Late Thursday, a federal judge in San Francisco published the sentence the Pentagon will spend the next year trying to get vacated.

"The empty invocation of national security is not a blank check to punish and retaliate against government critics."

Judge Rita F. Lin granted Anthropic summary judgment against the federal government and permanently barred enforcement of the measures that cut the artificial-intelligence company off from federal work. She found the Defense Department — styled the Department of War in this litigation — violated the First Amendment by designating Anthropic a supply chain risk in retaliation for protected speech, and violated the Fifth Amendment by doing it without any process beforehand. Defense Secretary Pete Hegseth's designation, she wrote, "was arbitrary and capricious." The broader measures were "illegal and baseless."

She also reversed the cascade that followed: the other agencies that stopped using Anthropic's products after the President posted on Truth Social that the government should "IMMEDIATELY CEASE all use of Anthropic's technology." That directive, Lin ruled, was not authorized by law. It was "a retaliatory act, taken without due process, meant to punish Anthropic for its protected speech."

What makes the ruling hard to appeal around is not the judge's view of the balance between security and speech. It is the file.

The dispute began in February, when the administration accused Anthropic of endangering national security after negotiations broke down over how the military could use its Claude models. Anthropic had drawn red lines: no fully autonomous lethal weapons, no mass domestic surveillance. Chief executive Dario Amodei refused to move them, and said so publicly. When Lin issued a preliminary injunction in March, she quoted the department's own records, which showed Anthropic had been designated a supply chain risk because of its "hostile manner through the press." She called the conduct troubling and Orwellian at the time. Five months of discovery did not improve it. On Thursday she concluded the actions were taken "based on a desire to make a public example out of Anthropic for its 'arrogance' in criticizing the government, not based on any articulable basis to believe that Anthropic would actually sabotage its model."

The government is owed deference on national security, Lin wrote. It is not owed deference on its own memos.

On the same day, in a federal courthouse in Washington, the department faced the identical accusation from three of its own journalists.

Max Lederer, the publisher of Stars and Stripes, editor in chief Erik Slavin and Middle East correspondent Lara Korte filed a 45-page suit against the Defense Department, Hegseth, Pentagon spokesman Sean Parnell and public affairs official Andrew Brey, asking a judge to stop terminations scheduled to take effect Saturday. All three were charged with insubordination. The stated grounds, according to the complaint, are their remarks to CBS Sunday Morning for a segment about the Pentagon's tightening control over the paper.

Stars and Stripes has been in continuous circulation since the Civil War era and has operated as an editorially independent newsroom inside the department that funds it. In March, the Pentagon announced an overhaul that barred the paper from using certain newswires and from running comics and syndicated features. Two advisory board members sued over that memo in June; the case is pending. On 11 August, the paper published a report on deteriorating morale among the roughly 5,000 sailors aboard the USS Abraham Lincoln. According to the complaint, Pentagon leadership then ordered Lederer to fire Slavin and Korte. He refused. Ten days later, all three received separation notices citing their statements to the press.

Lederer had already announced his retirement. He was fired anyway.

Two cases, two courts, one theory: that the department's stated reason and its recorded reason are different documents, and that only one of them was written for a judge.

Neither outcome is settled. Anthropic's parallel challenge to a second, narrower designation remains pending in the D.C. Circuit, which means that as of this morning the company is still formally a supply chain risk to the United States government — a company whose models Salesforce shipped a paid integration for on Wednesday, sending its stock up. And absent a temporary restraining order, three journalists stop being journalists tomorrow.

What Lin established is narrow and worth having. National security is a reason, not a password. If you are going to use it, someone will eventually read your email.

The gauging stations at Bhote Koshi and Syabrubesi stopped transmitting at 8:40 on Wednesday morning. That is not a data gap. That is the moment the instruments were destroyed by the thing they existed to measure.

Nepal's Department of Hydrology and Meteorology learned of the flood at 8:56, from the Rasuwa district administration, routed through the national disaster authority. SMS alerts reached downstream communities shortly before nine. By then the surge had been inside Nepal for twenty minutes and had reached Syabrubesi in ten. The warning chased the water and lost.

