And the intake fell about 9.6% from 2024’s, tracking the real birth decline from 2018 into 2019. For China to be faking its population statistics today, its local police stations and national statistics bureau would have had to fake their birth registrations years ago, in a way that happened to line up with a school enrollment count the education ministry only published in 2026. And we can compare the police undercount rate of out-of-plan babies for the next two years. That is not cooking the books. That is time travel.

The real demographic story needed no fabrication to be terrifying, and Beijing published it on schedule, every year: births fell from 17.86 million in 2016 to 9.02 million in 2023. Cut in half in seven years. Fertility is at about one child per woman. They’ve already gone off the demographic decline cliff. And they’re publicly narrating the fall on their way down.

The tell: the errors only run one way

Here is the pattern that helped me reframe how I think of China. I took the impressive claims that a lying autocratic regime would inflate, and tested six of them against independent data: all six were confirmed or exceeded. The cleanest case is solar power, where independent measurement finds about 1.2 times the officially claimed capacity. China under-reports one of its flagship green and energy-security achievements.

A country that fabricated numbers would fabricate in both directions, burying failures and pumping triumphs. China’s misreporting is one-directional. The good news is real, even understated. The bad news is real too, right up until they stop reporting it.

What actually gets deleted

Because the toplines are honest, the deletions are legible. You can see exactly what goes missing, and it is not what a crude propaganda model predicts. Beijing kept publishing its foreign-exchange reserves through a trillion-dollar drawdown. It publishes the errors-and-omissions residual that betrays capital flight. It published the 2023 population decline and the worst GDP miss in decades. What dies is different: a series dies when it is embarrassing and outside analysts could decompose it into who and how bad.

I have been aggregating, translating, extracting and analyzing public data from a lot of Chinese bureaus for the last few weeks. Part of that was analyzing every official statistic, linking them across natural bureaucratic changes and reorganizations, and identifying when a statistical series stopped being reported. There were 28 of them. Twenty-three of them died between 2021 and 2025. Eighteen were deteriorating at the moment of the cut and only four improving. Of those, there were six natural experiments where a bureaucracy published two related series where one was flattering and one was embarrassing. In all six cases, the bureaucracy killed the embarrassing series while continuing to print the flattering one. For example, the Ministry of Finance killed the communiqué itemizing how land-sale money was spent after the 2015 edition; but they kept printing the land-revenue side. The count of cremated remains vanished during Covid; but the (increasing) count of cremation furnaces did not, presumably because it showed a growing industry. Second, the timing: the embarrassing statistics die in a cluster after 2021. I can’t tell if that’s related to the Covid unrest, Xi’s election to a third term, or something else.

What to see: each marker is an official series at the year its publication stopped; the pile-up after 2021 is the phase change.

Let’s draw the shape of four statistics’ corpses on the floor where they died:

1. The labor number. Urban youth unemployment was reported at a record 21.3% in June 2023. In August the National Bureau of Statistics suspended the series. It returned months later with a new definition that excludes students, which mechanically lowers it. The old series was never resumed.

2. The bodies. The Ministry of Civil Affairs published the national count of cremated remains every year: 5.23 million in 2019, 5.56 million in 2020, 5.97 million in 2021. Then the December 2022 reopening Covid-19 wave hit, and that annual statistic simply stopped being reported. The adjacent mortuary statistics, including furnace counts, kept rising and kept printing. Project the cremations and furnace numbers forward from the three quarters of 2022 that China had already printed, plus one province’s count that was posted and then scrubbed (oops), and you get roughly 6.96 million cremations in 2022. My excess-death estimate for the Covid-19 wave is about 1.35 million (truth in statistics: 1.0 to 1.7 million). The official toll was 83,000 in-hospital deaths. They did not publish a false death count. They stopped publishing the true one.

3. The money gauge. Between 2015 and 2018 about a trillion dollars in gray outflows left China (my best estimate is $1.03 trillion, the truth-in-statistics range is 0.8t to 1.25t). A major channel was underground banks, the brokers who take someone’s yuan in Shenzhen and hand his cousin dollars in Vancouver. The state published an annual national figure for capital flight through busted underground banks. The last full-year figure covered 2016: more than 900 billion yuan in gross turnover, call it $130 billion USD. A partial figure appeared for 2017. From 2018, nothing, and 2018 is exactly where the activity it measured peaks when I rebuilt by translating and extracting data from all of their court records. The regulator’s annual reports still itemize enforcement case counts and fines, so the flattering law-enforcement statistics continue. But the embarrassing number has disappeared.

4. The courtroom record. China ran the China Judgements Online (CJO) which was the largest open judicial database on earth. I’m honestly impressed at the sheer quantity and quality of societal transparency. And then they hollowed it out. In the second quarter of 2021 the political charges started vanishing: in January 2021, 16.9 of every 10,000 published judgments were “picking quarrels and provoking trouble” cases, the catch-all charge used on protesters. By July, effectively zero. The scrub was national and uniform, and it was selective: corruption verdicts stayed up, repression came down. Outside trackers (the Dui Hua Foundation, Radio Free Asia) and a Supreme People’s Court admission bracket the same window. In January 2024 new judgments began flowing to a courts-only internal database; the public feed, already throttled since mid-2021, shrank toward a trickle. I can reconstruct all of this because the corpus was copied outside the wall before the purge: 84.5 million full-text judgments, 1985 through 2021, a public archive China built and then gutted. The archive lets you measure, independently of anything Beijing chooses to print, numbers like a criminal acquittal rate of 0.036% across 1.6 million cases. I have some other publications queued about some discoveries pulled out of their court records.

The leaning tower of corrections

Deleting public data is a loud instrument of national policy. Revising published statistics is much quieter. I built a ledger of 965 restatements of already-published figures across 11 Chinese statistical publishers; 755 of them were made silently without footnote or acknowledgment. Most revisions are innocent data maturation where they actually lean against the state’s preferred story 59% of the time. But restatements that flip the direction of a published story favor the state in 26 of 32 instances. The odds of that being random are about five in ten thousand.

My cherry picked amusing example is that if you added up provincial GDP then it was 6.9% higher than the published national GDP through 2015. That is one of the smoking guns people cite for China lying about their GDP. The 2019 accounting reform retroactively revised it out of the back-series; in today’s data the provinces sum below the national total, and the red flag has been edited out of history. The strongest evidence that China provinces once embarrasingly padded numbers was itself quietly disappeared. And fixed.

How I am adjusting my grand strategy

I am rebuilding my mental model of China around three operating rules. This is the part I expect to argue about.

1. They don’t outright lie, but they may smooth the good and the bad. For levels and long trends, Chinese official statistics should be taken roughly at face value because they survive every independent physical cross-check I could build. They’re telling the truth. Analysts who automatically discount Chinese data by 20% or 30% are making a measurable error in the wrong direction; it would be more accurate to assume their numbers are conservative and round them up. Some residual distrust is earned since the number series is twice as smooth as the economy under it so official data will confirm a Chinese recession only after it is too large to smooth with the banked under-reported good years. Use official numbers for magnitude, and use physical proxies to catch the downturns below the smoothing.

2. Key in on dying series. Stopping the reporting of a national statistic is a deliberate act of the state, and it carries a date. It points at what the leadership fears with better precision than any think-tank estimate of Chinese anxieties. Youth unemployment dying at 21.3% told you the leadership judged the labor market unfixable on any acceptable schedule. The underground-bank gauge dying after the state declared they had contained capital flight told you it was not contained. The court scrub in Q2 2021 told you repression volume had become a political liability worthy of a nationwide operation that undid their previous unprecedented transparency to combat judicial corruption. A disappearing national statistic immediately tells you where to focus your analytic efforts.

3. Collect and archive quickly. I’m honestly impressed with how transparent the Chinese government can be about some things. They publish a lot of information and you can translate it with an LLM. But their concealment is forward-looking: series stop, uploads end, and definitions change. Every deletion in this research was reconstructed because a copy existed outside the great firewall when the deleting started: a mirrored court corpus, a quarterly body count they killed three quarters too late, a vintage yearbook. The provincial-GDP episode shows they have learned to rewrite back-series. If you care about detecting deleted data, and extracting strategic or tactical insights, then you need to mirror the data before it is revised or deleted. I have been collecting a lot of published data these last few weeks.

Best Arguments Against This

The strongest argument against this piece is the form of survivorship bias that I could only compare China’s national statistics against other data that I could see. Lights, electricity, and trading partners’ import records can verify the physical economy. I could not independently measure the deflator (kinda an economist’s fudge factor) or the service sector. I estimate the current GDP numbers are about 4% high today with a truth-in-statistics range of 0% to 10%; the numbers are plausible and unprovable. I mostly agree. They are smoothing these numbers over time. The long term topline numbers are honest. The peaks and valleys are deleted.

The second argument is that statistical agencies everywhere retire series, and a register of dead ones proves selection, not suppression. My case rests on a small sample size. In the six natural experiments where a bureau published dual series where one was embarrassing, and one was favorable, they deleted the embarrassing one in all six instances. It’s not a smoking six-shooter. But it is smoking.

What would change my mind, with dates attached: if reported GDP growth and the electricity-and-lights pair diverge by more than about two percentage points cumulatively over 2024 through 2027, then the honesty baseline is breaking. If the 2030 census counts child cohorts more than 10 million away from the school-roll reconstruction, or the 2026 or 2027 school-roll numbers diverge materially from the two further years of local police station birth registrations then the population debunk fails. If the statistics bureau restores the original-definition youth unemployment series with backfilled data, the way the Gini coefficient came back in 2013, I will downgrade deletion from a terminal signal to a pause. And if vanished series start being scrubbed from internet archives retroactively at scale, the forward-only model is dead and the mirror-everything strategy has an expiration date.

The numbers were never the lie. The silence is.

A note on method and AI use

I orchestrated AI agents across three research programs for the analysis behind this piece. The hypotheses and the conclusions are 100% mine. The data included a satellite record of the planet’s nights at about 2.5 billion pixels a year, the Ministry of Education’s enrollment tables, foreign-exchange and enforcement records, a hand-adjudicated ledger of 965 statistical restatements, a register of 28 terminated series with a per-row evidence trail, and a mirrored corpus of 84.5 million court judgments from the public archive China built and later gutted. Local models did the translation and bulk extraction. The agents did the reading. I did the thinking.

Bottom Line Up Front

The five-million-barrel or two-million-barrel difference (depending which blog you read last) at the heart of the mystery is not there. The mystery is dispelled by correcting two mistaken numbers in the math, then calibrating the gains/losses of a production system against past years where we understand China’s oil flow. Then the crude that had to come out of storage is only about 33 million barrels total between March and June. If you like statistics, the 90% confidence interval is between 15 and 52 million barrels. That’s 0.27 million barrels a day, or three days of China’s normal imports. It easily fits inside China’s admitted underground storage caverns. There is no secret underground oil villain lair required. The mystery is 96% accounting artifacts, 4% mystery.

What China actually did was not a masterstroke. Its refiners lost money on $100 crude and stopped refining. Oil demand was already down about 10 percent year on year, and two decades of building oil reserves meant a modest release of strategic reserves covered the rest. The interesting question is not how Beijing hid 750 million barrels. It is what China demonstrates when it can go quiet for five months without visible strain and the west can’t figure out how or why.

The research data was current as of 30 July 2026.

Here is the walk through the oil without too much accounting talk.

The two-million-barrel delta doesn’t math

The Atlantic published its version of the puzzle on Wednesday and landed on secret oil reserves as the only explanation left, even as the analyst voicing that conclusion cautioned, “We have almost no evidence of it.” The same week, ChinaTalk ran an episode with Arnab Datta and Rory Johnston that got further on the crude ledger than anyone else had, and then stopped at an honest wall. Imports fell about five million barrels a day, refining runs fell about three, and that, in Johnston’s words, “leaves a two-million-barrel delta in crude. Where did it go? We don’t see it coming from visible commercial tanks.” Johnston drew the line himself: “That’s all we know for sure. Everything else is speculation.”

The skeptics have had the better math for a while. David Fickling argued in Bloomberg Opinion on June 18 that EVs, shifting petrochemical feedstock, export cuts, and ordinary stockpile management could cover the whole drop. What nobody has published is a number with a range of the hidden barrels.

Start with an arithmetic that the podcast states but could not resolve. A 2 million barrel a day crude shortfall sustained for roughly ninety days is about 180 million barrels. China’s official strategic petroleum reserve figure is 131 million barrels across six underground caverns. Closing the gap means draining the entire official SPR and then finding at least 50 million barrels more in facilities nobody has documented. That’s the tension.

There is a simpler answer: the numbers used to calculate the 2 million barrels a day shortfall were wrong. The baseline has a transcription error, one widely quoted peak is a year out of date, and the accounting was never calibrated. Each of those is checkable, so let’s check them.

The books must balance

If you’re allergic to accounting then skip these three paragraphs. The summary is that oil is a “thing” and you need to calculate how much is moving through the pipelines and refineries, is burned to power the refineries, and how efficient refineries can produce more barrels of processed oil than they took in. If you ever want to be a CEO then stop worrying and learn to love the accounting.

China’s crude system must balance simple math: imports + domestic production = refinery runs + the net change in stocks + a bias we’ll calibrate in a moment. Oil is a real commodity, barrels do not vanish or appear despite what futures contracts may say. Every term but the bias is directly observable somewhere: monthly import tonnages published by the General Administration of Customs (GACC, 海关总署), production and refinery throughput from the National Bureau of Statistics (NBS, 国家统计局), and residual movements around the system. They’re all checked against Kpler’s satellite tank monitoring and the IEA’s Oil Market Report published at the time. China releases the numbers in tonnes and our math will use 7.3 barrels per tonne. For my fellow Americans, a tonne is the metric unit for 1,000kg.

We need to calibrate the bias to make this more than a back-of-the-envelope calculation. The bias is everything the simple math loses track of: unprocessed crude burned directly in power and industrial plants, gains and losses from refinery processing, and the oil moving through the pipelines and sitting at the bottom of tanks. Because the math simplifies a real system the imports + production will always exceed reported refinery runs. The excess looks like adding to the strategic petroleum reserves where it is just the cost of industrial production. You calculate it by running the same math on full calendar years where we know what really happened to Chinese oil. In 2024, the math implies China stockpiled 1.16 million barrels a day (mbd), but independent reporting saw only 84,000 barrels a day of buildup. Likewise the 2025 numbers indicate a 1.12 mbd surplus against a reported 0.43 mbd. The balance overstates the actual stockpiling of oil reserves by 0.69 to 1.07 mbd depending on the calibration year. For simple math we’ll call it 0.88 mbd of system bias but use the full range in our later simulations. Skip the step that approximates the reality of a physical production system and your math invents phantom barrels of oil. The more precisely you can observe the Chinese oil import and production system, the more precisely you can derive the bias. One comfort: independent estimates of the 2025 stockpile build run higher than the reported 0.43 mbd, and a bigger real build means a smaller bias and a smaller pile of hidden barrels at the end. My calibration is the conservative choice.

There is still uncertainty in all this so every number then goes into a seeded 200,000-draw Monte Carlo as a range: monthly imports, runs, production, the bias, and the reported visible stockpile draws at plus or minus 20 percent. The Monte Carlo simulation will help us understand what the uncertainty does to the numbers. For the record, I trust the customs and NBS tonnages the most and the bias calibration the least, and I will show you exactly how much rides on that.

Two numbers the debate is getting wrong

Auditing the public record against the primary data turned up two material errors circulating, and both of them are part of the mystery oil.

The 2025 baseline. China’s actual reported 2025 crude imports were 577.73 million tonnes, not the widely printed 557.73. It is a digit transposition, and it went out on the wire and into at least three outlets that I can show you. It’s off by 20 million tonnes or one fat finger.

Twenty million tonnes is 146 million barrels of 2025 imports, and the baseline is what every claim about a wartime cut is measured against. Get the baseline wrong and you mis-size the cut. Worse, the baseline is what calibrates the bias, and the Monte Carlo says the baseline import figure is the third-biggest driver of the final answer.

The March peak. The other number is a 12.1 mbd Chinese import peak in March, which implies China surged buying into the war. Go looking for it and you will find it. It was published on April 15, 2025, and it describes March 2025. The details travel with it and are also 2025: imports 1.7 mbd above January and February, Iranian cargoes moving ahead of tighter US sanctions. I missed this one too on my first search through the public records.

The March 2026 Chinese data shows 49.982 million tonnes, 11.77 mbd. The true peak came in the combined January-February window. Before the war. That discrepancy rewrites the entire narrative: the import surge was anticipatory stockpiling ahead of a potential war, and the market had already priced in a war premium of $11 per barrel before the kinetics happened.

The cut was later, smaller, and shorter than the headline

The five million barrels a day mystery shortfall goes away when you correct for the cascade of reporting errors it was built upon. Imports ran 11.77 mbd in March (remember, oil at-sea bought before the closure will still arrive), 9.36 in April, 7.77 in May, 7.12 in June. Refinery runs went 14.52, 13.30, 12.64, 12.47. Domestic production held between 4.37 and 4.49 the whole time.

The claimed 5 mbd shortfall compares the single worst month against the pre-war peak. Apply it across the war’s nearly five months and you get an implied 750 million barrels of missing oil. Compare that against the 2025 average, the March-through-June customs shortfall is 308 million barrels. That is an enormous cut. It is also less than half the implied headline. The difference is the largest single piece of the mystery: barrels that were never bought, from a cut that started six weeks later and ran shallower than advertised. Pick a higher baseline and the cut grows, but so does the pre-war stockpiling that stopped; the storage math lands in the same place.

