The drones that disabled Saudi Arabia's last working oil artery on Thursday morning did not come from Yemen and did not come from Iran. They came from Maysan, a province in southeastern Iraq on the Iranian border. The government of Iraq said so out loud.

That admission is the most consequential sentence spoken in the Gulf this week, and it has been almost entirely buried under the Houthi advance down the Yemeni coast.

Here is the sequence. Thursday morning, several drones struck the East-West pipeline in the Riyadh and Medina regions — the line that carries crude from the Eastern Province across the peninsula to the Red Sea terminal at Yanbu. The Saudi energy ministry said the attacks caused injuries and that damage was still being assessed. On Friday, Riyadh shut the pipeline as a precaution. Satellite images showed scorched ground and smoke near the site.

Then the strange part. Iraq's prime minister telephoned Riyadh. Baghdad confirmed that the attack had been launched from Maysan, removed the governorate's operations commander from his post, and opened an investigation. And Saudi Arabia — a state that had just watched its single remaining export route go dark, hit by aircraft launched from a neighbour's territory — said it would not retaliate at this stage. It would instead, its foreign ministry said, "support the efforts of the Iraqi government" to "prevent attacks" launched from Iraq against neighbouring states.

Read that with the roles reversed and the oddity becomes visible. The victim of a cross-border attack is offering capacity-building assistance to the territory the attack came from.

## Why the pipeline is the whole game

The East-West line stopped being a contingency in the spring. When Iran's campaign effectively shut the Strait of Hormuz, Saudi Arabia began pushing the bulk of its exports across the peninsula to Yanbu rather than out through the Gulf. A spare became the primary. Nobody re-rated the risk, because re-rating it would have required admitting there was no third line.

Thursday removed the second one. Brent crossed $100 a barrel for the first time since July.

And on Friday, while Riyadh was drafting its statement of support for Baghdad, the Houthis completed a week-long offensive that took the entire Yemeni Red Sea coast and three strategic islands, including the port of Mocha and Zuqar Island, and gave them the Yemeni side of Bab al-Mandab. Hundreds are dead. The offensive means the same coalition that shut the front door now holds the water at the far end of the corridor the back door empties into.

One party has a claim on both ends of the detour. Nobody planned that. It is simply what happened while everyone was counting straits.

## A personnel action instead of a perpetrator

What Iraq did is worth stating precisely, because the precision is the point. Baghdad did not name the people who launched the drones. It did not announce arrests. It relieved the officer responsible for military operations in the province the drones came from.

That is what a government does when it wants to demonstrate accountability for an event it did not authorise and cannot prevent. It substitutes a job for a jurisdiction. Someone's career is offered in place of an assertion of control, because the assertion of control is the one thing that cannot be made without being immediately tested.

Maysan borders Iran. It has for years been among the governorates where Iraq's writ is thinnest and where armed formations operate with budgets, payrolls and chains of command that are not entirely the state's. Everyone in the region knows this. The purpose of the commander's removal is not to change it. The purpose is to give Riyadh something to accept.

## What Saudi Arabia bought

Riyadh accepted it because the alternatives are worse arithmetic. Retaliation against Iraq is the single move that converts a war between the United States, Israel and Iran into a general Arab war, and it would be retaliation against a government that has just conceded it is not in command of its own border province. There is no address to strike that is also an address that can stop the next launch.

So the kingdom bought the fiction. The Gulf Co-operation Council supplied the language for it, condemning the strike through secretary general Jasem Mohamed Albudaiwi as "a dangerous escalation and an unacceptable threat to the security of the Kingdom of Saudi Arabia, its territorial integrity, and its vital installations, as well as a flagrant violation of the principles of international law." Note what that sentence protects. It defends Saudi territorial integrity, and it says nothing about Iraq's, because saying something about Iraq's would require deciding whether Iraq has any.

The war is in its seventh month. The pipeline is off. The strait is held. And the formal diplomatic position of every government involved is that the state whose soil the drones flew from is a partner to be supported in its efforts.

It is a good fiction. It is buying time nobody has a plan for. Tell us what it buys in week eight.

The negotiators finished at four in the morning. By Saturday afternoon Narendra Modi could say the sentence he had spent the week buying: "No member has raised any objection. The New Delhi Declaration 2026 is adopted unanimously."

BRICS is consensus-based, which means any one of its eleven members can kill a joint statement by declining to nod. The bloc now contains Iran, Saudi Arabia, the UAE, Egypt, Ethiopia, Indonesia, Russia, China, Brazil, South Africa and India. That is a membership list that includes a country under attack, two Gulf states whose shipping is being interdicted by a movement the first one arms, and the country whose canal revenue depends on the water all of them are fighting over. Getting a single document past that room is not nothing. India did it by taking the names out.