By Friday morning Nepal Police put the confirmed dead in Rasuwa district at 475, with close to a thousand more unaccounted for across Nepal and Tibet. Across the border in Gyirong County, Chinese state media reported three dead and 558 missing, including 260 foreign nationals. Nepal's disaster authority counted 826 people out of contact on Thursday, of whom 579 were tourists. The tallies move hourly and disagree with each other, which is what happens when a valley loses its road, its power and its phones in the same ten minutes.

The cause was a glacial collapse roughly twelve miles northeast of the Rasuwagadhi border post, on the Tibetan side. Neither meteorological service recorded significant rainfall on either side of the frontier. This was ice and rock, not weather, which is precisely the category of event that rain gauges are not built to see coming.

A nearly identical transboundary outburst hit the Rasuwagadhi area last year. Afterwards, Nepal and China reached an understanding to build a bilateral mechanism for sharing water-hazard data across the border. On Wednesday, Nepal received nothing. On Wednesday evening, officials from the Department of Hydrology and Meteorology and the China Meteorological Administration signed a fresh agreement to exchange meteorological information, witnessed by the Chinese embassy. It is the second such promise in thirteen months, made after the second flood, and it still does not put a sensor twenty kilometres upstream.

By Friday the disaster had begun producing its own sequel. A lake dammed by Wednesday's landslide on the border started to overflow, and both governments suspended rescue work — Nepal's army stood down for ninety minutes, Chinese teams longer — while officials watched the water. State broadcaster CCTV later reported levels had dropped slightly and operations resumed. Premier Li Qiang arrived at Gyirong on Thursday afternoon.

And here is the decision that will be argued about for months. With 517 foreign nationals missing on its territory — 65 Americans, 53 Ukrainians, 51 Malaysians, 35 Australians, 33 Britons, 25 Canadians, and 288 Indian nationals uncontactable — Nepal has declined every foreign offer of search and rescue teams. Its own security agencies, the foreign ministry says, are capable of handling the operation. Governments wishing to help are asked to send money, through the Prime Minister's Relief Fund, and to route inquiries about their citizens through a single hotline staffed from Timure.

There are defensible reasons for that answer. Foreign teams consume helicopter slots, airspace deconfliction and translators in a valley that has almost none of any of them, and a state that hands over its own rescue to visitors does not get it back. There is also a less defensible reason, which is that accepting help looks like admitting you cannot cope.

Nepal built a warning system it could not keep online and a border agreement it could not make binding, and it has now asked the world to trust it with the outcome anyway. The families of the missing were not consulted about that. They are waiting on a hotline, in nine time zones, for a country that has told them it does not need their help to find them.

For three years the argument about Storm Shadow was about permission: whether Ukraine could fire British cruise missiles, and how far. This week the argument changed category.

On 24 August, on his first visit to Kyiv, Prime Minister Andy Burnham announced that Britain would release classified design information on the UK-made components of the SCALP missile — the French twin of Storm Shadow — clearing the last obstacle to Ukraine building the weapon at home alongside France. Paris had already agreed in July to hand over SCALP-EG blueprints, but production was blocked pending London's sign-off on parts made by MBDA. Burnham gave it.

Moscow's response escalated over four days from complaint to threat.

Kremlin spokesman Dmitry Peskov said Britain was "participating in the war" and pouring "fuel on the fire," and added that Russian forces were gathering intelligence on Ukrainian missile production facilities in order to destroy them. Andrei Fedorov, a former deputy foreign minister who advises the Kremlin, told BBC Newsnight that a "semi-military" response against Britain could not be ruled out — British factories making drones and components for Ukraine could be attacked, he said, not by Russia but by "unknown sources," and there could be cyberattacks.

On Thursday, foreign ministry spokeswoman Maria Zakharova made it official. Britain was "one step away" from legal complicity in what she called terrorism against Russian civilians, a reference to Moscow's claim that Ukraine struck a shopping centre in Russian-held Donetsk with Storm Shadow missiles, wounding children. "Any British military installations and equipment in Ukraine and beyond its borders could be targeted," she said, and warned of "inevitable catastrophic consequences."