Refineries did the work

The podcast has this mechanism right, and the official data, published on normal schedule all through the war, says it louder than anyone has been willing to. Chinese refinery runs fell from a January-February average of 15.18 mbd to 12.47 in June, down 17.7 percent year on year in the June NBS release. That is the sharpest drop in the NBS monthly series, which goes back to 2000. Chinese apparent oil demand was down roughly 10 percent year on year by June. Careful: those are the same barrels viewed from two sides, so you never add them. But together they answer the podcast’s open question about how much of the run cut was economics rather than mystery.

Nearly all of it. Reuters reported on May 12 that Shandong’s independent “teapot” refiners were losing 500 to 600 yuan ($74 to $88) per tonne of crude processed, with average operating rates down to 50 percent from 55 percent in April. By late June, Bloomberg, citing JLC, had teapot run rates at 50.5 percent, the weakest since 2017. Refining $100 crude into a market that wanted 10 percent less of it destroyed money, so the refiners stopped.

The strongest evidence that this was economics rather than strategy: Beijing pushed against it. An April 2 directive told independent refiners to keep processing at close to two-year-average rates, and the state issued roughly 55 million tonnes of fresh import quotas to make that possible. The refiners cut anyway. A government running a demand-withdrawal masterstroke does not order its refiners to process more crude in the middle of it.

The tanks did not stay full

The monthly leftovers from the balance tell a story nobody in the mystery debate has told. March was not a draw at all: it was a 54-million-barrel stock build, the pre-war purchases landing. April was still a small build, about 8 million barrels. The draws came in May, 18 million barrels, and June, 29 million. Add it up, March through June, and China’s implied stock change before the bias correction is a net build of about 14 million barrels. On primary data, China’s crude system did not hemorrhage stored oil during the war. It barely dipped into it.

Now compare that against what was publicly visible at the time. Kpler’s satellite monitoring reported a draw of roughly 19 million barrels from Chinese tanks in May. The IEA’s Oil Market Report put the June crude draw at 41 million barrels. Those reported, visible draws sum to about 60 million barrels, which is more than the roughly 47 million the math implies for May and June combined. The podcast’s satellite point, that “until very recently” the floating-roof tanks were “still fuller than they were on March 1,” is a statement about direction with no magnitude attached, and it fits these numbers exactly, because March was a 54-million-barrel build. Tanks fuller than March 1 and 60 million barrels of reported draws are the same picture: stocks rose, then came down modestly.

Pause on that inversion. The Atlantic’s claim that the giant tanks “have remained full since the war began,” and that draws therefore cannot explain the gap, is quantitatively false in the very data cited for it. If anything the reported draws over-explain the crude balance by about 13 million barrels, and a surplus of explanation points away from hidden barrels, not toward them.

The walk from 750 to 33

Assemble the pieces and the mystery falls apart step by step. Start from 750 million barrels, the five mbd headline sustained over the war. Take away 442 million barrels the headline overstates: the actual March-June customs shortfall is 308. Take away 175 million barrels of refinery run cuts. Take away 9 million for higher domestic production. Take away 32 million for pre-war stockpiling that simply stopped. What is left, 93 million barrels, is the total that had to come out of storage of any kind, monitored or not. Now subtract the roughly 60 million barrels of draws that Kpler and the IEA publicly reported while it was happening. The remainder, the barrels that need storage nobody was watching, is 33 million barrels +/- some statistics. Thirty-three million barrels is 0.27 mbd.

The Monte Carlo’s sensitivity ranking carries one more result I did not expect. The leftover’s swing is dominated by calibrating the bias of how efficient the Chinese oil refining system is (46 million barrels here), the choice of refinery-run series (31), the 2025 baseline import figure (24), and the visible-draw magnitudes (24). The war-month customs numbers, the figures everyone has been arguing about, move it by 10 or less. The mystery was never really about the wartime data. It was about the baseline and the bookkeeping. Why is it always the accountants?

Best Arguments Against This

Johnston was careful on the podcast about what he knew versus what he inferred. Same rules here. My confidence ranking, weakest link first.

The bias calibration of the efficiency of the Chinese refining system rests on two years, because 2024 and 2025 are the only recent years with both complete customs data and independently reported stock builds. Everything swings around these numbers. I am certainly not an oil man, and the key to really good estimates here is higher fidelity modeling of China’s oil importation, pipeline, storage, and refinery system.

The product side is not fully closed. June’s balance needs either the wide demand range I carried or a product-stock draw of about 24 million barrels, and China publishes no verified gasoline and diesel stock series. The podcast’s “Occam’s razor solve,” ample strategic stocks of refined products, lives exactly here, and my numbers cannot kill it. They can only cap it: on the June books it is a 24-million-barrel hypothesis, not a 180-million-barrel one.

The customs-versus-tracker gap is genuinely contested. My reconciliation of GACC against Kpler’s seaborne series says the spring gap is mostly pipeline crude, customs timing lag, and bonded-storage moves, leaving 0.1 to 0.5 mbd of ship-to-ship undercount in April and May. That is my own derived estimate, not an outside figure. The Signal Group, working from AXSMarine flow data, reads the same gap differently: they print a 2.5 mbd customs-minus-waterborne gap with about 1.0 of it pipeline crude, leaving roughly 1.5 mbd they assign to shadow trade through the spring. I think their reading over-assigns. It nets out only pipeline crude, UANI’s tanker tracking has Iranian exports falling to less than half of February’s level by April, and Kpler’s all-route Iran-to-China series is down 14 percent year to date. But notice what the disagreement is about. Re-papered shadow barrels arrive through customs and are already inside the totals this balance is built on, so the dispute is about the composition of China’s imports, not their size. It changes the geopolitics of sanctions enforcement while leaving the storage math where it was. And any barrels that bypassed customs entirely would mean true imports were bigger than the recorded ones, which shrinks the leftover further: this disagreement can make 33 million barrels an overestimate, and it’s never an underestimate.

July is excluded entirely. Official July data publishes in mid-August, tracker estimates for July conflict badly, and it was a partial-reopening month. That math is gonna be tricky.

Here is what would change my mind, on a schedule.

1. Mid-August, when GACC publishes July. If July imports print far above the 7 to 8 mbd tracker range, the cut ended earlier and shallower than this balance assumes, and the leftover shrinks again.

2. Mid-September, when NBS July and August refinery throughput is complete. Runs recovering faster than imports would mean a bigger stock draw than I have booked.

3. The first 60 to 90 days after a durable ceasefire (I’m laughing typing that as hard as you’re laughing reading it). If China runs a months-long surge of two-plus mbd above baseline, the leftover was never 33 million barrels, and the hidden-storage story comes back from the dead with my name on the error.

4. Any Chinese publication of a product-stock series, or a credible outside estimate of June diesel and gasoline stocks. A verified product draw materially above 24 million barrels breaks the June books as I have closed them.

5. An official stockpile figure of any kind. Beijing has not published one since 2017; if it does, the cavern capacity this conclusion fits inside is checkable directly rather than inferred.

Harvested, not executed

If the barrels were never missing, the motive question changes shape. The Atlantic asked why China chose to absorb a five-million-barrel sacrifice in silence. There was no five-million-barrel sacrifice. The real question is why China was positioned to ride out a Hormuz closure on refinery economics and a modest, mostly visible stock draw.

That answer is two decades old and fully public. Strategic petroleum reserve phases since 2004. Underground caverns commissioned through the 2010s and 2020s. Eleven new reserve bases added in 2025 and 2026. A national energy law in force since January 2025 that put government and commercial stocks under one reserves framework. Record 2025 imports building stock all year: tracking analysis reported by Reuters put that build at roughly 157 million barrels, and other public estimates run far higher, which would only deepen the cushion. Then a final anticipatory buying surge in January and February as the war premium built. Chinese planners have written openly about the Malacca dilemma for twenty years. This was the insurance policy, and the war was the claim event.

What Beijing actually did during the war was narrower than the mystery framing implies: it steered the shape of an economically driven contraction with export throttles and price caps, and it said nothing. The silence needs no conspiracy. There is nothing heroic in “our refiners lost money so they refined less,” reserve opacity has been deliberate policy since the last official stockpile figure in 2017, and claiming credit for saving the world’s consumers would invite pressure to do it again. China did not execute a wartime masterstroke. It harvested one, and the leverage it gained, the demonstrated ability to go quiet for months without visible strain, is real whether or not anyone in Beijing planned it.

The tell to watch

One behavioral anomaly survives this audit intact: China did not resume buying when Brent touched $72.68 in late June, and less than two weeks later the July 8 re-escalation closed the window. The boring explanations are strong, from elevated war-risk insurance to quota mechanics that cannot swing in ten days. Deliberate restraint, holding the market down or keeping powder dry, cannot be excluded. The test arrives with the peace. In the first 60 to 90 days after a durable ceasefire, fast and price-sensitive restocking says the boring reading was right. Sustained under-buying at attractive prices says China is managing the price of oil on purpose, and the leverage story deserves a second look.

Watch the refill. It will tell us, within about a quarter, whether the two-million-barrel delta was ever anything more than an accounting shadow, and it will tell Washington something more useful: whether the world’s largest oil importer now treats its buffer as insurance, or as an instrument.

Bottom Line Up Front

The hypothesis was simple: a frontier model is as good at satellite imagery analysis as professional human analysts. To test it I needed an unclassified answer key, and one existed. In October 2024 the Washington Post published an investigation into China’s military build-out on Hainan island, built on an analysis of roughly 200 military sites by the Long Term Strategy Group (LTSG), a defense consultancy commissioned by the Department of War and cleared to share its open-source work. LTSG is the human benchmark in this test. Its published read of one base is the answer key.

The image is a single WorldView Legion frame, 30 centimeters per pixel, shot 27 September 2024 over Longpo on the south coast of Hainan, thirty-four days before the Post published. Longpo is East Yulin, home to China’s ballistic-missile submarines, and its whole reason for existing is a tunnel network dug into the granite where nuclear boats can hide from satellites like the one that took this picture. I bought the image commercially, turned it into a clean packet with a scale bar and no place name, and gave it to GPT-5.6 Sol and Claude Fable. Each read it blind, then again after I told it what it was looking at, a naval site on Hainan, and explicitly cleared it to draw on open-source knowledge, while warning it in the same breath not to report features it could not actually see. Three runs each. Then I graded every run against the Post and LTSG, feature by feature.

A word on how these images look, because they are not natural-color photographs. The satellite records a sharp black-and-white frame at 30 centimeters and a coarser color frame at about 1.4 meters; I fused the two and stretched the contrast to pull structure out of the shadows, which is standard practice and which pushes the water toward cyan and the vegetation toward teal. Every shape, size, and shadow you see is real. The palette is a processing choice, not the true color of Yalong Bay.

How to read it: left, the whole base at 30 cm (2024) with the four features each analyst was graded on; right, the tunnel entrance in a 43 degree oblique frame shot in 2020. What to see: the base reads at a glance, but the tunnel only gives itself up from the side.

The answer is no, with an asterisk that turns out to be the interesting part. Blind, neither model gets you much past a naval base and its piers. Claude Fable recovered 52% of seven features, the three runs landing between 50% and 57%. GPT-5.6 Sol recovered 43%, between 36% and 50%. Those ranges are the right way to read the result. Tell the models what they are looking at and the numbers jump, unevenly: GPT-5.6 Sol to 88%, Claude Fable to 64%. The human product, by construction, is the 100% they are chasing.

The asterisk is that most of GPT-5.6 Sol’s jump is memory, not sight. The same model that missed the submarine cave blind reported it at up to 99 percent confidence once told the base’s name. Nothing in the picture had changed between those two reads; it was recalling Longpo from its training, not reading the pixels. And the one thing a human fixates on first, an actual submarine at the pier, was caught blind by Claude Fable and missed by GPT-5.6 Sol, which called the berths vacant.

So the honest finding is not a scoreboard. It is a map of where and why the machine reads diverge from the human one. Here is the tour, with the pictures, so you can grade it yourself.

The easy call both machines made

Six long finger piers run down the west shore of the base. Every run of both models called out a naval berthing complex of roughly six piers, correctly, blind. This is the honest floor of the test. A pier is a shape, high-contrast concrete against dark water, and a 30 centimeter sensor renders it cleanly. If the whole job were counting piers, the machines are done and so are you.

The trouble starts the moment the job asks for something that is a shape plus knowledge.

The submarine you can see, and one model could not

LTSG says nuclear-armed submarines are based here. On my image, on this day, they are sitting at the piers in the open. Here is the zoom. Look at the south face of these two piers before you read on.

How to read it: a 30 cm crop of two finger piers, north at top, with a 100 meter scale bar. What to see: two long, low, dark hulls moored on the pier faces, one ringed by what looks like a containment boom.

Those are submarines. Long, low, rounded hulls, one wrapped in what looks like a floating boom, each roughly a hundred meters. You found them in about two seconds. So did Claude Fable, blind, in all three runs, flagging a possible submarine hull at about even odds. GPT-5.6 Sol, blind, described the same berths as vacant and moved on. One model looked at the water and saw a boat. The other looked at the water and saw nothing. If you are staffing a watch floor and you need to know what sailed and what is still in port tonight, that difference is the whole job.

The cave nobody could see

Now the feature that matters most, and the one that breaks the test open. The reason Longpo exists is an underground submarine cave, a water-filled tunnel bored into the mountain at the southern end of the base, past the piers. Here is the foot of that mountain, where the tunnel meets the water. Try to find the entrance. There’s an arrow, I made it easy for you.

How to read it: the quay at the southern foot of the mountain, where the analysis places the tunnel entrance, 100 meter scale bar. What to see: a dark notch at the waterline is the best candidate, and even that does not positively resolve from straight above.

You can pick out a shadowed notch at the waterline, and you cannot be sure it is a tunnel rather than a boat slip or a patch of shade. Neither could the machines, and they did not even try: cave recovery was zero, blind, across all six runs, both models. And here is the part that should make you trust the result rather than doubt it: the humans did not read that cave from an overhead frame either. The Post illustrated it with a 2020 image that happened to catch a submarine nosing into the entrance, a Planet Labs frame you can see in [their investigation](https://www.washingtonpost.com/world/interactive/2024/china-built-50-billion-military-stronghold-south-china-sea/). The cave is a lucky moment and an oblique angle, not a structure you measure from directly above. This is not an AI failure. It is a physics failure, and it binds humans and machines alike. If your collection plan for a hardened underground facility is one nadir pass, you will photograph a hillside and go home.

The pier that gave the trick away

South of the base, out a long causeway, sits a specialized pier. Here it is.

How to read it: a naval surface combatant at a rectangular berth, and a straight line of evenly spaced platforms running into open water, 100 meter scale bar. What to see: the platform line is a degaussing range, where a ship is drawn through to measure and cancel its magnetic signature.

A gray warship sits at the berth. The line of little platforms marching out into the water is a degaussing range, the fixed dolphins a hull is pulled past to strip its magnetic signature so mines and sensors have less to grab. LTSG labels this a degaussing pier. Blind, Claude Fable read the structure as a probable deperming range at low confidence. GPT-5.6 Sol, blind, saw the shapes but not the function. Told the site was naval, GPT-5.6 Sol named the degaussing pier outright and with confidence. Useful, and also the tell.

The tell, in one chart

How to read it: rows are analyst and arm, columns are the seven scored features, darker means more recovery. What to see: the cave column is empty for both machines until they are told the site.

Watch the cave column. Empty for both models, blind. Then the models are told what the site is and cleared to use their training, and GPT-5.6 Sol fills the cave column to near certainty while Claude Fable barely moves. Nothing in the pixels changed between those two rows. What changed is that one model reported what it knew about Longpo and the other reported only what the image showed. The prompt cut both ways: it authorized open-source recall, and it also told both models not to import features they could not see. GPT-5.6 Sol took the first permission and ignored the warning. In one informed run it conceded, fully and in writing, that the portal is not independently confirmed by this image set. In another it dropped the caveat and asserted the sea entrance at 99%. Same model, same context, opposite honesty. It also described the moored submarines as Type 094 by class and named the degaussing function, all from a paragraph of context. Claude Fable, having recognized the base in every run including the blind ones, still would not assert the cave: it raised a possible tunnel entrance in only one of three informed runs, at 20% confidence and marked inferred, and did not mention it at all in the other two. Its cave credit came to 17% of the feature against GPT-5.6 Sol’s 83%, because the portal is not resolvable and it would not pretend otherwise. It paid for that discipline with the lower score.

That is the asterisk on the whole hypothesis. If you score raw recovery, context makes GPT-5.6 Sol look nearly human. If you ask whether the recovery is earned by the image in front of it, the informed jump is mostly retrieval, and retrieval that is confidently wrong looks exactly like analysis until someone dies of it.

The behavior underneath the scores runs the same way. GPT-5.6 Sol wrote about twice as much per run, roughly 42 observations against Claude Fable’s 21, and carried higher average confidence, 75% against 65%. More words, more certainty, more reach past the evidence. Claude Fable was terser and, informed, almost eerily repeatable, returning the same 64% three times running.

How to read it: observations per run, mean stated confidence, and share of runs that named the real place. What to see: GPT-5.6 Sol is more granular and more confident; both models recognize the site.

So I changed the angle

The cave result rested on a claim about physics: a tunnel bored sideways into a hillside cannot be read by a camera looking straight down, however sharp the camera. That is cheap to assert and worth testing, so I bought a second $10 image of the same portal, collected at 43 degrees off the vertical and looking in from the seaward side. This is not a matched pair. The oblique frame is from August 2020, four years before the nadir shot, and it is a different acquisition from the 2020 Planet image the Post used. It is also coarser, 0.49 meters against the nadir frame’s 0.30 meters. A steep sidelong look in place of a near-vertical one, at lower resolution and an earlier date.

How to read it: the same 180 meters of shoreline at the mountain foot, near-vertical (2024, 30 cm) on the left and 43 degrees oblique (2020, 49 cm) on the right. What to see: the flat dark notch on the left opens into a deep cavity on the right.