On the war, the declaration expresses "deep concern over the continued escalation of tensions in Middle East/West Asia" and calls for "exercising maximum restraint." It urges protection of civilians and civilian infrastructure, raises "serious concern" over deliberate attacks on peaceful nuclear facilities under full IAEA safeguards, and insists that nuclear safety must hold even during armed conflict. It respects "the sovereignty and territorial integrity of the States."

It assigns responsibility to no one.

That was the fight. Tehran wanted an explicit reference to what it calls a unilateral attack and a violation of the UN Charter, and wanted it kept out of what a source close to the talks described as a "generic formulation." Abu Dhabi wanted the generic formulation. The generic formulation won, with the compensation prize that the language on nuclear facilities came out broader than it started.

## The measurement

Here is the useful way to read a document like this. A communiqué is not a statement of intent; it is a survey instrument. It tells you the exact boundary of what a group of governments will still say together, and the boundary moves.

The boundary this weekend runs just short of every fact on the ground. On Thursday drones launched from Iraq shut the pipeline carrying Saudi exports — Saudi Arabia is in the room. On Friday the Houthis took the Yemeni side of Bab al-Mandab — Iran, their patron, is in the room. Egypt, whose canal receipts have not recovered from the last Red Sea closure, is in the room, and the crude now crossing Egyptian soil by pipe is Saudi. The bloc contains both ends of the blockade and the toll booth in between, and what it could agree to say about that is: maximum restraint.

The economic text is more honest because it is less urgent. The declaration backs WTO reform, warns about tariffs and non-tariff barriers, and calls for IMF and World Bank quota changes. On payments it acknowledges the work of the BRICS Payment Task Force on cross-border interoperability and "promoting trade settlements and investments using BRICS local currencies, while respecting national priorities and acknowledging that there is no one-size-fits-all approach."

That last clause is the whole story of BRICS currency ambition rendered in treaty prose. There is no common currency. There is no mandate. There is a task force, a study of messaging-channel interoperability, and an explicit reservation that nobody has to do any of it.

## The bilateral that mattered more

The consequential meeting in Delhi was not the plenary. It was Modi and Xi Jinping sitting down on Saturday, Xi's first visit to India in seven years, six years after the Ladakh standoff froze the relationship. They discussed trade and investment and the machinery of not shooting at each other in the Himalayas.

A bloc that cannot name a belligerent can still be the venue where two nuclear-armed neighbours who stopped talking start again. That is a smaller claim than the one the declaration makes for itself, and it is the one that will still be true in a year.

Ask who closed the southern Red Sea and you will be told: the Houthis. That is roughly half right and entirely useless if you want to know what a cargo costs this week.

The mechanism is hull war risk insurance, and the body that sets its perimeter is the Joint War Committee in London, which maintains a published list of enhanced-risk areas and a separate notified zone. Owners pay to enter. When the committee moves the boundary, every vessel inside it repriced overnight without a shot being fired at any of them.

After the Houthis declared a maritime embargo on Saudi-serving shipping on 20 July and two linked vessels were hit, the committee widened the notified zone northward toward the Saudi port of Jizan — about 800 kilometres up the coast. Premiums in the most exposed corridors moved to roughly 0.5 per cent of hull value per transit. The wider Red Sea has been sitting closer to 1 per cent, against a pre-escalation baseline near 0.3 per cent.

## Do the division

A Suezmax carries about a million barrels on a hull worth perhaps $80 million. At 0.5 per cent, that is $400,000 spread across a million barrels: forty cents a barrel. At the 1 per cent level the corridor has touched, about eighty cents. In the worst previous spike, after the Sounion strike in 2024, Red Sea add-ons hit 2 per cent — a dollar sixty on that cargo.

Those are real numbers and they are small. The Bab al-Mandab insurance leg is measured in tens of cents. Anyone telling you war-risk cover at the southern gate is what put Brent over $100 is selling something.

What is not small is Hormuz. Lloyd's List's David Osler puts the total war-risk contribution at roughly $7 to $8 on a barrel of crude across the whole conflict, with additional premiums for high-risk areas running as high as 10 per cent of a ship's value, and about $2 billion in claims across more than seventy cases since the fighting began. A $210 million tanker at those rates is paying multiples of the Red Sea figure, and the freight detour — around $7.70 a barrel on the reroute — dwarfs the insurance line in both theatres. For some voyages, once you stack diversion, war risk, financing, congestion, demurrage and idle time, a single passage clears $4 million in additional cost.