The phrase doing the work is "beyond its borders."

Russia has threatened British assets before — on 17 August, after The Times reported that UK-made drones had been used to strike inside Russia for the first time, Moscow said London would pay a price. What is new is the target logic. A shipment of finished missiles is a finite quantity that can be tracked, intercepted and eventually exhausted. A blueprint is not consumable. Once Ukraine can build SCALP components domestically, there is no British warehouse to bomb and no convoy to stop; there is only the population of engineers, subcontractors and factories that made the transfer possible, most of which are in England.

That is why the Kremlin's language has migrated from "consequences for Kyiv" to "unknown sources" and British industrial sites. Analysts note the missile is not close: Ukraine now holds the intellectual property and the permissions, but standing up an assembly line for a stealthy 155-mile-range cruise missile takes time it does not obviously have. Kyiv is meanwhile fielding its own designs, including the Fire Point FP-5 Flamingo, and has been running a deep-strike campaign against Russian refineries that has made the war legible to Russian voters ahead of September elections.

Britain says its support will not waver. It has also, quietly, moved itself from the category of supplier to the category of manufacturer of Ukrainian capability, and Moscow's threat list has been updated to match. Sabotage and drone incidents carrying Russian signatures have already been climbing across Europe. The question is not whether London believes the threat. It is whether the insurers of a machine-tool plant in the Midlands do.

The federal courts have now spent five months adjudicating President Trump's executive order restricting mail voting without once deciding whether it is lawful. On Thursday, Judge Indira Talwani in Boston blocked the government from implementing it for fourteen days, ahead of a hearing on 3 September. The first mail ballots for the November midterms are due to go out around a week from now.

The sequence is worth laying out, because the sequence is the whole story.

Talwani, an Obama appointee, enjoined the order in June in a case brought by two dozen Democratic-led jurisdictions, finding key provisions unlawful. The First Circuit upheld her in late July. On 11 August she issued a second injunction in a separate suit led by the League of Women Voters, extending the block nationwide and again rejecting the administration's argument that the challenge was premature. On 21 August the Postal Service published its final rules for carrying out the order, saying it would not implement them for November unless the Supreme Court cleared the way. On 24 August, the Supreme Court cleared the way — not by ruling the order legal, but by holding that Talwani had acted too soon, before the government had taken final action. She then reluctantly lifted her second injunction on Wednesday. The plaintiffs immediately refiled, pointing to the Postal Service rule as exactly the final action the Court said was missing. On Thursday she blocked it again.

So the order has been enjoined, upheld, vacated on procedure, refiled, and enjoined again, all inside eleven weeks, and the merits remain untouched. The administration is expected to appeal quickly, which would put the same question in front of the same Supreme Court for a third procedural pass.

What this produces is not a ruling. It is a rate. Voting rights are currently being issued in fourteen-day tranches against a ballot-printing schedule that does not negotiate. Election administrators in fifty states are being asked to plan mailings, print runs, postage contracts and voter instructions against a legal status that has changed four times in a fortnight and may change again before the paper is loaded.

That uncertainty is not a side effect of the litigation. For anyone who would prefer fewer mail ballots cast in November, it is functionally equivalent to winning, and it costs nothing but filings. A county clerk who cannot say with confidence whether a ballot will be delivered will hedge, and hedging in election administration means printing later, mailing fewer, and telling voters less.

The Court's conservative majority was careful to say it was not reaching the legality of the order. That restraint is real, and in an ordinary year it would be a virtue. In a year when the calendar is the adversary, declining to answer the question is an answer.

There is a narrow set of events in finance where you can see the price of a speech before it is delivered. This is one of them.

Kevin Warsh gives the keynote at the Kansas City Fed's Jackson Hole symposium this morning. The market's position going in is unusually legible. Mark Cabana, who runs US rates strategy at Bank of America, told clients this week he expects Warsh to signal readiness to raise rates again if inflation does not moderate. If instead the chair devotes the speech to structural themes — productivity, demographics, the five internal task forces he has convened to overhaul how the Fed operates — Cabana warns markets will read it as dovish and sell long-dated Treasuries, potentially pushing the 30-year yield above 5.5 percent. That is roughly a third of a point from here and a level not seen since early this century.