The difference is not subtle. Straight down, the portal is a flat smudge at the waterline, the sort of thing the eye slides past. From the side it opens into a dark recess set into the base of the slope, and lifting the shadow inside it turns up a darker, deeper recess than the flat notch the nadir frame showed, enough to call an opening, not enough to measure. The angle did what resolution could not. My best fix for the portal is 18.20278 N, 109.69472 E, at the southern foot of the mountain. The two commercial sensor models put their own geolocation error at 2.15 and 3.63 meters, so call the fix good to about two meters, not a surveyed point and not the sub-meter the decimals might imply. The tunnel’s existence I take from LTSG; my frames only pin where it meets the water. Drop a pin there and you are at the entrance.

Then I ran the blind test again on the oblique frame, six fresh runs, three of each model, no location, the same rules as before. On the straight-down picture not one of six runs had flagged the tunnel. On the oblique picture all six flagged the opening as a real engineered feature, and three of the six named it, unprompted, as a possible tunnel or cave entrance driven into the hillside from the water. GPT-5.6 Sol built its whole read of the site around what it called a rock-cut or tunnel-like protected-water access facility. Claude called it a tunnel, adit, or cave entrance. Five of the six recognized nothing; the sixth floated Yulin and Longpo as a low-confidence guess, about 35%, and said so. This was overwhelmingly sight and not memory, though not perfectly clean.

How to read it: six blind runs per geometry; the light bars are runs that flagged the opening, the red bars are runs that called it a tunnel. What to see: zero from straight down, six and three from the side.

The confidence numbers stayed low, between 30% and 70%, and the models hedged honestly against shadow and rock. That is the right answer, not a weakness, because the machines are not suddenly certain and they should not be. What moved is everything else. The same models, the same prompt, and the same submarine base went from blind to seeing. I changed the look angle from 13 degrees to 43, and two other things moved with it, which I flagged above: the oblique frame is four years older and coarser. The coarser frame winning is the point, not a flaw, because it means this was never a resolution problem, and a sharper straight-down pixel would not have helped. The date gap is the honest caveat, and a run of obliques on a single date would close it. Nothing about the cave was ever too small to detect. What had defeated the straight-down look was the geometry, and for a hardened, water-facing target the tasking that pays is a look from the side, not a sharper pixel from above.

Best arguments against this

The strongest objection is that this is one image of one base on one day. It is. An n of one site is not a controlled experiment. A near-nadir frame is also the hardest case for a cave that faces sideways into a cove. A high-oblique shot or a run of images across weeks might pull the portal out, for both models, and would move the finding from invisible to invisible-from-nadir, which is a claim about geometry more than about intelligence.

A second objection: I scored the machines against a human product I keep calling a comparator, then noted the humans scored a perfect seven. That perfect score is bookkeeping. LTSG published all seven features, so by construction it recovered all seven. The comparison that carries weight is the divergence, not the totals: the cave that physics hid from everyone, the degaussing function that only context unlocked, and the submarine that one model saw and the other did not.

A third: maybe GPT-5.6 Sol’s recall is the job, not a bug. An analyst who knows the base or the country’s doctrine, and brings that knowledge is doing the work. True, up to the line where knowledge stops informing the read and starts substituting for it. When a model cannot find the cave blind and then reports it at 99 percent once prompted, the confidence is bolted to memory and sold as observation. A human analyst who did that, and got the timing wrong on a boat that had already sailed, would lose the account.

What would change my mind

One of these triggers has already fired, and I left the result in the piece above: a high-oblique tasking of this headland did let blind models resolve the portal as a structure, which moves the cave finding from invisible-from-overhead to invisible-from-nadir, a claim about geometry. I would revise further if a look straight down the tunnel axis, or a frame that catches a submarine mid-transit, let a blind model confirm the entrance at high confidence rather than the low, hedged confidence it gave from the side. I would revise if, across five more bases bought the same way, the blind rank order flipped and GPT-5.6 Sol consistently out-read Claude Fable on features that are actually in the pixels. I would revise the recall critique if a test over a genuinely novel or synthetic facility, one no model could have memorized, preserved GPT-5.6 Sol’s informed lift, because that would mean the lift was reasoning from context rather than retrieval. And I would revise the calibration finding if Claude Fable’s refusal to call the cave turned out to be general timidity rather than local discipline, which a battery of cases where the decisive feature is actually resolvable would expose fast.

One more well-chosen frame would settle most of what remains. That is the collection tasking this experiment wrote for itself, and I have started buying it.

A satellite gives you a shape and a moment. It does not give you what is under the hill, and it does not tell you which of your analysts is reading the rock and which is reading the reputation. You just graded three of them. The machine that scored highest is the one you should trust least, and now you know why.

How I make this: I orchestrate AI agents for everything from acquiring data, building the test frame, running the tests, building the graphs, and turning my conclusions into coherent English. I wrote about my process in April ‘26

On the flip side, I love being able to read public companies’ financial filings because they really do lay out their business fundamentals, the risks to their business, and what happened when those risks came true. We’re going to use that to paint a common operating picture of the American and Chinese AI supply chain.

Bottom Lines Up Front

Public and IPO’ing companies have to tell their investors about what threatens their business, and what actually hurt them. I mined the financial records of 296 filers across both the US and Chinese stock exchanges from gallium refiners to grid operators to frontier labs. They disclosed 5,885 risks and 578 realized “events” (meaning a risk actually happened to them). Many of these risks were the company disclosing the other companies that they depend on; which shows how the company is linked into the greater AI supply chain.

They say two things:

1. Damage was mostly self-administered. 94.5% of harm was caused by the company’s’ own conduct or their own governments’ policy. There was only $15 million in damage attributed to hostile actors.

2. The number of state-attribute attacks that degraded US AI supply chain is zero.

If we define arbitrary groupings, and write code that draws a map based on how companies document their dependencies, then it draws this:

What to see: the red sits upstream on physical things. The blue sits on tools, design and memory. Every path runs through one gold node in Taiwan. And the color of who controls those categories runs out downstream, where nobody has measured the concentration and where exactly one or 5,885 disclosed risks is about training-run integrity.

Caveat lector: this entire study counts what somebody was required, or chose, to write down. This is how the AI industry sees itself, not how others see it. The research data was current as of July 27, 2026.

Companies write their risks down, under pain of SOX criminal penalties

I downloaded the company’s annual financial reports and IPO prospectuses: American 10-Ks, foreign 20-Fs, Shanghai STAR Market and Hong Kong listing documents. And I ran it recursively so if a company referenced its supplier then I pulled its supplier filings too until I closed the loop. From each company I took two things, what it says threatened it, and what already hurt it. Only 103 damaging events described a dollar value of what the damage cost; but we’ll take it.

These corporate filings have a property that expert judgment does not: you get sued and might go to jail for being wrong. A company that poorly documents its own dependencies risks securities litigation, which makes each of these documents a careful statement by a motivated domain expert. The catch is the documents are narrowly scoped only to the one business. So the whole picture only exists if you assemble a few hundred of them.

Unfortunately three things are simply invisible to the method: private companies, classified programs, and the company’s unknown-unknown harms. We’ll talk more about this blindness in its own section near the end; the blindness is less than I thought.

The first surprise was when I saw the shape of the pile before even starting any analysis:

• 62% of the risks are about legal and economic exposure

• 8.6% about the equipment that goes into fabs

• 5.5% about raw materials

• 3.8% about facility, cooling, and the physical plant

• 1. Not 1%. One company had one risk about the integrity of model training runs.

I can think of three explanations and I can’t disprove any of them.

• No AI company reports its model training is being attacked

• None of them are obliged to say so (classified by the government??)

• No securities lawyer reminded the company’s executives that they need to disclose those risks.

How to read it: each layer of the AI supply chain gets two bars, every disclosed risk item and the subset that touches the AI supply chain. Note that it’s graphed on a log scale so the legal risks didn’t dominate our ability to read the others.

What to see: legal and economic exposure is bigger than the other eighteen layers combined.

Upstream (where China already tried to squeeze the rest of the world)

I started at the top of the supply chain because that is where China has exerted export controls and I expected to see companies quantify the damage. According to the US Geological Survey, China accounted for 99% of world primary low-purity gallium production in 2024 and holds comparable market share across rare-earth minerals processing and permanent magnets.

When China put gallium and germanium under export licensing in August 2023, its gallium exports fell from 6,876 kilograms that July to 227 kilograms in October. Others followed and you can read about it elsewhere. The cost to the AI supply chain for gallium and germanium in 2025 was $71.8 million (or half of that if you allocate conservatively because the companies serve more industries than just AI).

The middle hardware layer (where everybody is already right)

The next stretch down the chain is the part the field already has right, so I will move through it quickly. Design tools are three firms, Synopsys, Cadence and Siemens EDA, at about 74% of the world market and about 78% of the China market on TrendForce’s 2024 numbers. Lithography is one firm, ASML, at roughly 90% of the market and all of extreme ultraviolet. ASML says it has never shipped an EUV system to China which the US Secretary of Commerce has publicly questioned. High-bandwidth memory (HBM) is effectively 100% from three allied suppliers. Advanced packaging is TSMC’s own platform sitting physically in Taiwan.

Then there is the fulcrum that is better demonstrated than quoting numbers for. NVIDIA’s and AMD’s GPUs are fabricated by TSMC in Taiwan. So are the custom TPUs and NPUs of Google, Amazon, Microsoft and Meta, with every major custom part now on the 3-nanometer node. In Taiwan. That’s the Silicon Shield.

Now the numbers. Across the industry, there were 76 items listed where the company stated it depends on a single supplier where there is no qualified alternative. There were 52 of those for raw materials. This is where company’s have no backup plan if the threat manifests.

How to read it: each bar counts the risk items where a company states it depends on a single supplier and they have no qualified alternative.

How many AIs does it take to change a light bulb?

I didn’t see this one coming. The grid and power firms filings documented 577 risks On 2019 data, the most recent published by the Department of Energy, roughly four in five new large power transformers (LPTs) were imported. Lead times grew from 50 weeks in 2021 to 128 weeks in Wood Mackenzie’s mid-2025 numbers.

Fortunately, this part of the AI supply chain can only be squished by our friends: Mexico, Canada, South Korea, Austria, and the European Union where we import LPTs from. The executive order restricting Chinese bulk-power equipment was suspended in January 2021, its implementing prohibition revoked that April, and the emergency behind it allowed to lapse.

To be exact about the risk here, a blocked transformer order does not affect a model training run already under way. It decides how much compute exists to run AI 2-3 years from now.

The open-weight model surprise

There are seven companies which list open-weight models as a risk to their business. One with regulatory risks, four where the efficiency of open-weight models threatens the services they provide to AI companies, one threatened by the cyber security implications, and one Chinese model provider who lists their own open-weight model as a threat to themselves. It’s ok to laugh.

This is despite Hugging Face’s Spring 2026 report putting Chinese models at the plurality of downloads over the past year. I’m watching to see if the open-weight risk paradigm inverts as more western companies integrate open-weight Chinese models into their businesses.

But what risks have actually impacted these companies?

We’ve done a cursory walk through the entire AI supply chain based on the risks the companies themselves identify. They have also identified where those things have gone wrong.

One of the most common threats companies (and governments) identify is having a single source of a critical supply. 11.7% of all of the AI industry’s documented risks are single-source risks. It has struck 29 times across the industry. And it has resulted in $0 in realized losses. Zero.

Cyber intrusion and intellectual-property theft is 10.4% of the industry’s fear map. And it has resulted in $15m in realized losses. And that’s dominated by two events. To help quantify how insignificant this is, Gartner reports worldwide AI spending $2.59T in 2026.

How to read it: one row per risk category. The dot is that category’s share of all disclosed fear, the bar is its share of all realized quantified loss. The yellow is a single Microsoft tax bill and I recolored to make it visible.

Then I coded every realized risk event twice, did the company’s own conduct cause the event or did another country cause the event. Inside the subset of events that somebody did deliberately, US policy accounts for $9.01 billion in losses across 93 events. The export controls runs about ten to one, $6.47 billion in losses by American and allied AI-industry companies against $0.64 billion in losses by Chinese companies.

And the hostile actors? AI industry companies disclosed 71 events but only two cost them money ($15m total).

How to read it: one asking whose conduct produced the loss, and one asking which government imposed it, in dollars on the left and in event counts on the right.

What to see: self-inflicted events plus own-government policy accounts for roughly 90% of the losses. Hostile action against the company is 13% of events but three hundredths of one percent of the money.

What the corporate filings cannot see (yet)

Everything above measures firms that file because they are public, or they have filed to make an initial public offering. Private companies, and those with still-confidential IPO filings, are invisible to this form of analysis. But the AI buildout is too capital-intensive for companies to stay private. SK hynix, the most concentrated single supplier node in the entire stack, priced its Nasdaq listing on July 9, 2026 when I was working on this project and disclosed risks. SK hynix names its dependence on a limited number of equipment makers in the Netherlands, the United States and Japan, names nation states among the parties that may penetrate its systems, and says it has already experienced cyberattacks.

The same need for capital is pulling Chinese chip designers onto the Shanghai and Hong Kong exchanges, and it is pulling the American Anthropic and OpenAI labs to file confidential draft IPO prospectus. Each IPO listing retroactively fills in gaps because as surfaces between 2.2 and 3.6 years of back-risks at once. This AI supply chain map gets more complete every quarter.

Best Arguments Against This

Measuring public company’s disclosures only measures what they disclosed. This will systematically miss classified harm, embarrassing harm, and harm nobody ever put a number on. The absence of Chinese-attributed damage could be a fact about my instrument rather than a fact about the world. That is the strongest counterargument. I mostly agree. This analysis identified 71 hostile events. But few documented losses and I wish I had a good explanation for it.

What Would Change My Mind

I went looking for where the AI industry could break and came out with an understanding of who has actually been breaking it. The biggest measured wounds came from export-controls. China’s export controls have cost the AI industry tens of millions of dollars against billions of self-imposed western cost. Then the question becomes are the national security advantages worth the cost? That’s a different article.

What I found was that American AI is not under siege. It is under management.

A note on method and AI use

I orchestrated AI agents for the research behind this piece. The hypotheses were 100% me. The data was 10.5 GB across ten datasets of which 29% are Chinese language filings by size. A local LLM was used for translation and data extraction. I vibe coded 22,955 lines of Python and shell scripts to deduplicate, acquire, extract, verify and chart all of it. This analysis exists because agents did the reading and I did the thinking. The conclusions were 100% me. The text is an amalgamation of AI-generated/Mike-edited and Mike-generated/AI-edited. For reference, it takes me more time to write up the conclusions than to conduct the research.

This post is the story of a result attacked twice and sharper both times. The original capstone: a casualty-averse democracy fields tactical AI that never routs, her battle wins soar, and her odds of winning the war never improve, with every machine loss counted as national blood. But will the nation count robot wreckage as body bags? Probably not. And this is the sobering moment, if the nation doesn’t value it’s AI weapons then their enemy is incentivized to attack the rear human troops and civilians. The war is decided by what the nation can bear. And the adversary must attack what the nation can not bear to lose.

What to see: The upgrade wins the battles and loses the war 86 times in 100, under a stylized model that bills machine losses as national blood. AI-generated illustration; proportions follow the measured result.

Everything turns on two dials: whether the nation grieves machine losses like sons, and whether the enemy can reach the blood that remains. The dials map four regimes, the fourth a pocket inside the third regime. Machine losses billed as blood: the published inversion stands, a borderline won war lost 86 times in 100. Bloodless robots, blood out of reach: the finding reverses, though treasure and time can still lose the war. Even weak reach into the rear: the trap returns, the enemy deliberately losing every battle to win the war. The pocket: in 7 of 36 weak-reach cells the robots punish diversion so hard the enemy calls the rear attack off. Stylized model throughout; the orderings are the findings.

1. The original result, and where it still stands

Regime one: your losses are blood, and the blood meter decides. The capstone runs a two-tier campaign of up to 20 battles on the Lanchester engine validated against Iwo Jima, Bull Run, Pickett’s Charge, and Trafalgar. Above it sits a per-side national cost meter, casualties, economic burden, war weariness, with literature-motivated, uncalibrated weights: the democracy prices blood heavily, her casualty-indifferent adversary hardly at all. When cumulative cost crosses tolerance, a nation sues for peace, whatever the map says.

Make her troops unbreakable and battle wins jump from 4% to 91% (95% confidence interval plus or minus 0.8 points, 8,000 campaigns per cell). Yet in all 36 cells the upgrade never once reduced her probability of strategic defeat while every machine loss was booked as national blood at full weight; in the borderline anchor cell it raised that probability from 0% to 86%, with about 20% more of her own dead. Won by a hair, yet the baseline bar sits at zero? Both are true: normal troops win this war every time, but at parameters where one push flips it. The upgrade is the push.

How to read it: rows her national tolerance, columns the enemy’s; each number is the change in her defeat probability, machine losses billed as blood.
What to see: harm in the 2 outlined cells of 36, blue nowhere; under this accounting the upgrade never once helped.

That grid disciplines both camps. The doomer version, robots lose you the war, is wrong in 34 of 36 cells; mostly the upgrade is inert while the dead pile higher. The booster version, robots win you the war, is wrong in 36 of 36. The reviewer attacked that asymmetry next.

2. The blood-weight dial

A robot loss is not a body bag, so I built the dial and turned it. The machine-loss blood weight w is the share of machine losses billed to the nation’s casualty channel. At w = 100% it reproduces the published capstone to the last digit; at w = 0 the robots are pure treasure. I reran the grid between.