## Why the small number is the interesting one

Because it is the one that does not go away.

Freight rates fall when ships come back. Crude falls when a ceasefire holds. The notified zone is different: it is an administrative object, and administrative objects have inertia. The committee widened the perimeter in July. Nothing that has happened since — the pipeline strike, Mocha, Zuqar, the Yemeni side of the strait — argues for narrowing it. Every week that line stays where it is, the corridor carries a standing tax that no government levies, no parliament votes on, and no belligerent has to maintain with ordnance.

The traffic data shows the shape of it. Weekly transits through Bab al-Mandab averaged 273 between late July and late August against 319 in the run-up to the blockade, a 15 per cent decline — significant, orderly, and nothing like a closure. Ships are still going through. They are going through more expensively, and the expense is set in a room in London by people who will never see the water.

That is the part worth watching, and it is the part that will not be in any communiqué. A militia with fibreglass boats can make a corridor risky. Only an underwriting committee can make it dear.

There is a version of this week's energy story in which Egypt is the winner, and it is worth walking through carefully, because it is true in the narrow sense and false in every sense that matters to Cairo's balance of payments.

Start with the route. Iran's campaign shut Hormuz. Saudi Arabia responded by pushing exports across the peninsula through the East-West pipeline to Yanbu on the Red Sea. Then in July the Houthis declared a naval embargo on Saudi-serving shipping, which made exiting south through Bab al-Mandab unattractive for anything with a Saudi connection. So the cargo turned around.

Increasing volumes of Saudi crude now run north up the Red Sea to Ain Sukhna, come ashore, cross Egypt through the SuMed pipeline, and re-enter the water at Sidi Kerir on the Mediterranean. A detour built to avoid one chokepoint acquired a second detour to avoid the exit from the first. Egypt owns the pipe in the middle.

The tanker numbers show it. 283 crude tankers transited the Suez Canal in August, against 210 a year earlier. Crude tanker tonnage is running roughly 10 per cent below pre-Houthi-attack levels and 50 per cent above the same period last year. July canal income hit $505 million on 1,340 vessels, up 42 per cent year on year, the highest monthly figure since December 2023.

## Now the other column

Fiscal 2025/26 revenue came in at $4.67 billion, up 23 per cent. The Suez Canal Authority expects the calendar year to land between $5.8 and $6 billion, up from $4.1 billion in 2025.

The canal took $10.2 billion in 2023.

That is the number Cairo has to keep in its head. August traffic was still 39 per cent below pre-crisis levels by vessel count and 44 per cent below August 2023 in tonnage. Containership movements are up 35 per cent year on year and still 66 per cent below August 2023. Vehicle carriers are up 120 per cent and still 56 per cent down. The Lloyd's List Intelligence count for the last full week of August was 290 transits — the best in more than two years, and 36 per cent below normal.

So Egypt is recovering from a catastrophe by hosting a second catastrophe. The tanker business it is winning today exists because Saudi Arabia cannot use Hormuz and does not want to use Bab al-Mandab. The container business it lost in 2024 has not come back, because containers are the most risk-averse cargo afloat and their operators have four years of Cape of Good Hope routings already amortised into their networks. Maersk has kept more than thirty services on the Cape. Hapag-Lloyd has put a single 14,993-TEU box ship westbound through the Red Sea and called it a resumption.

## The trade

What Cairo is being paid for is proximity to a war. The SuMed volumes are contingent on exactly one condition — that shipping Saudi crude out of the bottom of the Red Sea remains unattractive — and that condition is set by a militia and a group of London underwriters, not by any Egyptian ministry.

When the war ends, the crude goes back through Hormuz and SuMed's windfall ends the same week. The containers do not automatically return, because they never left for military reasons alone; they left because the insurance and the schedule reliability made the long way round competitive, and 66 per cent of them have not found a reason to reverse that.

Egypt's foreign currency now depends on tourism, remittances, and a pipeline fee that is a direct function of somebody else's blockade. That is not a recovery. That is a hedge that pays out when your neighbours are on fire.

The interesting sentence is in the system card, and it is flat enough that most coverage walked past it: Claude Fable 5.1 and Claude Mythos 5.1 are "two configurations of a new large language model," and they share "identical model weights."