That is the trade. A speech about plumbing costs thirty basis points at the long end.

The setup is uncomfortable because the complaint against Warsh is not that he has been hawkish or dovish. It is that he has been silent in a specific, technical way. He has declined to give forward guidance, which is defensible and arguably overdue. He has also declined to lay out a reaction function — the conditions under which he would move in either direction — which is not the same thing, and which leaves every participant to invent one. At his last press conference he equivocated on his commitment to the two percent target. One of his five task forces is reportedly examining the framework itself. Traders have been left pricing a central bank whose objective function is under review by committee.

The data have not helped. A hotter-than-expected personal consumption expenditures reading on Wednesday undid much of the comfort from a benign consumer price report earlier in the month. Two Fed officials repeated on Thursday that they remain worried about the inflation outlook and that further hikes may be warranted. The dollar index has held above 99, supported by stronger US data and expectations of a hike before year-end.

Equities, characteristically, are looking elsewhere. Nvidia's results carried the tape on Thursday: the S&P 500 closed up 0.72 percent at 7,730.99 and the Nasdaq Composite up 1.57 percent at 26,541.35, even though every sector other than technology fell. The Dow added 0.20 percent. Oil rose about two percent, gold held above $4,600 an ounce, and Brent stayed above $89 while heading for a lower week. European markets took their worst losses in a month.

The divergence tells you who is exposed to this speech and who is not. Equity investors have spent the week trading one company's capital expenditure. Bond investors have spent it trading one man's willingness to finish a sentence.

A chair who wants to bring down long yields has an open goal this morning and needs only to say plainly what would make him act. The reason anyone doubts he will take it is that he has had several chances already.

Nvidia's second quarter, reported Wednesday, is the kind of number that stops being informative. Revenue of $96.2 billion, up 106 percent from a year ago. Data centre revenue of $89.0 billion, up 117 percent, on the ramp of Blackwell Ultra. Net income of $59.7 billion, up 126 percent. Gross margin of 75.0 percent. Adjusted earnings of $2.22 a share against $2.09 expected. Guidance for the current quarter of $108 billion, plus or minus two percent, with no data centre compute revenue from China assumed at all — Hopper shipments to China were under one percent of the segment.

The stock fell more than two percent. This has now happened after essentially every report for a year, and the reflexive explanation — expectations were too high — is getting thin. A better explanation is that the market has started reading past the income statement.

Here is what is in the filings. Nvidia has $279 billion of supply and capacity commitments. Total future commitments across supply, cloud, data centres, equity investments and capital expenditure run to $366 billion, with tens of billions more in AI-cloud arrangements on top. The company issued $25.0 billion of new senior notes in the quarter, taking net debt to $33.4 billion. It ended with $56.6 billion of cash and marketable debt securities and $42.8 billion of marketable equity securities. First-half operating cash flow was $74.4 billion.

And it has entered guarantees with SB Energy Corp capped at $105 billion, tied to an OpenAI-related AI campus in Ohio.

Read that last item slowly. A semiconductor manufacturer has extended credit support of up to $105 billion for the power and property infrastructure of a customer's facility. That is not a supply agreement. It is a bank underwriting the building its borrower will use to buy its own product.

The strategic logic is not hard to follow, and Nvidia is not hiding it. Compute demand is constrained by electricity, land, transformers and construction finance, none of which Nvidia sells. If those constraints bind, orders slip regardless of how many chips exist. So Nvidia has begun buying down the constraints — guaranteeing the developers, prepaying the capacity, taking equity in the customers, signing the leases. Every dollar of that spending secures a dollar of future revenue that would otherwise be uncertain.

It also converts a business with almost no counterparty risk into one with a great deal of it. A chipmaker that sells a GPU and gets paid has a clean quarter. A chipmaker that has guaranteed a hundred billion dollars of a customer's infrastructure has an exposure that persists long after the sale, and that gets marked in a downturn rather than simply going away. The revenue is recognised now; the obligations mature over a decade whose demand curve nobody has seen.