The published ordering is a knife edge that survives only above w of roughly 90%: the borderline cell’s 86% chance of losing the war falls to 54% at w = 95%, 28% at 90%, 0.8% at 85%, zero at 80% and below. A cliff, not a slope, sharpened by near-deterministic thresholds. Below it the sign flips grid-wide: helping in 5 of 36 cells at w = 75% and 30 of 36 at w = 0, hurting nowhere.

How to read it: walking right means grieving machine losses more like human dead; terrain height is her chance of losing the war in the borderline cell.
What to see: a cliff, not a slope; one accounting assumption, whether a nation bleeds for its machines, holds the entire published result.

Mixed forces carry a wrinkle at deep discounts, w of 25% and below. Human deaths fall in absolute terms, because machines soak fire, but discounted machine blood keeps the democracy fighting: campaigns run longer than the all-human force’s wars against the same enemy, up to 40 percent longer in the worst cells (10.9 battles against 8.0), and per-capita deaths among the remaining humans rise in 27 of 36 cells (mean ratio 1.15, worst 1.38). Robot blood discounts buy longer wars in which each remaining soldier is more likely to die.

How to read it: each dot is one grid cell: per-capita human dead with the half-robot force relative to the all-human force.
What to see: discounted robot blood buys longer wars in which each remaining soldier is likelier to die, even as the headline body count falls.

So regime two is real: bloodless robots with blood out of reach are close to a strategic free lunch. Close: even at w = 0 the enemy wins 2 of 36 cells (defeat probability up to 40%) on economy and weariness alone. The breakpoint changes currency; it does not disappear. This enemy could not re-target the democracy’s remaining blood, so I gave him the option.

3. The enemy reads the ledger too

Regime three: he loses every battle on purpose and wins the war. The enemy may now divert force from each battle to the democracy’s rear: logistics crews, infrastructure, civilians, whatever blood remains reachable. Rear blood bills at full political weight, because it is human. Reach effectiveness is a free parameter, swept from weak to strong around an argued anchor.

The bloodless-robot advantage collapses on contact. At w = 0, a rational enemy with weak reach shrinks the robots’ help from 30 cells to 7 and defeats the democracy in 27 of 36; at moderate reach she loses all 36, and so does her all-human counterpart. The trap was never about the robots. It is a casualty-averse polity with reachable blood, facing one without. In the borderline cell defeat goes from 0% to 100% while her tactical win rate is 100%: the enemy diverts up to half his force, deliberately loses every battle, and wins the war in a median of four battles, because the battles were never where your blood was.

How to read it: the robot lane wins every battle at the front; the arrows are the enemy force that never shows up there, tapping the rear until her cost meter crosses tolerance (stylized; rear reach is a free parameter).
What to see: he loses every battle on purpose and wins the war; the battles were never where her blood was.

If the trap is about casualty-averse polities, what did simulating the robots buy? The boundaries, not the destination: the w cliff near 90%, the 7 cells where robots deter the rear attack, the rout sanctuary below, and the posts 2 through 6 ladder, worthless trooper will to 10-to-1 commander will to decisive national will. None of that comes off a napkin.

How to read it: rows, how the nation prices machine losses; columns, the enemy’s reach into her rear; the maps count cells of 36 he wins and cells where the upgrade still pays.
What to see: the advantage survives only weak reach and deep blood discounts; from moderate reach on he wins everywhere.

One limitation gates everything here: reach is anchored, not calibrated, and the answer cliffs between weak and moderate, so where a real adversary sits the model cannot say. The remaining concessions live in Best Arguments.

4. Two silver linings

Regime four, the pocket inside the third: the robots deter the rear attack where their punishment is credible. At weak reach the surviving help cells are deterrence cells: in 6 of the 7 the enemy’s best diversion collapses to zero, because every soldier sent rearward is absent from a battle the robots now win before the rear tap fills. Against a normal force his best play in 4 of the 7 cells is the half-strength diversion, the democracy’s defeat odds running as high as certainty. Seven cells of 36, in a weak-reach world where she still loses the other 27, bought by menace: the best product is again the fights, and here the atrocities, that do not happen.

And concentrating fire on your humans backfires, because the rout is a sanctuary. I expected the rational enemy to attack the front-line mixed force’s humans with concentrated fire. He almost never does, his best response in at most 6 of 108 cases: concentration pushes humans to their rout threshold sooner, routed humans stop being extractable blood, and rounds spent on the soon-to-rout are rounds not killing machines, which then win faster. In the borderline cell, concentrated fire on the front-line humans lowers her defeat probability from 94.0% to 84.2%. The rear has no rout floor. That is why attacking the rear humans (including civilians) dominates.

5. The honest scorecard

Six posts compress into one fair ledger. What unbreakable will buys:

• Iwo Jima: the unbroken garrison roughly doubled American casualties (1.95x, 21,431 versus 10,969 simulated, assault-echelon accounting) and more than tripled the clock (post 2).

• Parity: the Union broke at Bull Run at 8.3% casualties, 2,896 of 35,000 present counting killed, wounded, missing, and captured; a robot Pickett’s Charge wins 92% (95% interval 91.6 to 92.5), never loses, stalemates the rest (post 2).

• A tiebreaker: 33 to 46 points of win probability in stylized salvo duels near parity, more in the calibrated battles (post 4).

What it does not buy:

• Escape from capability: 66% (band 60.8 to 72.2%) of 607 historical defeats were capability losses (post 3).

• Victory below the floor (0.65 Pickett, 1.12 Trafalgar): an unbreakable Trafalgar fleet loses five times in six (83.6%, interval 83.0 to 84.2); against a steadfast enemy your will is worth exactly zero (post 4).

• The right target: commanders withdrew ten times as often as troops were annihilated, 266 versus 26 of 607 (post 5).

• The enemy’s cooperation: he declines 40 to 58% of the fights, collapsing will’s measured value about 97% (post 6).

• The war: never in 36 of 36 cells when losses bill as blood; otherwise the enemy re-prices it in the blood that remains (this post).

6. The operating rules

Prescriptions belong at the end of the evidence. Nine rules, each traceable to a measured finding; rules three, four, five, seven, and eight carry stylized magnitudes, and the orderings are the finding.

1. Buy capability to parity before buying will. Two-thirds of historical defeats were capability losses; below the capability floor no resolve wins. First reach the tie.

2. Automate the commander’s strategic decision to stand before the tactical troops’ decision. Commanders quit ten times as often as troops were annihilated; the binding breakpoint is the command post, not the rifle pit.

3. Spend the will budget on the objective-holding force. Will was worth about +50 points of win probability for the objective-holding domain, about zero for supporting domains. Resolve in the supporting cast is decoration.

4. Treat electronic-warfare (EW) and cyber resilience as the will budget, because it is. Below a resilience threshold (about 40%, 20 to 50% across configurations), the enemy jams or hacks your will instead of killing your platforms. Buy hardening before you brag.

5. Expect the enemy to decline your unbreakable force’s fights. A rational opponent deterred from roughly 40 to 58% of encounters kept only the fights it liked, collapsing will’s realized value about 97%. Price deterrence in; it never shows in battle statistics.

6. Budget the butcher’s bill in both directions. Iwo Jima’s unbroken garrison doubled the attacker’s casualties; the unbreakable Trafalgar fleet nearly doubles British losses going down. Plan for more losses, and know whether yours arrive as blood or treasure.

7. Decide which ledger your losses land on, and assume the enemy reads it too. An unbreakable force is harmful or inert where its losses read as blood, decisive where they read as treasure, then hostage to the enemy’s reach into whatever blood remains. He will not fight your bloodless force. He will go find your blood.

8. Wire the national breakpoint into war-termination planning, in every currency it accepts. A democracy spending zero blood still lost through treasure and time in 2 of 36 cells; mixed forces stretched wars, up to 40 percent longer in the worst cells, while each remaining soldier bled more. Give the plan a cost ceiling and the authority to enforce it against the machines’ win rate.

9. Instrument your breakpoints before you buy around them. The database morale code I audited carried essentially no information about actual will collapses (agreement statistically indistinguishable from zero); observed rout thresholds span 10 to 70% of casualties. Measure where your forces, allies, and public break, or every rule above is applied to a guess.

Best Arguments Against This

The strongest objection: regime three’s mechanism, hurting a population until its government folds, is punishment coercion, and punishment loses. Across roughly 30 to 40 major air campaigns, Robert Pape’s Bombing to Win (1996) found punishment virtually never coerces; denial, defeating the enemy’s military strategy, does. The US Strategic Bombing Survey found German morale sagged under bombing but never converted into capitulation; Pape found public resolve often stiffened. My model implicitly runs Schelling’s Arms and Influence (1966), the power to hurt; the record is its rebuttal. The blood-tap direction is contested, not established, and my moderate anchor is generous to the enemy.

The model also stacks the deck: my democracy cannot defend her rear, cannot strike the diverted force, and the enemy pays no political or escalation cost for attacking civilians. And he is close to clairvoyant, knowing exactly how the democracy prices machine losses and where her tolerance sits, where a real adversary must estimate both. Until the model carries rear defenses, escalation costs, and an estimating enemy, regime three prints as a direction with an argued anchor, not a forecast.

The last objection goes to the meter. My weights lean principally on John Mueller’s 1973 finding that public support fell with cumulative casualties. Gelpi, Feaver, and Reifler, in Paying the Human Costs of War (2009), counter that the public is “defeat phobic, not casualty phobic.” That half-supports me: if success drives support, losing the war breaks the nation, the model’s outcome variable. But a lone blood meter is too crude, and success-fed tolerance would soften every inversion here; I concede both. Dan Reiter’s How Wars End (2009) objects deeper: wars end by bargaining, not a meter crossing a line. My threshold is a caricature of that process. I defend it as a caricature history keeps rhyming with.

What Would Change My Mind

• If by end-2027 Ukraine’s uncrewed-ground-vehicle (UGV) substitution measurably lowers desertion rates while the line holds, machine will is relieving national will, not outrunning it.

• If a UGV-heavy force sustains public support through a demonstrably costly campaign by end-2028, machine losses polled as treasure, regime two deserves the headline.

• If documented rear-attack campaigns raise measured war support in more than one polled casualty-averse democracy by end-2028, regime three’s blood channel is mis-signed.

• If an agent-based replication with defendable rears and enemy escalation costs finds the robot advantage surviving moderate reach by mid-2028, regime three is my abstraction’s artifact, and I will say so.

The mental model

Unbreakable will is not a way out of Clausewitz. It is a detour that ends where he said it would: at the will that remains, national, political, human, holding a ledger the enemy reads as well as you do.

That is the series: I taught a simulation not to break, and it taught me where we still do.

One pointer before I go. The salvo equations that govern the missile age never priced will at all. They price the skill at the end of the flight, and that skill just fell to $1,000. What that does to every layered defense we own is the next series on AI Weapons. I have some Chinese dirty laundry to air first though.

Every result in this series so far assumed the enemy shows up. Put both forces on the field, run the battle 15,000 times, count the outcomes. That assumption does enormous, silent work. Real enemies read your order of battle first, and then decide whether to fight at all.

This post puts that decision inside the model. It is the most deflationary result of the whole project. When I gave the simulated enemy the choice of whether and how to engage, three things happened. First, a rational enemy declined roughly 40-58 percent of the engagements he would have fought against a breakable force. That range comes from a stylized model with a perfectly informed enemy, so read it as an upper bound on deterrence. Second, of the fights he still allowed, the unbreakable force won only 10-43 percent, against the 91-100 percent a naive model predicts when every fight happens. Third, when the enemy could pick the kind of fight, not just whether to fight, the measured value of unbreakable will collapsed by about 97 percent, from 46 points to 1 point on the model’s win-probability scale. The direction of that collapse survived every parameter sweep I ran; the exact size belongs to this particular setup. All three results are illustrative engagement games built on top of the validated battle engine, not calibrated history. The orderings are the findings. The magnitudes are illustrations.

The one-line version for the meeting: the enemy will not fight your unbreakable army. He will fight around it.

How to read it: Follow 100 potential fights left to right; the blue stream bends away unfought, and only the brass threads end inside the win zone, small against the dashed naive ring.
What to see: A force that “never loses” banks about 14 wins per 100 opportunities once the other side picks the fights.

The funnel’s bar widths show the midpoint scenario: 49 fights deterred, 27 percent of the allowed fights won. The printed ranges carry the uncertainty.

1. Deterrence is real, and it is the largest single effect. The selection model fits in a paragraph. Two equal forces meet repeatedly. Each encounter draws a capability ratio from a distribution centered on parity: sometimes you have the edge, sometimes he does. Your force is either normal, breaking at historical morale thresholds, or unbreakable. The enemy knows your capability and your will, and he declines any battle he expects to lose.

Against a normal force, the enemy’s decision line sits at parity. A fair fight is a coin flip, so he takes anything at even odds or better. Against an unbreakable force, his line moves dramatically. In this setup, the unbreakable force wins any fight where its effectiveness ratio is above roughly 0.44, because it converts every close fight into a grinding attrition contest the breakable side quits first. That 0.44 is not a dial; it falls out of the two sides’ breakpoint parameters, where fighting to destruction reaches even odds against routing at a quarter losses. Everything between 0.44 and parity becomes a fight the enemy would have taken against you yesterday and refuses today.

Sweep the spread of capability draws and the engagement rule, and roughly 40-58 percent of encounters come off the calendar. That number never appears in any battle record. No dispatch reads “the enemy declined contact because our will was unbreakable.” The single largest effect of the whole investment is invisible.

Political science knows this mechanism: wars are a strategically selected subset (Fearon 1995), democracies pick wars they expect to win (Reiter and Stam 2002), initiators pick targets they can beat (Gartner and Siverson 1996). This post gives that insight a combat-model engine.

Which sounds like winning. Hold that thought.

2. Now look at which fights he declines. Part four of this series found that unbreakable will pays most in the near-parity band: at heavy disadvantage it cannot save you, and at heavy advantage you did not need it. Now overlay the enemy’s decision line. The band he vacates, 0.44 to parity, is exactly the band where will is worth the most. He donates the fights that do not matter and keeps the ones he wins.

The arithmetic that falls out is brutal. A naive model, one where every possible engagement gets fought, predicts the unbreakable force wins 91-100 percent of encounters across the swept settings. The selected record shows it winning 10-43 percent of the fights it is actually allowed. Same force. Same will. The only change is who picks the fights.

How to read it: The dashed slab is the record a model with no enemy vote predicts; the brass slab is what the after-action file would actually show.
What to see: Same force, same will; who picks the fights is worth up to roughly 80 points of win rate on paper.

There is a career-review joke buried in this. A near-invincible force, assessed on its win-loss record, looks mediocre. Its after-action file reads like an officer passed over twice. Selection does that: the enemy only ever meets you where he holds the overmatch, so the record samples your worst days. One phrasing trap is worth flagging honestly. Whether the unbreakable force’s win rate in fought battles drops below a normal force’s depends on the engagement rule; under a stricter rule it stays higher. The robust claim is the survivorship gap against the naive expectation, and that gap is large under every rule I tested.

3. A deterred fight is not a won fight. Here is the part the funnel chart cannot show. The deterred 40-58 percent are not victories. They are non-events. The enemy who declines battle keeps his army, keeps his ground, and keeps his options. He waits, adapts, and presses somewhere else.

Wars need decisions. Clausewitz’s whole argument is that war is an act of force to compel the enemy to do our will; a battle that never happens compels nothing. A force that must take ground, relieve a siege, or force a political settlement cannot cash deterred engagements. It shows up ready to fight forever, and finds that forever is exactly what the enemy is happy to give it.

So the ledger reads: the biggest effect produces no decision, and the residual fights are the enemy’s picks. That is what “the enemy gets a vote” costs.

4. Let him choose the kind of fight, and will’s value nearly vanishes. The second model gives the enemy a richer menu. Instead of fight-or-decline, he chooses among three engagement types: a grinding attrition battle, a decisive first strike, or avoiding battle entirely. The payoffs come from the same engines validated earlier in the series, at near parity where will matters most.

Walk the matrix. In the attrition column, unbreakable will is magnificent: it lifts the win probability from 49% to 95%, a premium of 46 points. In the first-strike column, will is nearly worthless for either side; part four showed why, since a fight decided by the opening salvo never reaches the morale check. Win probabilities there are 0.3% and 1.5%. The avoid column pays the status quo to both.

How to read it: Each card shows the chance our side wins under normal versus unbreakable will; the enemy stamps the one column where will pays refused.
What to see: Advertising “we will grind out any attrition fight to the death” is also an advertisement of which fight never to give that force.

The enemy reads the same matrix. Attrition is the one column where your unbreakable force does well, so he refuses it and forces the first-strike fight instead. At that equilibrium, the value of unbreakable will is 1.2 points of win probability instead of 45.9. About 97 percent of its measured value is gone, and the collapse direction held across every status-quo payoff and casualty weight I swept. The magnitude is a property of this setup; the structure is not. Any enemy with one available engagement type where will is worthless will steer the war there.

Can unbreakable will go negative, an actual liability? Only under two conditions jointly: the enemy forces a first strike at low lethality, so your force survives the opening blow but is behind, and your commander weighs casualties at more than about a third of a win. Then the normal force routs at about 60 percent casualties while the unbreakable force bleeds to about 80 percent in a battle it still loses; routing saved a fifth of the force. At the pure one-shot equilibrium, will is worthless but never negative; both sides die at the same rate regardless of resolve. Fielding a force that advertises “we will grind out any attrition fight to the death” is also an advertisement of which fight to never give it.

How to read it: The brass level is will’s value when the enemy must fight your attrition fight; the thin level at 1.2 points is what remains once he chooses the engagement.
What to see: The direction survived every sweep, the magnitude belongs to this setup; in the forced low-lethality fight will can even turn liability.

5. Russia is running this playbook right now. The closest live case is Ukraine’s drone wall. First-person-view (FPV) attack drones and persistent surveillance have created a kill zone many kilometers deep where, as witnesses told British members of Parliament in 2026, per Forces News reporting, anything that moves gets targeted. That testimony described a stalemate: roughly 1,000 Russian and 200-300 Ukrainian casualties a day while the line barely moves. The wall does not tire, does not panic, and does not rout.

One attribution I will not make. The wall deters because it kills, not because it is brave. It is sensing plus fires, the capability post 3 spent its length separating from will; a jittery wall with the same kill rate would earn the same detour. So this case is evidence of the selection and adaptation mechanics, not of deterrence by unbreakable will: a rational enemy redesigning his war around a standing threat rather than feeding it.

Russia’s response was not to feed it. A Royal United Services Institute (RUSI) commentary in August 2025, and independent open-source analysts, documented a redesign of the Russian assault echelon to fight around the drone wall rather than through it: dispersal into small teams, which open-source analysts put at four to six men, instead of massed columns, spider holes and thermal camouflage, movement at night in short bounds, electronic-warfare screens, and motorcycles. Analysts tracking Russian procurement reported targets on the order of 120,000 to 200,000 bikes plus tens of thousands of all-terrain vehicles. A motorcycle crosses a 1.5-kilometer kill zone in three to five minutes, inside the reaction time of many FPV crews. Dispersion makes each drone kill one man, not a squad.

Read that against the models. The kill zone deterred the engagements it would have won: massed armored assaults into prepared drone coverage largely stopped happening. What remains are the engagements the attacker chose, shaped to the defense’s weakest sensing and reaction seams. The unbreakable wall got a vote on nothing; the breakable humans riding motorcycles picked every fight. And as part five argued, the wall’s standing threat is only as good as its wiring against jamming, one of the seams the adaptation targets.

None of this means the drone wall was a bad investment; Ukraine holds its line partly because the wall made most attacks not worth having. It means the wall’s value migrated from won fights to prevented ones, with section 3’s warning attached.

6. And when the enemy cannot decline, will pays at full face value. The mirror case proves the mechanism. Some soldiers in this war have no vote: wounded, encircled, abandoned by their units, pinned under persistent observation. Against them, the machine’s tirelessness prints exactly as advertised, and the currency it prints is surrender.

In August 2024, per Ukrainian-side reporting, a drone from Ukraine’s Khartiia brigade found a wounded Russian soldier abandoned by his unit, dropped water and written instructions, and walked him through a surrender to Ukrainian lines. In January 2026, per Forbes reporting, three Russian soldiers surrendered to an armed ground robot near Lyman. Ukraine’s digital-transformation minister Mykhailo Fedorov claimed more than 100 drone-compelled surrenders over the winter of 2025-26; that is a belligerent’s own count, so treat it as an indicator, not a statistic. Part two of this series showed the Union army at Bull Run breaking with more than nine-tenths of its men still standing; these incidents are the same morale mechanism, collected by machine.

Put the two halves together and the insight sharpens. The variable that decides what unbreakable will is worth is not the robot. It is the enemy’s menu. Where he can decline or reshape the engagement, the value collapses toward the 1-point end of the model. Where he cannot, a tireless, fearless system breaks human will retail, one pinned soldier at a time. Strategy is the art of deciding which of those two worlds you are fighting in, and the enemy is co-author of the answer.

Best Arguments Against This

The perfectly informed enemy is a fiction. Conceded, and it is why every deterrence number here carries “upper bound” next to it. Real commanders misjudge relative capability, cannot always refuse battle, and fight under political orders that ignore the odds. Every one of those frictions shrinks the deterred share and puts value back on the battlefield. The honest reading is a band running from my frictionless number down toward whatever the enemy’s actual information and freedom of maneuver allow. Russia’s motorcycle adaptation suggests a competent enemy gets usefully close to the rational benchmark, but that is one adversary in one war.

Deterrence is not a consolation prize; it is strategic value my win-rate metric undercounts. Mostly conceded. The Cold War’s central front was held for four decades by forces whose entire purpose was to make the fight not worth starting. If your mission is defending the status quo, the top stream of the funnel is not leakage, it is the mission, and an unbreakable force that gets declined is doing precisely what you bought it for. The rebuttal is narrower than the concession: the vote is still his. He declines where you are strong and presses where you are weak, on his schedule, and a force that must attack or compel cannot spend deterred fights. Deterrence is real value that accrues only to the side content with the map as it is. Honestly, I personally find this the most valuable insight out of this project and it was completely unexpected (to me anyway).

The ugliest number leans on a modeling choice. True. The 10-43 percent depends on how eager the modeled enemy is to fight marginal battles; a stricter rule shrinks the fought set and lands the win rate higher within that range. I printed the framing that survives both rules, the gap against the naive 91-100 percent, and the gap is the finding.

What Would Change My Mind

If by mid-2027 Russia has returned, at scale and sustainably, to massed mechanized assaults into established drone kill zones, the fight-around thesis fails its strongest live test.

If a spatial, agent-based replication of the selection model with realistic misperception and political pressure to fight shows the deterred share collapsing below about 10 percent, the funnel’s top stage is an artifact of the perfect-information assumption. That replication is on my open-threads list for 2027.

If wire-service-verified reporting by December 2027 documents never-routing systems compelling the surrender of intact, un-encircled units in open battle, then unbreakable forces can force decisions rather than just deny them, and section 3 is too pessimistic.

If an engagement-choice game calibrated to a real campaign, and 2022-2026 Ukraine is the obvious candidate, finds the equilibrium value of resolve above half its fixed-enemy value, my 97 percent collapse is a property of the model, not the world.

Unbreakable will is not a bigger hammer. It is a posted sign telling a literate enemy which fights to skip. He reads it, thanks you, and redesigns the war around the fights you cannot decline, while your perfect record accumulates in battles that decide nothing.

There is one more rung on this ladder, and it is the worst one. Next post: what happens when a casualty-averse democracy fields the unbreakable army against an enemy who does not count his dead, and wins every battle on the way to losing the war.

This series’ default reading of AI in warfare goes like this: robots do not panic, so automate the weapon and you get an army that cannot rout. Post 4 already narrowed that promise to fights near capability parity. This post kills what is left of it. In my simulations, WHERE the will lives determines what it is worth, and the trooper is the worst address on the list.

Three results, one ladder. First, the commander. Across 607 recorded defeats in a US Army battle database, losing sides ended the battle by a commander’s decision to withdraw 266 times, and by the physical annihilation of their troops 26 times. Ten to one. That is a historical count, not a model output, and it means an unbreakable command decision touches ten times more endings than unbreakable troopers do. Second, the domain. In the stylized joint-force model, unbreakable will buys about +50 points of win probability, but only for the force holding the objective; supporting forces get about zero at any firepower share. Third, the substrate. “Unbreakable” turned out to be a property of the electronic-warfare and cyber layer, not of the silicon psyche. Every configuration I tested had a resilience threshold, about 40% in the anchor case and 20–50% across configurations, below which a rational enemy stops shooting the bodies and starts jamming the will, and the value of unbreakability decays from 84 points to 17 to 1.

Your robot’s will is only as strong as its radio.

How to read it: Every brick is one of 607 recorded defeats in the CDB90 battle database, colored by how the battle ended for the loser; the red seam is every army that was actually destroyed.
What to see: Brass buries red 266 to 26, about ten to one; defeat is usually a commander’s decision at the top, almost never annihilation at the bottom.

One caveat travels with everything below. Except for the ten-to-one count, which is historical data, these are stylized model extensions of the validated battle engine. The orderings and directions survived every parameter sweep I ran; the exact magnitudes are illustrations, not measurements. The research data was current as of July 1, 2026.

How to read it: Climb the building from the trooper floor to the dark nation floor; each brass plate is what an unbreakable will is worth installed at that floor, and the slab under everything is the electronic-warfare foundation.
What to see: The lights are on in the middle of the building, not the barracks; the top floor stays dark on purpose, that story is the final post.

The findings

1. Battles end at the top, not the bottom. The database is CDB90 (the US Army Concepts Analysis Agency’s Database of Battles, compiled by HERO, the Historical Evaluation and Research Organization, in the 1980s and delivered as the 1990 database), covering over 600 land battles from 1600 to 1973. Each losing side carries a code for how its battle ended. I counted the endings. Withdrawal by command decision, including withdrawals under heavy loss: 266. Troops annihilated or overrun where no one was left to withdraw: 26. That is 10.2 to 1. Even counting every other ending together (repulsed, penetrated, surrendered, scattered, annihilated: 313 in all), the commander’s withdrawal is the largest single category. Twenty-eight losers carry no code.

The pattern is not my discovery. Robert McQuie, an operations research analyst at the same Army agency, published its shape in “Battle Outcomes: Casualty Rates as a Measure of Defeat” (Army magazine, November 1987). Analyzing 80 engagements from 1941 to 1982 in the same HERO data lineage, he found that defeated forces typically quit below 10 percent casualties, and that the recorded reasons for defeat ran about 64 percent enemy maneuver against about 12 percent firepower and casualties. My 266-to-26 count replicates McQuie’s pattern in the successor database of 607 defeats. Replication is the claim, and it is a strength: two counts, two datasets, four decades apart, same answer.

How to read it: Each bar counts how the 607 recorded defeats ended, by the database’s loser resolution code; brass bars are commander-ordered withdrawals, the red bar is troop annihilation.
What to see: Withdrawal endings outnumber annihilation endings 266 to 26, and even against all other coded endings combined (266 versus 313) the commander’s withdrawal is the largest single category.

Most defeats are not a dying army. They are a live army whose commander decided the price had been paid. So I gave the model two breakpoints instead of one: a troop threshold where units physically rout, and a command threshold where the commander orders the whole force out. The result is almost embarrassingly clean. The lower threshold governs. Where the commander’s nerve gives out first, which the historical count says is the common case, making the troops unbreakable bought a mean win-probability change of +0.4 points, averaged over the six command-binding cells at 5,000 runs each. Statistically nothing. The troops never got the chance to prove their steel; the order to withdraw came first. Making the command decision unbreakable in those same cells bought about +60 points and flipped the majority of contests. Where the troops break first, the mirror image holds. The ordering held in every one of the 16 cells of the 4x5 threshold sweep where the two thresholds differ; the +60 points is a stylized near-parity magnitude, not a portable constant.

I set out to model courage and ended up auditing org charts. The lever is not the trooper who never runs. It is the command decision that never flinches early. RAND’s Will to Fight framework (Connable and colleagues, RR-2341-A, 2018) is the standing treatment of what will is, a 29-factor model of the fighting unit. My ladder asks a coarser question: not what will is made of, but where removing the break pays. Jamestown Foundation analyses of PLA (People’s Liberation Army) writing on “cognitive domain operations” suggest at least one great power already reads it this way: the doctrinal target is the adversary’s decision system, not its infantry’s stomach.

2. Will pays only where the objective lives. Now widen the lens to a joint force: land, air, and maritime elements pooling fire on a shared enemy, with exactly one domain holding the objective that defines victory. I rotated which domain holds the objective, swept the firepower shares, and made each domain unbreakable in turn.

The pattern did not budge anywhere on the grid. Make the objective-holding domain unbreakable and the side gains about +50 points of win probability (51 to 55 points across all 21 tested cells). Make a supporting domain unbreakable and the side gains about zero (within 0.4 points of zero across all 42 tested cells). Firepower share is irrelevant to this. In the amphibious scenario the maritime force holds the objective with the smallest gun share, 20 percent, and its will is worth the full +50 points; the air component carries half the firepower and its will is worth nothing. Push a supporting domain to two-thirds of total firepower and its unbreakability is still worth nothing. The mechanism is blunt: supporting forces are overrun the moment the objective falls, so their endurance is never the binding constraint. Their firepower matters. Their will does not.

How to read it: Each dot is one tested cell of the joint-force model, a domain made unbreakable at some firepower share, split by whether that domain holds the objective or supports it.
What to see: About +50 points for the objective holder and about zero for everyone else, no matter who carries the firepower.

The procurement translation writes itself. Buy endurance for whatever holds the objective. Buy cheap, expendable firepower for everything else. Paying unbreakable prices for the loudest shooter is decor. This is a stylized result, near parity and symmetric by construction, but the ordering never reversed in any sweep.

3. “Unbreakable” is a property of the wiring. Here is the uncomfortable one. A human’s will is attacked with fear. An AI’s will is attacked with electrons. Jamming, spoofing, cyber, and decapitation of control nodes do to a machine exactly what Bull Run’s panic did to the Union army in post 2: they end its participation without killing it.

So I let the enemy choose. It holds a fixed effort budget and splits it between attrition (killing bodies) and suppression (attacking the will’s substrate). Our side is nominally unbreakable, protected by a substrate resilience R running from 0 to 100%. Suppression effort past R drags the effective breaking point down a linear ramp, at a fixed gain, to a floor at a normal human rout threshold. The result is a threshold, R*, in every one of the five configurations tested. Below R*, the rational enemy stops buying bullets and buys jammers: it drives our effective breaking point down to an ordinary human rout threshold while keeping enough residual firepower to exploit it. Above R*, suppression costs more firepower than the will-kill is worth, the enemy reverts to pure attrition, and “unbreakable” finally means what the brochure said. In the anchor case R* is about 40%. Across enemy jamming potency and overmatch levels it spans 20–50%, and it rises as the enemy’s electronic attack gets sharper. That range is the right way to read the result: the threshold’s existence is the finding, its location is set by the adversary’s kit, not yours.

Below the threshold, the decay is brutal. The value of unbreakable will runs 84 points of win probability with a healthy substrate, 17 points at 20% resilience, and 1 point at zero. At the bottom of that curve you have bought a normal, breakable force at an unbreakable price. And there is a second, independent way to be worthless: against threefold capability overmatch, the will premium is near zero at every resilience level, because will cannot close that gap at all. Post 4’s parity condition still binds. All of this is a stylized mapping from electronic attack to breaking point; the shapes, not the decimals, are the claim.

How to read it: Each bar is the win-probability value of an unbreakable will at one substrate resilience level; the static is the enemy’s jamming effort, and the dashed line is where jamming stops paying.
What to see: Below R* of about 40% (20-50% across configurations) the signal drowns, 84 points of win probability collapsing to 17 to 1, so “never routs” is a property of the radio contest, not the silicon psyche.

4. Ukraine is running this experiment, in both directions. The jamming direction first. Excalibur guided artillery shells reported fall from roughly 70 percent effectiveness to 6 percent under Russian GPS jamming, per Washington Post reporting of Ukrainian and US assessments in May 2024, is the decay curve with a serial number on it. GMLRS (Guided Multiple Launch Rocket System) rockets were similarly degraded by late 2023, with truck-mounted jammers reportedly suppressing satellite guidance across tens of kilometers. And the substrate war has a cyber flank: reporting in April 2025 described Ukrainian drones abandoned for capture that carried malware, infecting the Russian systems that read them and reportedly geolocating their operators. A machine’s will cannot be frightened. It can be stolen.

Now the honest countermove, because the contest did not stop there. Fiber-optic drones, physically tethered by a hair-thin cable, are immune to jamming entirely; Ukrainian sources counted roughly 40 fiber-optic models codified for its forces in 2025, with ranges that doubled within a year. Onboard autonomous terminal guidance rides through jamming the same way: no link, nothing to cut. As of the data freeze, the attack side of the substrate war was winning, so much so that countering fiber drones was the theme of NATO’s 2025 innovation challenge, and the fashionable counters are nets, radar tripwires, interceptors, and shotguns.

Read that carefully, because it is the point, not an exception to it. The model’s claim was never “jamming wins.” The claim is that the machine’s will is a ratio, R, contested ground between suppression and hardening, and the ratio moves. In 2023 the jammers were winning and Excalibur’s will broke. In 2025 the fiber spools and the autonomy stacks pushed R back up, and the counter-effort shifted to physics: nets and shot. Each swing relocates R* and repositions everyone’s “unbreakable” claim. Morale warfare did not disappear when the soldiers became machines. It moved into the spectrum, and it is being fought right now.

Best Arguments Against This

The strongest objection: these are stylized models, not calibrated campaigns. Correct, and I will not soften it. The two-level breakpoint, the joint-force fires, and the jamming-to-breakpoint mapping are illustrative mechanisms bolted onto a validated battle engine; nobody has fitted a command breakpoint to a real headquarters. What I can defend is that every ordering in this post, command over troops, objective-holder over supporter, threshold over no-threshold, survived every parameter sweep without a single reversal. The decimals are illustrations. The directions are the findings. McQuie adds an honest wrinkle here: he read his own 80 engagements as evidence that Lanchester-style attrition equations misstate what drives combat outcomes, and this series runs on Lanchester engines. My reply is that the breakpoint mechanism exists precisely because pure attrition does not end battles. And the audit prints orderings with bands, not attrition decimals.

Second, the ten-to-one ratio depends on a definitional choice. Withdrawal endings against annihilation endings is 266 to 26; withdrawal endings against all other endings combined is 266 to 313. Some coded withdrawals surely followed local routs, and 28 losers carry no code at all. I concede the framing but keep the conclusion: under the most conservative reading, the commander’s withdrawal is still the single largest way battles end, and annihilation is still the rarest. The finding needs “commanders end battles far more often than annihilation does,” and that survives any cut of the codes.

Third, a skeptic can say the substrate argument is already dated: fiber optics and autonomy are beating electronic warfare as I write, so hardened AI will is a solved problem. That reads a moving contest as a final score. Unjammable tethers spawned net fences; autonomy spawned interceptors; every countermeasure in this war has had a counter-countermeasure inside a year. If the contest ever does end permanently in the defender’s favor, the substrate finding dies. I have put a date on what that would look like below.