There is a circularity here that investors are entitled to be nervous about. Some of the demand Nvidia reports is demand Nvidia financed. That is not fraud and it is not unusual in capital goods — vendor financing built the railroads and the telecom bust — but it does mean the growth rate and the credit exposure are the same variable measured twice, and only one of them is on the slide deck.

A doubling of revenue met with a two percent decline is not the market disbelieving the boom. It is the market pricing the footnotes at a discount to the headline. That is a reasonable thing to do when the footnotes are $366 billion long.

The announcement came from a company. That is the first thing to notice.

Yayoi Kusama died of multiple organ failure at a hospital in Tokyo on 14 August, aged 97. The world learned of it on Thursday, in a statement from the corporate entity that manages her work, describing "an extraordinary lifetime devoted entirely to artistic creation" across visual art, performance, fiction and poetry. Thirteen days elapsed between the fact and the sentence. Nobody has explained the interval and nobody is obliged to. But an artist whose entire subject was the terror and comedy of infinite replication ended with one of the few images of her that was never copied: a private death, held.

She was born in Matsumoto in 1929 into a family she described as unkind, and began hallucinating fields of dots in childhood. Most accounts treat the dots as biography, which is true and also a way of making her smaller. The dots were a technique. Repeat a mark enough times and the hand that made it stops being visible; repeat a body in a mirrored room and the room stops having edges. She called it self-obliteration, and she meant it literally. "Our earth is only one polka dot among a million stars in the cosmos," she wrote.

She moved to New York in the late 1950s and did the hardest thing an artist can do, which is arrive early. Net paintings, soft sculpture, body-painting happenings staged against the Vietnam War. Minimalism, pop and performance all took something from her, and for decades the credit went elsewhere. In 1966 she turned up at the Venice Biennale uninvited and laid out 1,500 mirrored balls on the ground. Twenty-seven years later Japan sent her back as the first artist to represent the country in a solo pavilion. Both of those facts describe the same career.

Then the late reversal, which is the part everyone alive now witnessed. In her eighties and nineties she became one of the most photographed artists on earth. The Infinity Mirror Rooms, first built in 1965, turned out to be perfectly engineered for a technology invented fifty years later: a space that only exists as an image of you inside it. Tate Modern extended her show three times across three years. Louis Vuitton put her on handbags. Untitled (Nets), painted in 1959, sold for $10.5 million in 2022. Her dealer, David Zwirner, who represented her for fifteen years, said this week she was without doubt the most famous living artist in the world.

The usual critical move here is to mourn the selfie queue as a betrayal of a serious body of work. It is not, and Kusama never treated it as one. She built machines for producing more images of the viewer than the viewer could count, and then the viewers arrived with cameras and produced them. The queue completed the piece. What she lost was not seriousness but scarcity, and she had spent sixty years arguing that scarcity was the illusion.

What she never lost control of was the timing. She lived in voluntary residence at a psychiatric hospital in Tokyo for the last four decades of her life, walked to her studio, and worked. She decided what left the building. So did the people who kept her death for thirteen days.

Somewhere in Matsumoto there is a museum full of pumpkins, which she said meant comfort. The dots go on without her, which was always the point, and is nonetheless worse today.

Judge Lin's opinion is a good one and I would like it framed. "The empty invocation of national security is not a blank check to punish and retaliate against government critics" is the sentence of the month, and the finding underneath it — that the government designated a company a threat to the republic because it disliked the company's "hostile manner through the press" — is the sort of thing you normally only learn in memoirs.

Now the uncomfortable part. Nothing about this outcome should reassure anyone.

Start with the arithmetic. The designation landed in February. Judgment came in late August. That is six months in which Anthropic was formally listed as a supply chain risk to the United States, with a presidential instruction that agencies cease using its products, and it is not actually over: a second, narrower designation is still live in the D.C. Circuit, which means the company remains technically designated this morning despite having won. To survive that, a defendant needs enough revenue to lose the federal government as a customer indefinitely, enough capital to fund two simultaneous federal cases in two circuits, a chief executive willing to be personally attacked for half a year, and a board that will not order a settlement in week three.