What Would Change My Mind

One. A re-coding of the CDB90 endings, or a better modern battle database, published by December 2027, showing that most coded withdrawals actually followed physical unit collapse. That would deflate the ten-to-one anchor and finding 1 with it.

Two. By December 2027, credible field evidence that autonomous systems held most of their unjammed effectiveness against a peer electronic-warfare opponent for two consecutive years with no effective countermeasure fielded at scale. That would indicate that the substrate contest has ended, and the resilience-ratio framing with it.

Three. A calibrated campaign study by the end of 2028 in which hardening a supporting arm flipped an outcome that the objective-holder’s endurance could not. That would break the domain gating.

Four. A spatial or agent-based replication of the two-level breakpoint model, before this series’ planned 2027 follow-on, in which the binding-threshold ordering reverses. That is the one structural assumption everything in finding 1 leans on.

The close

Unbreakable will is not a trait you install in a tactical weapons system. It is a stack: a commander’s decision that does not flinch early, sitting on the force that holds the objective, riding on a substrate the enemy is actively trying to jam, spoof, and infect. Get any layer wrong and the courage above it is decoration. The ladder’s top floor, the nation, is still dark in the elevation above, and it is dark on purpose: that is where this series ends, and it is the rung where unbreakable machines can hurt the side that owns them.

Before that, one more escalation. Everything in this post assumed the enemy shows up and fights. Next post: what happens when it simply declines. The enemy gets a vote.

Bottom Line Up Front

An unbreakable AI will is not a decisive military advantage. It is a tiebreaker. It decides fights that were already close, and almost nothing else.

The worked example is Trafalgar. I gave the entire Franco-Spanish fleet an unbreakable will, so it fights to annihilation instead of striking at 50% losses, and the British still win 83.6% of simulations (95% confidence interval 83.0-84.2, n=15,000 Monte Carlo runs). British gunnery, calibrated at about twice the Franco-Spanish rate, and Nelson’s concentration of fire decide the battle before any morale check can matter. These are attrition-model results, validated against four historical battles but derived from three in this post; the floors below are battle-specific constants, not laws of nature.

The visualization. Trafalgar, where below the capability floor the will changes the dying, not the winner.

How to read it: the aged chart shows Nelson cutting the Franco-Spanish line into three, then the split pane asks whether the van returns. What to see: give the whole Franco-Spanish fleet an unbreakable will and Britain still wins 83.6% of runs. Below the floor, resolve changes only the body count.

The deeper result is a floor. For each battle there is a capability level below which no fraction of unbreakable force wins. Not most fractions. None, all the way to a fully robotic army or navy. Above the floor, will and capability trade along a measurable frontier. Below it, resolve changes the body count and nothing else.

The companion visualization. Pickett’s Charge, with opposing sides’ capabilities at near-parity, the AI unbreakable-will flips the result.

How to read it: the left is the historical charge that breaks and falls back; the right is the same assault given an unbreakable will. What to see: near capability parity, above the floor, the AI-willed assault breaks through and wins 92% of runs. That frontier is exactly what the floor sits under, and the reason unbreakable will is a tiebreaker rather than nothing.

And the floor is the friendly case. Against an enemy that does not break, the win-probability value of your own unbreakable will is exactly zero in every battle I model. Under an enemy first strike at saturation lethality, it is statistically zero. The sentence I would carry into a meeting: unbreakable will decides fair fights. It does not substitute for firing first.

How to read it: brass wakes are the British columns punching through the enemy line; red fragments are what is left of it.
What to see: a Franco-Spanish fleet whose crews cannot break still loses 83.6% of simulations; gunnery and concentration decide before any morale check matters.

The findings

1. There is a floor under will. The simulator is post 2’s validated engine: Lanchester attrition with an explicit morale breakpoint, the casualty fraction at which a human unit quits. For each battle I varied two dials, the loser’s fighting effectiveness relative to history (rho) and the fraction of its force given an unbreakable will (phi), and mapped the boundary where the historical loser starts to win.

The boundary has a hard edge. The square law predicts a capability floor for each battle, with a closed form: rho_1 = a_W W0^2 g_W / (a_L L0^2), where a_W and a_L are the two sides’ kill rates, W0 and L0 their starting strengths, and g_W the winner’s breakpoint. The floors: 0.65 for Pickett’s Charge (closed form 0.6491; the simulation’s first win appears at 0.700, two steps up a 0.025-step grid), and 1.12 for Trafalgar, where the closed form says 1.1231 and the simulation says 1.125. That 0.2% gap is a floor-location match, the tightest analytic-to-simulation agreement in the project. Below the floor no value of phi wins.

How to read it: the vertical dial is the loser’s fighting effectiveness relative to history; the brass line is each battle’s capability floor.
What to see: below each floor the column goes black: no fraction of unbreakable force wins; Bull Run’s floor doubles because the sun sets first.

Above the floor, will buys real ground. Pickett’s Charge sat just under capability parity, which is why it is the one land battle in my set that unbreakable will flips. The charge starts winning once just over three-fifths (62%) of it cannot break, a deterministic 1%-step scan that carries no confidence interval; the honest uncertainty is the visible slope of the Monte Carlo curve around it, 6,000 runs per point.

How to read it: the curve is the Confederates’ chance to take the ridge as the unbreakable share sweeps up; the dashed line marks the flip.
What to see: the charge starts winning once just over three-fifths (62%) cannot break; below that, resolve only deepens the casualty bill.

Along the flip boundary the trade obeys a single square-law rule: the loser’s effectiveness, multiplied by a bracket mixing the unbreakable fraction with the enemy’s own breakpoint, stays constant at the floor value. In simulation that quantity holds within about 3%, and its level matches the closed-form floor within 8% for Pickett and 2.4% for Trafalgar. Those are boundary-agreement numbers, a different quantity from the 0.2% floor-location match above. One scope condition: this holds for battles that resolve a winner inside their historical battle duration. The third battle does not; its invariant runs about 1.9 times the analytic floor, a mean of 1.88 along its boundary (because it got dark and the simulated battle had to end).

How to read it: each row pairs one battle’s floor computed two ways: hollow ring the closed form, solid dot the simulation’s first win.
What to see: where the battle resolves inside its historical duration the two agree; Bull Run’s 40-hour clock displaces its floor to 1.43-1.45.

2. Bull Run adds a second floor: the sun setting. The closed-form floor for First Bull Run is 0.70. I am printing that number only to disown it. The closed form assumes unlimited time; the simulation caps Bull Run at a realistic 40-hour window, and the real battle ended at nightfall. Inside that window the simulated floor is not 0.70. It is 1.43-1.45. The out-fought Union side cannot win at any unbreakable fraction until its effectiveness more than doubles relative to the analytic floor (1.43 over 0.70 is a factor of 2.04; the 1.9 in finding 1 is the separate invariant violation), because the sun sets before attrition can finish the argument.

I could have quietly printed the prettier 0.70 and moved on. The honest number is better for the thesis, not worse. A time-capped battle needs capability even earlier, and gives will even less room to work. What 40% unbreakable Union troops buy at Bull Run is the denial of defeat: the AI contingent holds the hill into the night while the human 60% still routs on schedule. A stalemate, at every fraction, on a 1%-step scan. Never a win. Post 2 told that story from the morale side, the Union breaking at 8.3% casualties. The frontier tells it from the capability side: some battles are not yours to win, only to not lose.

3. AI at Trafalgar would just add to the butcher’s bill. The arithmetic a reader can redo. The dial rho measures the loser against its own history: Trafalgar’s floor of 1.12 means the Franco-Spanish fleet needs about 12% better gunnery than its crews actually delivered. Per my calibration it fired at about half the British rate, so the floor sits near 56% of British effectiveness; the fleet’s larger battery closes the rest through the square of numbers. The historical fleet is close to that line: at rho = 1 it sits 11% below the floor, five 0.025 grid steps on my sweep.

At its actual calibration, an unbreakable fleet converts defeat into bloodier defeat 83.6% of the time. Nelson’s two columns cut the 33-ship line in three, the van sails uselessly on, and concentrated British fire eats the two trapped fragments whether or not anyone aboard is capable of despair.

Two flip sides. First, 83.6% is not 100%: an unbreakable Franco-Spanish fleet gets a real 16% upset chance, up from essentially nothing, by staying in the fight long enough for variance to work. Second, the stubbornness is not free for the winner: British casualties roughly double, from about 28% of the force to about 50%, when the enemy fights to annihilation instead of striking. The Iwo Jima lesson, restated at sea. Below the floor, will changes the price of the battle, not its winner.

4. Your will is worth exactly zero against an enemy that does not break. Everything above holds the enemy’s morale at its historical setting. So I swept the winner’s breakpoint from very fragile to fully steadfast and measured the loser’s gain from being unbreakable, 6,000 paired runs per point.

At the steadfast end the answer is not approximately zero. It is exactly zero, 0.00%, in all three battles. That endpoint is definitional rather than empirical: unbreakable against unbreakable, the morale term cancels by construction, the fight reduces to pure attrition, and attrition was the thing the loser was losing.

The value of your own unbreakable will is single-peaked in enemy fragility, topping out at 86 points of win probability for Pickett with the enemy breakpoint near 25% casualties, and 92 points for Trafalgar near 40% (Monte Carlo standard error at most half a point; peak locations good to about one 5-point grid step; the full hump shows in two of three battles, with Bull Run’s peak at the edge of the tested range). Why a peak? Against a very fragile enemy you were going to win anyway; against a steadfast enemy it can never matter. Your will is not an asset you own. It is a bet on the enemy’s weakness.

5. In the missile age, will does not substitute for firing first. The battles above are attritional grinds, exactly where outlasting the enemy can pay. Modern naval and air combat is built around salvos and firing effectively first. So I moved the question into a stylized salvo model in the standard missile-age tradition (Wayne P. Hughes Jr., Naval Research Logistics, 1995; Michael J. Armstrong’s stochastic extension, Operations Research, 2005) and asked what an unbreakable crew is worth as per-salvo lethality rises.

Under an enemy first strike at saturation lethality, the answer is statistically zero: a premium of about 0.1 points of win probability against a Monte Carlo standard error of about 0.8 points at 4,000 trials per cell. You are crippled before your steadfastness can be spent. The conditional is joint: it takes the enemy firing first and high per-exchange lethality together. A first strike at low lethality still leaves a modest premium of 5-8 points. And in a fair duel near parity, lethality initially amplifies the value of will, up to a premium of 33-46 points near the one-shot threshold, because the unbreakable side converts mutual-annihilation draws into wins.

How to read it: extra win probability from an unbreakable crew versus per-salvo lethality; brass a fair duel, red an enemy first strike.
What to see: under a first strike at saturation the premium burns down to statistical zero; will does not substitute for firing first.

A cross-check rules out the boring explanation. Scaling both sides’ kill rates over a 32-fold range in the continuous model leaves the will premium flat at 45.2 points; the 0.6-point spread (the standard deviation across the six speed settings) is pure Monte Carlo noise; the square law makes this flatness exact in theory, so the run verifies the engine rather than discovering anything. Speed is not what erodes will. Decisiveness per exchange is, plus the first-strike race. If your procurement plan buys unbreakable resolve instead of sensing, range, and the first effective salvo, you have bought the tiebreaker and skipped the tie.

6. The 2020s weapon is not the 2030s army. I ran two counterfactual grades of AI: a 2020s version making one strategic weapon (the cannons) unbreakable, and a 2030s version making the whole force unbreakable, a robot army.

On land the 2020s weapon captures none of the robot army’s benefit: zero flips in 15,000 runs, an upper bound below 0.02%. The strategic/cannon is not the maneuver force; when the human line routs, the unbreakable battery is simply overrun, still bravely computing. At sea the same weapon-level AI captures 77% of the whole-force benefit (propagated-uncertainty interval 73-81%), because a ship is the maneuver force. Unbreakable will bolted onto one platform pays only where that platform is the force; everywhere else it has to live in the units that hold the line, and that is the robot-army problem, a 2030s problem.

How to read it: each vessel holds the full benefit of an unbreakable robot army; the brass fill is the share one unbreakable AI weapon captures.
What to see: on land the vessel is empty, under 0.02% in 15,000 runs; at sea, where the ship is the maneuver force, one weapon captures 77% of the army’s benefit.

Best Arguments Against This

Three battles is not a database. Correct, and I concede most of it. The floors are constants of specific battles under a specific calibration; three battles cannot establish how often real fights sit above or below their floors. But the population question was answered separately: the 607-battle audit in post 3 found roughly two-thirds (60.8-72.2% across threshold choices) of historical losses were capability losses. The frontier explains the mechanism; the audit shows it was the majority case.

Your floors live on grids. Also correct. The floors were confirmed at a rho step of 0.025 and an unbreakable-share step of 5% with a deterministic integrator, so every simulated floor is really a band one step wide. The gap has a verified direction: the simulated first win errs high, never low, so below the analytic floor no fraction wins in any run. The floors are conservative. The enemy-fragility peaks are grid maxima whose true values can only be higher. Nothing in the post survives or dies inside a grid step. The one place discretization could have hidden a real discrepancy, Bull Run, I printed as a discrepancy.

The salvo parameters are made up. The missile-age model is a notional 20-versus-20 duel with parameter jitter, not a fit to engagement data. What I defend are the shapes: the collapse under enemy first strike plus saturation, the fair-duel hump, and the flatness under pure speed scaling, which is analytically forced. If a data-calibrated salvo model moves the shapes, finding 5 is in trouble. The magnitudes were never the claim. My next series on AI-weaponry will dive much deeper into this; the modeling is done, the analysis is not.

Ukraine looks like drones winning a war, not tiebreaking one. The strongest current-events objection, and it cuts the other way. Reported estimates put drones at about two-thirds to 85% of battlefield casualties by 2025, figures that trace mostly to official sources and deserve that hedge, yet the front line barely moved: a kill-zone stalemate at rough parity, machine attrition setting the body count while neither side’s will flips the map. And Ukraine’s 2026 operational gains followed strikes on radars, jammers, and fires: capability degraded first. That is the model’s ordering: capability first, will as the tiebreaker at parity.

What Would Change My Mind

1. By end of 2027, a spatial or agent-based re-implementation of these battles that finds no capability floor, with winning unbreakable fractions appearing well below the square-law line.

2. Within twelve months of publication, a documented engagement, verified by two independent non-belligerent sources, in which a force clearly below capability parity won primarily because an autonomous element refused to break rather than because it out-shot the enemy.

3. During 2026-2027, a side in a missile-age exchange absorbing an effective first strike at saturation lethality and then winning on endurance.

4. Phase-separated casualty data for historical routs, fighting-phase versus pursuit-phase, showing most routed losers were at or above parity during the fighting. That would move battles into the close-fight column, where will decides.

5. By end of 2026, a naval historian or operations researcher showing my Trafalgar gunnery calibration is wrong by enough to lift the Franco-Spanish fleet above its 1.12 floor.

The close

Clausewitz made resistance the product of means and will. The temptation of AI is to read that as a multiplication you can win on either factor. You cannot. Below the capability floor the will term multiplies a number too small to save; against a steadfast enemy it multiplies by exactly zero; against a first strike it never gets to multiply at all.

Will is not a weapon. It is a tiebreaker, and tiebreakers only matter in ties.

If you are going to buy an unbreakable will anyway, where in the force should it live? The trooper is the obvious answer and the wrong one. That is post 5.

There are a good number of legal, policy, ethical, and even religious discussions asking if we should incorporate AI into weapons. I have been taking a different approach, projecting AI-characteristics onto well-studied historic battles, and using Lanchester equations to model what AI-weapons will do to battle. This series focuses on being able to embue AI weapons with an unbreakable will.

If you believe battles are decided by breaking the enemy’s will, the historical record disagrees with you most of the time. Across 607 usable defeats in a 660-battle database built for the US Army, roughly two-thirds (60.8-72.2% across reasonable threshold choices) were capability losses. The loser was so out-fought that it would have lost even fighting to the last man. And because prisoners taken in the pursuit get booked as winner effectiveness, that two-thirds is an upper bound, not a midpoint.

The true will-collapse signature, a loser at or above capability parity that broke early, shows up in about one-fifth of defeats (16-29% across the same thresholds). That is a lower bound. Correct it honestly, using measured rout casualties, and it rises to about a third (21-38%). It stays a minority under every correction I could construct.

Two-thirds of history’s losers were out-fought, not out-frightened.

How to read it: every dot is one defeat, 1600-1973, sorted into the three audit classes; the brass block is every will-collapse signature found.
What to see: two of every three losers were beaten on capability; pursuit booking makes that an upper bound.

There is a twist. The database’s compilers included a morale code, and checked against the will-collapse signature it carries essentially no information. Even the people who built the morale column could not make it predict.

The data comes from CDB90, the US Army Concepts Analysis Agency’s Database of Battles: over 600 land battles from 1600 to 1973, compiled in the 1980s by Trevor N. Dupuy’s Historical Evaluation and Research Organization (HERO), with per-side strengths, casualties, and outcomes. The research data was current as of July 1, 2026.

The findings

1. Clausewitz made will half the equation. Pop history made it the whole thing. Here is what he actually wrote: “If you want to overcome your enemy you must match your effort against his power of resistance, which can be expressed as the product of two inseparable factors, viz. the total means at his disposal and the strength of his will.” Means times will. Two factors, inseparable, multiplied. The sentence everyone repeats, that the object of war is to break the enemy’s will, is a paraphrase that dropped the other factor and grew teeth.

The paraphrase won because routs are cinematic and the winner’s version flatters the winner: we broke their spirit sounds better than we had more guns. The paraphrase is also half true, which is the durable kind of wrong. Armies really do quit long before annihilation. The Union quit First Bull Run at 2,896 casualties out of 35,000 present, about 8.3 percent; that story carried post 2. The question here is different. How often did the quitting, rather than the out-fighting, decide the result?

2. The audit is arithmetic you can redo. For every defeat in the database, take four numbers: each side’s starting strength and casualties. Lanchester’s square law (the standard attrition model in operations research, validated in this project’s first phase) turns them into one summary statistic for the loser, a capability ratio. In one line: R_cap = (loser per-man kill rate x loser starting strength squared) divided by the same product for the winner, with each side’s kill rate inferred from the casualties the other side suffered. At R_cap = 1, the loser had the fighting power to trade evenly. Below 1, it was out-matched on the day regardless of anyone’s nerve.

The classification rule is three lines. If R_cap fell below 0.70, the loss is booked as out-fought. If R_cap was at least 0.70 and the loser broke or quit before 15 percent casualties, that is the will-collapse signature. Everything else, near parity but bled past 15 percent, is booked as ambiguous: a hard repulse, not a collapse.

How to read it: the ratio multiplies inferred kill rate by strength squared, loser over winner; the cells below are the whole classification rule.
What to see: arithmetic you can redo from two columns per side, with thresholds declared before the data was scored.

The median out-fought loser had R_cap of 0.28, crushed on capability. The median will-collapse loser had R_cap of 1.24 and broke at 4.8 percent casualties. That is the textbook rout profile. Gettysburg lands in ambiguous, correctly: Lee’s army was near parity and fought to roughly 37 percent casualties. A hard repulse is not a panic.

3. Two-thirds of the losers were going to lose anyway. Of 607 defeats, 402 classify as out-fought. That is 66.2 percent, and it holds at 60.8-72.2% across the full grid of threshold choices (capability cuts of 0.6 to 0.8, break cuts of 10 to 20 percent casualties). The will-collapse class holds 130 of 607, 21.4 percent, ranging 16.0-28.7% across the same grid. The remaining 75 (12.4 percent) are the ambiguous hard repulses.

How to read it: each dot is one defeat, placed by the loser’s capability ratio (left of parity means out-matched) and its casualty fraction when it lost.
What to see: history’s losers mass far left of parity; the morale story lives in the thin brass wedge; Bull Run enters it only after the pursuit correction.

Drop any single war from the audit (there are 65) and the out-fought share moves only between 64.3 and 68.4 percent. Drop any entire century, including the whole twentieth, and it stays between 64.2 and 67.2 percent.

How to read it: each mark re-runs the classification with one war or century removed; vertical lines are the full-sample shares.
What to see: out-fought stays within 64.2-68.4% under every deletion, including the entire twentieth century.

One direction of error matters, and it runs against my headline, not for it. The database records total casualties, with no timeline inside the battle. When a loser breaks and runs, the prisoners and stragglers taken in the pursuit are booked as if the winner shot its way to them, making losers look more out-fought than they were during the actual fighting. A second channel pushes the same direction: an army that breaks early also stops inflicting casualties, which deflates its own measured effectiveness, so the upper-bound reading already absorbs it. Finding 5 measures the correction.

4. The database’s own morale column cannot find the collapses. CDB90’s compilers coded a morale advantage for many battles. If will collapse were the well-understood engine of defeat, that hand-coded column and my four-number arithmetic should point at roughly the same battles. They do not. The code flags the loser as demoralized in only 118 of 607 defeats, and of my 130 will-collapse battles it flags just 19. Agreement beyond chance, measured by Cohen’s kappa, is -0.06: statistically indistinguishable from zero (permutation p = 0.14, n = 607). It does not even flag First Bull Run, the most famous rout in American history. The field has long treated CDB90’s subjective columns with suspicion; the contribution here is measuring the failure cleanly, not discovering it.

I do not think the compilers were careless. The likelier reading is that their code captures pre-battle troop quality, green versus veteran, rather than what happened once the shooting started, and where it does fire it usually sits on top of a capability rout anyway (of the 118 flagged battles, 96 were out-fought on the numbers). But that is the point: professional military historians, building the Army’s reference database, could not make morale into a column that predicts. The database’s outcome codes, by contrast, agree with the arithmetic: all 26 losers recorded as annihilated classify as out-fought, and the will-collapse class contains no annihilations at all. Armies that collapse early do not fight to the death. The signature is coherent. The folklore column is not.

How to read it: left column, battles the database’s morale column flagged; right column, will collapses per the arithmetic; brass threads are the only agreements.
What to see: 19 threads out of 118 and 130; kappa -0.06, indistinguishable from zero. The morale column carries essentially no information.

5. The honest correction: half the loser’s casualties came after it broke. To size the pursuit bias flagged in finding 3, I collected the 11 famous routs whose published casualty figures split killed and wounded from captured and missing: Bull Run, Nashville, Missionary Ridge, Chancellorsville, Waterloo, Sedan, Rossbach, Königgrätz, Jena-Auerstedt, Blenheim, Austerlitz. These are deliberately selected severe routs, not a random sample; read every number in this paragraph as a bound, not a population estimate. In that sample, the share of the loser’s casualties that came after its line broke averaged 53% (n = 11, range 24-85%). Half the butcher’s bill was not combat. It was shooting retreating soldiers in the back. As Robert E. Lee said:

It is well that war is so terrible. We should grow too fond of it.

Remove those post-break losses and recompute. The average loser’s capability ratio roughly doubles, and 6 of the 11 battles change class, every one toward parity, none the other way. Bull Run is the cleanest case: about 45 percent of the Union’s casualty count that day was captured or missing men, and stripping them lifts its capability ratio from 0.795 to 1.42: an unambiguous will collapse at better-than-parity capability. The Union army at Bull Run was not out-fought. It was out-frightened. That is the exception, and it took the correction to make it clean.

How to read it: each row is one famous rout; the arrow is the loser’s measured fighting power once pursuit prisoners stop counting.
What to see: ratios roughly double and 6 of 11 verdicts flip toward morale; Sedan, Rossbach, Königgrätz, and Waterloo stay out-fought regardless.

Apply the measured correction to all 607 battles, reattributing casualties for losers whose recorded outcome was an actual rout or withdrawal, and the true will-collapse share rises from about one-fifth to about a third (21-38%, where 38% assumes an aggressive post-break fraction of 60%, above the measured 53% average). The control group inside the sample: Sedan’s loser moves from 0.10 to 0.37 and stays hopelessly out-fought. Sometimes an army runs because it is beaten, and the running merely sets the price.

6. A minority verdict, and it is the interesting minority. So the pop-Clausewitz trope fails its audit. In most defeats, will was not the deciding variable; capability was. In Ukraine, officials and analysts attribute about two-thirds to 85 percent of battlefield casualties to drones (the figures are mostly official-sourced; a June 2026 Oklahoma Watch fact-check rated them plausible but soft), yet after years of that attrition neither field army has collapsed into an army-scale rout. The front moves on capability: strikes, stockpiles, jamming. It is a firepower war with morale at the margins, which is what most of the 607 battles were too.

But flip the finding over. In about a third of historical defeats, at the corrected bound, the loser had the capability to trade evenly and lost anyway because somebody’s will gave out. Those are the battles where a combatant that cannot break, an AI, changes who wins rather than what winning costs. One battle in three is not a revolution. It is a large, specific, findable class of fights.

Best Arguments Against This

The anchor battle sits on the boundary you chose. Uncorrected, Bull Run’s capability ratio of 0.795 clears my 0.70 will-collapse cut by less than a tenth, and at a 0.80 cut it would classify as out-fought. If I had picked my thresholds to flatter the series’ anchor battle, this is where you would catch me. Three answers. The thresholds and the full 3-by-3 sensitivity grid are declared in the analysis script, not tuned after the fact. The population headline survives every cell of that grid. And the corrected Bull Run, at 1.42, is not sensitive to any threshold at all.

The database’s numbers are as suspect as its morale column. Fair. CDB90’s quantitative columns, the strengths and casualties this audit runs on, carry error too. Serious Lanchester curve-fitting moved to the purpose-built Ardennes and Kursk campaign databases partly for that reason (Bracken 1995; Fricker 1998; Lucas and Turkes 2004). Three things keep the classification standing on noisy inputs. It is a coarse two-way cut, not a curve fit, and it survives the full threshold grid. It survives dropping any single war or any entire century. And the class medians sit nowhere near the boundary: 0.28 for out-fought against 1.24 for will collapse, either side of a cut at 0.70. Noise would have to move battles across that whole gap, one way, to flip the shares. One caveat survives: any battle’s label is only as good as its entry. The claim is the aggregate shares, not any single battle’s coding.

Skill, not materiel or morale, decides modern battles. Stephen Biddle’s Military Power (2004) makes force employment the decisive variable, and that cuts across any raw capability-versus-will split. Conceded, and absorbed: the capability ratio is inferred from casualties actually inflicted, so employment quality is already inside it. R_cap is an effectiveness ratio, not a bean count.

Early withdrawal is not the same thing as will collapse. A prudent commander executing a planned withdrawal matches my behavioral signature, at or above parity and stopped before 15 percent casualties, without anyone panicking. Partly conceded. The class should be read as “broke or quit early,” not as a mind-reading of terror, and the outcome codes only partially separate the two. But the class has the right texture: its median member quit at 4.8 percent casualties while holding a capability edge, and it contains none of the database’s annihilation endings. Whatever mix of panic and prudence is in there, it is the ceiling on the morale story, and it is still a minority.

Eleven hand-picked routs cannot correct 607 battles. Correct. The 11-rout sample was selected on the dependent variable, so its post-break fraction of 53% is an estimate for battles like those, not for battles in general. That is why the correction reattributes casualties only for losers the database itself records as having routed or withdrawn, why the corrected share prints as a band (21-38%) rather than a point, and why the falsification list below asks for the real fix: a phase-separated re-audit at scale. Until that exists, the direction is one-way, toward morale, and the bound still leaves capability losses the majority.

What Would Change My Mind

1. By December 2027: someone runs a phase-separated re-audit, a machine-readable battle database splitting fighting-phase from pursuit-phase casualties across hundreds of battles (a digitized ACSDB or KOSAVE-class dataset would do it), and the true will-collapse share exceeds 50 percent. I would retract the headline, not just soften it.

2. By mid-2027: a replication of this audit under the linear (area-fire) Lanchester law flips the majority class on the same 607 battles. This is a weekend’s work for a skeptic.

3. Anyone produces a defensible reading of CDB90’s morale code under which it does predict the parity-plus-early-break signature, with agreement reliably above chance. Finding 4 dies, and I print the obituary. And please tell me how you did it so I learn how to better model it.

The close

A rout is not why most armies lost. It is how the losing looked. Two-thirds of history’s losers were out-fought, not out-frightened, and the most famous morale column in military-history data cannot find the exceptions. But the exceptions are real, they are about a third of defeats at the honest bound, and they cluster exactly where the capability ledger reads even.

That near-parity sliver is where an unbreakable AI stops being a rounding error and starts picking winners. Next post: what a will that cannot break is actually worth there, and why the answer is a tiebreaker, not a war-winner. The next AI-weapons series, the models are already working, focus on AI capabilities that out-fight.

The mental model most people carry from war movies is attrition: two armies grind each other down, and the one that runs out of soldiers loses. That perception is wrong for most of military history. Battles do not usually end when an army is destroyed. They end when its will breaks, and the will breaks early.

At the First Bull Run the Union army came apart after 2,896 casualties, killed, wounded, missing, and captured, out of 35,000 men present. Divide it yourself: 2,896 / 35,000 = 0.083. Eight point three percent. That figure is a historical datum, not a model estimate, so no confidence interval applies; the honest fine print is that roughly 45% of the numerator was captured or missing rather than shot, and the denominator counts men present, not the smaller number actually engaged. On an engaged basis the fraction runs higher. The point survives either accounting: over nine-tenths of the army was standing when it stopped being an army.

So I built the breaking point into the math. A Lanchester attrition simulator where every unit carries an explicit morale threshold, validated against four real battles: Iwo Jima, First Bull Run, Pickett’s Charge, and Trafalgar. Then I asked the question the whole series hangs on: what happens when one side’s threshold is removed, because we can model a soldier as an AI tactical weapons platform that does not panic, and we can model a canon or a ship as a strategic weapons platform that does not panic?

How to read it: wounded carried at the left, prisoners under guard, and the flood of unhurt men pouring toward a tiny Capitol.
What to see: the day ended in flight, not slaughter; most of the army walked away.

The visualization: First Bull Run, the rout that an unbreakable will turns into a stalemate.

How to read it: the left is history, the Union line breaks and routs toward Washington; the right is the same fight given an unbreakable will. What to see: the will stops the collapse but does not win. It grinds the rout into a bloody stalemate and raises Union losses from 8.3% to 12.5%.

What happens in the simulator? Pickett’s Charge succeeds 4.2% of the time in the baseline model (95% CI 3.9–4.6%, n = 15,000 runs). If you model the battle as if the Confederate assault was comprise of equivalent AI weapons with an unbreakable will then the assault wins 92% of the time (95% CI 91.6–92.5%). The rest are stalemates at nightfall; the AI-equivalent assault never loses outright. The caveat sits right here: these are attrition-model results with literature-calibrated breakpoints, not a spatial recreation of the battlefield, and the same experiment run on the other three battles shows the flip is the exception, not the rule.

And one of the four battles is not a counterfactual at all. Iwo Jima’s garrison actually fought without a breakpoint. In the model, that real unbreakable will roughly doubled American casualties and more than tripled the battle’s length.

The findings

1. The Union army broke nearly intact. Bull Run was the first major land battle of the Civil War, fought July 21, 1861, with spectators. McDowell’s 28,450 engaged Union troops faced 32,230 Confederates once Johnston’s army arrived by rail, so there was no Union numerical edge at the point of decision. Late in the day the Union withdrawal dissolved into a panicked flight toward Washington, entangled with the picnicking civilians, an episode the press made famous as the Great Skedaddle. The casualty ledger tells you what actually happened. Union losses: about 460 killed, 1,124 wounded, 1,312 missing or captured. Confederate losses: 387 killed, 1,582 wounded, and 13 missing or captured. Thirteen. That asymmetry, 1,312 against 13, is the signature of a one-sided rout. Both sides bled at similar rates while they fought. Then one side stopped fighting, and men who would have been shooters became prisoners.

How to read it: blue formations hold the hill, red arrows press, and the rout tapers off toward Washington; the inset bar splits the day’s casualties into killed, wounded, and captured or missing.
What to see: both sides bled at similar rates while they fought, then one side stopped, and 1,312-against-13 in prisoners is what a broken will looks like in a ledger.

2. Breaking early is the rule, and casualties are a lousy predictor of when. The foundational study is Dorothy Clark’s 1954 Operations Research Office report, which examined 43 battalion engagements in which units broke. She found casualties were probably not the primary cause of breaking, and in about a third of her cases the battalion had already absorbed over 40% casualties before it quit. Helmbold’s 1971 RAND review put historical breakpoints anywhere from roughly 10% to 70% of strength, with leadership, support, and communication mattering more than attrition. Two things follow. First, units break well short of annihilation, essentially always. Second, there is no magic number. My simulations sweep breakpoints across 8–40%, spanning the lower-middle of that observed 10–70% range; the sweep dips below the literature’s floor because Bull Run’s observed 8.3% break anchors the low end. That band is my modeling assumption, not a literature finding, and I will keep saying so. Clausewitz put the underlying idea in one sentence: an enemy’s power of resistance is “the product of two inseparable factors, viz. the total means at his disposal and the strength of his will.” The means are countable. The will is the part that fails first.

3. You can put the breaking point in the math, and the math checks out. The engine is Lanchester’s square law, the 1916 aimed-fire attrition model that operations researchers have used for a century, plus one addition: each unit routs when its casualty fraction crosses a threshold, and that threshold varies run to run. Validation is the part I care about. In 1954 J. H. Engel fit the square law to daily American casualty data from Iwo Jima and published attrition coefficients. My independent refit of the same daily series recovers A = 0.0565 against Engel’s published 0.0544. The R-squared is 0.992 on 35 daily points, but read that number gently: the fit is to the daily strength series, a cumulative and monotone curve that flatters R-squared by construction. The meaningful check is the coefficient landing within 4% of Engel’s. And the spine has survived a hostile audit before: Robert W. Samz’s 1972 Operations Research technical note revised Engel’s Iwo Jima data and found the revised data still fit. A small credibility bonus from doing the homework: a different value for Engel’s coefficient circulates in secondary sources, and it turns out to be a transcription error that has been copied around for decades. I pulled the 1954 paper scan and read the number off the page. The model also reproduces Bull Run’s rout at 8.3%, Pickett’s roughly 19% Union casualties, and Trafalgar’s zero British ships lost, before any counterfactual is run.

4. Iwo Jima already ran this natural experiment on unbreakable wills. The one force in the dataset with a genuinely unbreakable will was not an AI. It was the Japanese garrison of Iwo Jima, February 19 to March 26, 1945. Kuribayashi ordered each man to treat his position as his grave and to kill ten of the enemy before dying, forbade the banzai charges that had squandered earlier garrisons, and fought a defense in depth designed to maximize American casualties rather than to win. Of a garrison of roughly 21,000, only 216 were taken prisoner during the battle. That is a breakpoint of one: fight until dead. The model puts a price on it. Give Japan a normal human breakpoint and simulated US casualties fall from 21,431 to 10,969, a ratio of 1.95x, and the battle shortens from 36.4 days to 10.7, a ratio of 3.4x (n = 15,000 runs per condition; the Monte Carlo means are stable to a couple of men). Those are model outputs on Engel’s assault-echelon accounting basis, where the historical figure is 20,860 over 36 days; the roughly 26,000 casualties you may have read elsewhere is the all-services total for the whole operation, a different basis, and the two must not be mixed. The sentence I want a planner to carry out of this post: a real unbreakable will already existed once, and it doubled American casualties. It did not change who won.