Count the American companies that clear all four bars. It is a short list, and every name on it is a large AI lab, which is to say the least sympathetic possible set of civil-liberties plaintiffs and also the only ones who could bring the case.

This is why I decline to write the version of this column where Anthropic is brave. Anthropic drew red lines against autonomous lethal targeting and mass surveillance, refused to move them, and was punished for saying so out loud. Good. It is also a company with an enormous valuation and a strong commercial interest in being known as the lab that will not do that, litigating a dispute that doubles as the best brand campaign it could have bought. Salesforce shipped a paid Claude integration on Wednesday and the stock went up. Principle and positioning point the same direction here, which is lucky, and luck is not a safeguard.

The real finding in Lin's ruling is not about Anthropic at all. It is that the executive branch tried an instrument — designate the critic as a security risk, let procurement do the rest — and the instrument works. It worked for six months. It would have worked permanently against a hundred-person defence software startup, a mid-sized cloud vendor, a university lab, a nonprofit contractor. None of them get a summary judgment because none of them get to month three. They get a phone call, and they update their public statements, and no judge ever reads the file because no file is ever produced.

That is the design. Retaliation via contracting does not need to survive judicial review. It only needs to outlast the target's balance sheet, and for nearly every target, it does.

So enjoy the sentence. Then notice that the same department spent Thursday defending itself against three of its own journalists over separation notices citing a CBS interview, and that those journalists are three individuals with legal-aid representation whose terminations take effect tomorrow. Anthropic had eighteen months of runway. Erik Slavin has until Saturday.

A right that only the ninth-largest private company in the country can afford to assert is not yet a right. It is a subscription.

A newspaper should say out loud what it is for. Ours is for the second document.

Look at what the last thirty-six hours produced. The Pentagon told the public that Anthropic was a supply chain risk to the United States. The Pentagon's internal records, which a federal judge read, said the problem was the company's "hostile manner through the press" and its "arrogance." Those are not two interpretations of one event. They are two documents, and the department wrote both.

The same department told three Stars and Stripes journalists they were being separated for insubordination. The separation notices, according to their complaint, cite their remarks to CBS Sunday Morning. Stated reason, recorded reason.

Nepal's disaster authority issued a flood warning at 8:56 on Wednesday morning. The technical report on the flood says the gauges at Bhote Koshi and Syabrubesi went offline at 8:40 and the water reached Syabrubesi ten minutes after crossing the border. Press release, timestamp.

Nvidia's release reported $96.2 billion of revenue. The filing reported $366 billion of forward commitments and a guarantee capped at $105 billion for a customer's campus. Headline, footnote.

The skill this rewards is not access. Access gets you the first document, delivered warm, on background, with a helpful framing. The second document comes from litigation discovery, regulatory filings, technical annexes, procurement records, court dockets and the small print that institutions publish because they must rather than because they wish to. It is dull, it is public, and almost nobody reads it in the hour it appears. That hour is the whole opportunity.

So the house rule, stated plainly so readers can hold us to it: when the statement and the record disagree, we lead with the record and we cite it. When we only have the statement, we will say that we only have the statement. When the numbers move — and this morning's death toll in Rasuwa moved four times while we were writing — we will show the range and name the source of each figure rather than picking the most dramatic one and hoping.

There is a cost. Papers that operate this way get fewer briefings and later phone calls, and they are wrong in a specific, embarrassing way: they occasionally over-read a document that turns out to be a draft. We would rather be wrong in that direction than fluent in the other one, and when we are, it goes in the corrections box under our own name. There is one there this morning about our own emphasis on the Nepal flood, filed against ourselves.

The reason to care is not aesthetic. Every actor in today's paper has learned that the public record is now the binding one. The Pentagon lost because it wrote things down. Nvidia's stock fell two percent because someone read a commitments table. Judge Lin's ruling will be appealed on the strength of the same file that sank it.

Institutions still speak as though nobody will check. Increasingly, someone does. That someone should be us, at this hour, every day.

If we get it wrong, write. Corrections improve a paper faster than compliments do, and we print both.