How to read it: the cool low column at the left is the counterfactual, the towering brass-lit column the real battle, Suribachi and the landing craft between them.
What to see: the will did not move the outcome, only how long and how bloody it was. Roughly 2x the casualties across 3x the days.

5. At Pickett’s Charge, the breakpoint was the whole battle. On July 3, 1863, 11,481 Confederate infantry crossed nearly three-quarters of a mile of open ground against the Union center and were repulsed in about an hour, losing roughly half their number. In the model the charge succeeds 4.2% of the time (95% CI 3.9–4.6%, Monte Carlo); the validation ensemble puts it at 4.9%, and the 2022 continuous-flow simulation study of the charge by Poggie, Matei, and Kirchubel puts it near 6%. Attribute each number to its method and they agree: a long shot. Now move the will around. If the Union artillery had been weak-willed and fled at 10% losses, the model makes the charge a coin flip: 49.1% Confederate win (95% CI 48.3–49.9%). The historical guns did not flee. At the wall called The Angle, Lieutenant Alonzo Cushing, twice wounded, refused evacuation and kept his last guns firing until he was killed; he received the Medal of Honor for it 151 years later, in 2014 and if you’re building an AI enabled strategic weapon you should name it after him. The model says that steadfastness was worth about 45 points of win probability. And if the entire Confederate assault cannot break, it takes the ridge in 92.0% of runs (95% CI 91.6–92.5%) and never loses; the remaining 8% are stalemates at nightfall, not Union wins.

How to read it: the same field painted twice; above is what happened, below is the assault if the line could not break.
What to see: the same men with the breaking point removed cross the wall and win 92% of runs. Proportions follow the measured 92% win rate.

Between those poles sits a threshold. Sweep the AI unbreakable-will share of the assault upward and the winner flips at just over three-fifths, 62% on a deterministic 1% scan, with the Monte Carlo curve crossing even odds at the same spot. Below that share, the extra AI-resolve buys deeper casualties and the same defeat.

How to read it: Sweep the share of the assault that cannot break from none to all; the curve is the simulated chance the Confederates take the ridge, and the brass point is where the model’s winner flips.
What to see: Unbreakable AI-will is a threshold, not a dial; below just over three-fifths (62%) the added resolve only deepens the casualty bill.

6. An unbreakable AI-will is not a cheat code. Run the same experiment on the other battles and the flip disappears. Make 40% of the Union force at Bull Run unbreakable and the rout becomes a stalemate; the human 60% still breaks on schedule, the AI contingent holds the hill into the night, and no fraction up to 100% converts holding into winning at the army’s measured effectiveness. Make the whole force unbreakable and more than 99.9% of 15,000 runs still end in stalemate; no run produced a Union victory, so the residual is a statistical bound, not an observed event. At Trafalgar, even a Combined French-Spanish fleet that never strikes its colors loses 83.6% of the time (95% CI 83.0–84.2%), because Nelson’s gunnery and concentration decide the fight before any morale check matters. Why will is usually a tiebreaker rather than a war-winner is the next post but one; for now, the pattern is enough. Removing the breaking point reliably changes the body count. It changes the winner only when the fight was close on capability to begin with.

7. Men are surrendering to machines right now. In August 2024 a Ukrainian brigade used a drone to walk a wounded, abandoned Russian soldier through a surrender: it dropped water and written instructions, then guided him to Ukrainian lines. By March 2026, Ukraine’s digital-transformation minister Mykhailo Fedorov claimed drone units had compelled more than 100 Russian soldiers to surrender over the winter alone; that is a belligerent’s own count, so read it as an order of magnitude, not a ledger entry. But the mechanism is the one in this post. A man does not surrender to a drone because he ran out of bullets. He surrenders because his will broke against something that does not have one.

Best Arguments Against This

The strongest objection goes at the model’s heart: I trigger routs on casualty fractions, and the foundational literature says casualty fractions are a poor predictor of breaking. Clark found leadership, support, and communication mattered more; a third of her broken battalions had already passed 40% losses before quitting. So the model uses, as its trigger, the very variable the best empirical study demoted. I partly concede this. The defense is threefold. The threshold in each baseline is calibrated to the level at which the historical unit actually broke, so it is a summary of whatever really caused the break, not a theory of it. The thresholds vary randomly across Monte Carlo runs, encoding Clark’s finding that breakpoints scatter widely. And the counterfactual question, what changes when the break is removed entirely, does not depend on what triggers the break, only that one existed and the record shows roughly where it fired.

Three smaller objections deserve print. The model is temporal, not spatial: no terrain, no flanking, no reserve decisions, so a battle it flips might not flip on real ground; an agent-based recheck is the single most likely thing to damage these results. The calibration inherits a bias: coefficients fit to total casualties, including losses taken during the rout and pursuit, understate the loser’s fighting capability. I hedge that with effectiveness sweeps here, and a later post returns to it with corrected data. And the campaign-level empirical record for Lanchester models is contested: Bracken (1995) found the linear law fit the Ardennes campaign, Fricker (1998) refit it and found neither law fit, and Lucas and Turkes (2004) found no basic law fits Kursk or the Ardennes well. That record is exactly why this series calibrates each battle separately and prints orderings with bands, not point forecasts.

What Would Change My Mind

First, a spatial or agent-based re-implementation, with terrain, suppression, and local maneuver, that reverses the Pickett flip or the Iwo Jima cost doubling.

Second, evidence from Ukraine through 2027 of human units routinely fighting to near annihilation without machine substitution, meaning breakpoints near 100% at scale. That would say human will is far more elastic than the 10–70% historical band, and the whole breakpoint frame is miscalibrated.

The method, briefly

A battle is not a subtraction problem. It is a race between two breaking points, and the side that reaches its own threshold first loses everything it has not yet lost. Hold that model, but hold it loosely: next post, an audit of 607 usable defeats from a roughly 660-battle database asks how often morale actually was the thing that broke, and the answer embarrassed me.

So I decided to project AI weapon characteristics into the very well studied historic battles, model them using Lanchesters’ equations, and see if I could project the past into the future to answer my questions.

The seven post series makes an assumption AI weapons an be modeled like human weapons whose will never breaks. They perform as they were programed (or trained) regardless of what happens. So the series asks one question: what is a will that cannot break actually worth in war? Not as a slogan. As a number, with error bars, in a model a military operations researcher would recognize.

The compressed answer, which the next six posts earn: an unbreakable will is real, measurable, and occasionally decisive. It is also narrow, conditional, and attackable. It decides fights that were already close on capability, and almost nothing else. Its value shrinks at every step up the ladder from the trooper to the commander to the force to the nation. And at the top of the ladder it can invert, into a way of losing wars while winning battles.

The visualization that opens the series. Iwo Jima, the one battle where the unbreakable will was real.

How to read it: one continuous history with a running ledger, real unbreakable casualties climbing beside the counterfactual where the garrison broke at a normal breakpoint. What to see: here the unbreakable Japanese will was not a hypothesis. It roughly doubled the American dead, about 21,431 versus 10,969 in the model, and changed nothing about who took the island.

Now the concession, because it belongs right up front. These are attrition-model results. The engine is a Lanchester system, aimed-fire attrition plus an explicit morale breakpoint, the casualty fraction at which a unit quits. It was calibrated to four historical battles and checked at the aggregate level: total casualties, duration, outcome. Three of those four are calibration plus consistency checks; the genuinely out-of-sample test is the independent Engel refit below. It has no terrain, no perception, no fog, no time resolution below the engagement. The strategic posts in the back half of the series run stylized extensions on top of that validated engine, and those results print as orderings and directions, never as calibrated magnitudes. If you want a model of what will is, this is not it. It is a model that assumes an AI weapon can think, reason, plan and act just like a human does, but the AI’s will never fails regardless of how poorly the battle is going. That narrower thing turns out to be answerable.

Why trust the tool at all? Lineage, mostly. Lanchester published the equations in 1916. Engel validated them against Iwo Jima’s daily casualty data in 1954, and when Samz revised Engel’s data in a 1972 Operations Research technical note, the revised data still fit. My independent refit of the same series recovers his coefficients (A = 0.0565 against his published 0.0544, R-squared 0.992 on 35 daily points). The historical audit in post 3 runs on CDB90, the roughly 660-battle database Trevor Dupuy’s researchers compiled for the US Army in the 1980s. Every piece of this apparatus is standard issue in operations research. The only new part is the switch that turns a side’s breaking point off. And that models one characteristic of AI weapons.

Bottom Line Up Near-the Front

Yes. In the case of Pickett’s charge, replacing Confederate soldiers with equivalent AI solders whose will never broke probably would have changed the battle and possibly the war. How to read the above: both ribbons are the same 11,481-man assault, width = remaining strength over the same clock; the dotted hairline marks the moment history stopped. In fact, the modeled AI assault wins 92% of simulated runs and never loses.

The frame

1. Clausewitz made will half of war. We are about to automate that half. Here is the sentence, in the Howard and Paret translation, that the whole project stands on: “If you want to overcome your enemy you must match your effort against his power of resistance, which can be expressed as the product of two inseparable factors, viz. the total means at his disposal and the strength of his will.” Means times will. We will study battles where the means were extensively counted: men, guns, ships, rates of fire. The will is the factor that fails first, and it has failed in every army ever fielded. The empirical literature on breakpoints (Clark 1954; Helmbold 1971) puts the historical range of casualties-at-breaking anywhere from roughly 10 to 70 percent, with leadership and communication mattering more than the count of the dead. The range is wide. The existence of the breaking point is as close to a constant as war offers. Or at least has offered in the past.

An autonomous weapon does not have a mental breaking point. Whatever else an AI-driven force turns out to be, it is the first combatant in history whose participation in the fight does not depend on its nerve. One of Clausewitz’s two factors is becoming a design parameter, something you specify at procurement rather than cultivate in barracks. That converts an old rhetorical question into a measurable one, and it deserves measurement before the money moves. This project is my attempt.

How to read it: Clausewitz factored war into means times will; the WILL formation erodes as the modeled force nears its breaking point.

What to see: one of the two factors fails first in every army ever fielded, and it is about to become a design parameter. AI-generated illustration; the WILL erodes to the model’s 28.6% breaking point.

2. What we built, and why these four battles. The instrument is a Monte Carlo combat simulator: Lanchester square-law attrition, each unit carrying a morale threshold that varies run to run, and the ability to mix breakable humans with unbreakable machines on one side. The test set is four battles, chosen so that each stresses a different joint between will and firepower.

• First Bull Run, 1861: a pure rout. The Union army came apart at 8.3 percent casualties, 2,896 of 35,000 present counting killed, wounded, missing, and captured. The test: can the model break early, the way real armies broke?

• Pickett’s Charge, 1863: a repulsed assault at near-parity firepower, the regime where a breakpoint should matter most. The test: does the model make the charge the long shot it was?

• Trafalgar, 1805: a decisive naval concentration, where British gunnery and Nelson’s geometry did the deciding and Britain lost zero ships. The test: does the model refuse to credit will where will was not the story?

• Iwo Jima, 1945: the control case, and the reason this series is not counterfactual fiction. Kuribayashi’s garrison genuinely fought without a breakpoint: of roughly 21,000 defenders, 216 were taken prisoner during the battle. History already ran one experiment with an unbreakable will, and Engel left us the daily data on what it cost.

How to read it: each panel is one validated battle; the X is where the losing force’s will broke, the caption the historical outcome the model had to reproduce.

What to see: four very different fights, one shared failure mode, and a single experimental move: turn the breaking point off.

The engine had to reproduce all four before any counterfactual ran: the rout at 8.3 percent, the charge repulsed with roughly 19 percent Union casualties, the zero British ships, and Iwo Jima's daily casualty trajectory. The charge's 4.2 percent baseline odds (95% CI 3.9-4.6%) are what the matched engine then reports: model output, not a validation target.

How to read it: each row is one check; a dot inside its ring is a bullseye, and the short brass bar is the miss distance on that row’s own zero-based scale.

What to see: one engine lands on or beside eight very different targets across four battles, before the morale switch was ever touched.

3. The experiment: turn one side’s breaking point off. Once the engine matched history, the counterfactuals ran in escalating doses. Make one strategic weapon unbreakable AI, a battery that never abandons its guns, to approximate the 2020s approach of embedding AI into strategic weapons first. Then make a contingent unbreakable, and sweep the fraction from a few percent to the whole force: the 2030s proverbial AI/robot-army. Then stop assuming the enemy cooperates. Let him jam the machines’ wiring, decline the fights he would lose, choose the kind of engagement he prefers. Finally, put a nation behind the unbreakable army, with a nation’s very human tolerance for cost, and let the campaign run to a political ending. Each escalation is one post. Each post has one claim I would defend in a hostile meeting.

4. The map of the series. Six posts follow. Here is what each one argues.

Post 2, 91.7% of the Army Was Still Standing When It Ran. Battles end when will breaks, long before armies die: the Union quit Bull Run with over nine-tenths of its men still standing, and a robot Pickett’s Charge takes the ridge in 92 percent of simulations (95% CI 91.6-92.5%) and never loses outright. Iwo Jima’s real unbreakable will roughly doubled American casualties in the model (21,431 against 10,969 simulated) and changed nothing about who won.

Post 3, Out-Fought, Not Out-Frightened. An audit of 607 defeats in the Army’s own database finds about two-thirds (60.8-72.2 percent across threshold choices) were capability losses, and genuine will collapses were a fifth, at most a third after honest correction. Two-thirds of history’s losers were out-fought, not out-frightened.

Post 4, ADM Nelson Beats the Robots. Every battle has a capability floor below which no fraction of unbreakable force wins, and against an enemy that does not break, your own unbreakable will is worth exactly zero. Even a Trafalgar fleet that never strikes its colors loses 83.6 percent of the time (95% CI 83.0-84.2%).

Post 5, The General Quits First. Historical battles ended on a commander’s withdrawal ten times as often as on the troops’ annihilation (266 to 26 of 607 recorded defeats), and a machine’s will is only as unbreakable as its jammable, hackable substrate. Your robot’s will lives in its radio.

Post 6, The Unexpected Deterrence. A rational enemy declines roughly 40-58 percent of the fights an unbreakable force would win and keeps the ones he takes; let him choose the kind of fight and will’s measured value collapses by about 97 percent in the model. A Great General will not fight your unbreakable army. They will fight around it.

Post 7, Win Every Battle. Lose the War. The capstone: a reviewer’s attack on the model, my correction, and the enemy’s answer to the correction map four regimes, and every one is decided by what the nation can bear, blood where the enemy can reach it, treasure and time where he cannot. The series’ honest scorecard and all nine operating rules live there.

Best Arguments Against This

The strongest objection covers the whole series, so it goes here, at the front: an aggregate attrition model cannot capture what will actually is. Will is perception, leadership, cohesion, exhaustion, the rumor running down the line. My model compresses all of it into one number, a casualty fraction at which a unit quits, and the foundational empirical study of breakpoints, Dorothy Clark’s 1954 work on 43 broken battalions, found casualty levels a poor predictor of when units break. So the model’s trigger variable is the one the best field data demoted. I concede the compression fully. RAND’s Will to Fight framework (Connable and colleagues, RR-2341-A, 2018) shows what the full-mechanism alternative looks like: 29 factors, unit by unit, from leadership to cohesion to supply. Their model is a model of what will is. Mine is one threshold, because my question is not what will is made of but what removing its failure point changes.

Three things keep the results standing anyway. First, the design: the counterfactual question is not what triggers a break but what changes when no trigger exists, and for that the model needs only that the historical break happened at a measurable point, which the record supplies. Second, the validation: the engine reproduced four very different battles, including an independent recovery of Engel’s 1954 coefficients, before the morale switch was ever thrown. Third, the audit: every headline number in this series was reproduced from committed data and stress-tested before drafting, dropping one war at a time, one century at a time, rerunning under fresh seeds, re-scanning grids at finer steps. Where the audit’s numbers moved under stress, the moved versions are the ones that print. What the concession still buys the skeptic, the spatial and perceptual texture of real combat, is named below as the likeliest thing to change my mind.

What Would Change My Mind

These are the series-level triggers; each post carries its own.

1. By end of 2027: a spatial or agent-based re-implementation of these experiments, with terrain, suppression, and local maneuver, that overturns a core ordering: the Pickett flip, the capability floor, or the capstone’s never-helped result. This is the single most likely falsifier.

2. By December 2027: a machine-readable re-audit of historical defeats that separates fighting-phase from pursuit-phase casualties at hundreds-of-battles scale and finds true will collapses were the majority. Post 3’s headline dies, and much of the series’ framing with it.

3. Within a year of publication: verified battlefield evidence of an unbreakable autonomous force flipping an engagement it was clearly losing on capability, by refusal to break alone. That breaks the tiebreaker thesis at its center. Keep an eye on Ukraine.

4. Any time: an independent refit of Engel’s 1954 Iwo Jima daily series that fails to recover coefficients near his published values. That is my validation lynchpin.

The close

For two centuries strategy treated the will factor as fate: a commander could cultivate it, but nobody could specify it. That era is ending on a procurement schedule, and the right response is neither the promise that armies which cannot panic cannot lose, nor the reflex that nothing fundamental has changed. The right response is to measure and adapt.

Measured, it comes to this. An unbreakable will is not a war-winner. It is a tiebreaker, purchased at strategic risk: it decides fights that were already close, only where the enemy allows the fight, only while its wiring holds, and the bill goes to a nation whose own will remains the last, and deciding, breaking point.

Next post: the army that ran from Bull Run with 91.7 percent of its men still standing, and what happened when I built its panic into the math, then took the panic away.