One artifact. Two names. Fable 5.1 is generally available, with safeguards that block tasks in high-risk dual-use domains — principally biology and cybersecurity. Mythos 5.1 relaxes those specific safeguards. It is invite-only, released the same day, distributed under the name Project Glasswing, and reachable through the same endpoints on the same clouds at the same price. The documentation is unambiguous about what separates them: "Claude Fable 5.1 doesn't require access approval. Claude Mythos 5.1 is available only to approved customers in Project Glasswing."

Approval runs through two vetting programs — a Life Sciences Verification Program, whose first participants were enrolled in partnership with the US government, and a Cyber Verification Program for defensive security work. Access is currently limited to a set of US organizations, with the company saying it is coordinating with the US government to extend it to further domestic and international partners.

## What actually changed

For twenty years the unit of technology policy has been the artifact. You controlled a chip, a machine tool, a compiler, a strain. The artifact had mass and a serial number and a customs code, and controlling it meant controlling something that had to physically move.

What shipped on 1 September is a control regime in which the artifact is constant and the control is a property of the requester. The weights on Bedrock and on Google Cloud and in Microsoft Foundry are the same weights. The capability delta exists in a policy layer and an access list. A life sciences lab in Boston that clears vetting gets a model that will help with work the identical model refuses to a lab in Lisbon that has not been offered the form.

This is a much better instrument than the old one in almost every operational respect. It is granular, it is revocable, it degrades gracefully, it can be tuned per domain, and the company reports that the newer biology safeguards fire 85 per cent less often on benign life-sciences queries than their predecessors — which is the sort of false-positive reduction that made the tiering worth doing in the first place. A blunt refusal that blocks a thousand vaccine researchers to stop one bad actor is a bad trade, and this is the engineering answer to it.

It also relocates something. The question "what can this model do" no longer has a single answer, and the answer it does have is not held by the people who built the model or by the people using it. It is held in an enrollment decision, made jointly by a company and a government, about an organization.

## Two details for the file

First: Mythos 5.1's capabilities also power Claude Security, a vulnerability-scanning product available to all Claude Enterprise customers. So the more permissive configuration is already reaching a wide commercial population, packaged as a product rather than as a model. The gate is on the raw interface, not on the capability's commercial availability.

Second, and this one is almost funny: the knowledge cutoff for both configurations is June 2026. Neither the vetted model nor the public one knows that Hormuz is throttled, that the East-West pipeline is down, that the Houthis hold the Yemeni side of Bab al-Mandab, or that diesel is $6.05. The most carefully gated artifact in American technology policy this month is, on the subject of this month, uninformed.

That is not a flaw in the gating. It is a reminder of what the gate is protecting. It is not protecting a mind that knows things. It is protecting a capacity — and capacity, unlike knowledge, does not go stale while the approval queue moves.

The national average price of diesel hit $6.05 a gallon on Friday morning, the first time it has ever crossed six dollars, according to AAA. It was $5.85 a week earlier and $3.71 a year ago — a 63 per cent increase. Regular gasoline averaged $4.29, up fifteen cents on the week, after setting a Labor Day record of $4.15.

Since the war with Iran began in late February, when diesel sat near $3.76, the price has risen about 60 per cent.

Asked about it en route to Dallas, the President said: "I think it's going to take a little bit longer than the midterms" for prices to come down. "Right after the election, oil prices are going to be tumbling downward."

That is a date. It is not a mechanism, and the distinction is the only thing worth arguing about, because every physical constraint currently setting the price is indifferent to the American electoral calendar.

## The constraints, in order

Crude is the first. Brent touched $100.72 on Wednesday, its first move above $100 since July, and US crude has gained roughly 20 per cent in September alone. That is the Gulf: Hormuz throttled, the Saudi East-West pipeline shut after Thursday's drone strike, Houthi forces now holding the Yemeni side of Bab al-Mandab.

The second is refining, and it is why diesel is running ahead of gasoline rather than alongside it. Ukraine struck Russian refineries at least twenty-one times in August, the highest monthly count of the war. Russian refining fell to just over 3.8 million barrels a day, a two-decade low, and Moscow banned diesel exports. That is distillate removed from the world market, and distillate is the tight barrel.

The third is domestic and it is the one with no policy lever attached at all. American refineries are running at 98 per cent utilisation. "There is just no spare capacity," as RBC's Helima Croft put it. A refinery at 98 per cent cannot be talked up to 104.

None of those three resolves on 3 November. Two of them are functions of wars, and the third is a function of steel.

## Who is actually paying

Diesel is not a consumer product in the way gasoline is. It is an input. It moves nearly everything that is moved in this country, which means the $6.05 does not arrive at most households as a pump price. It arrives weeks later inside the cost of a box of cereal, a course of antibiotics, a delivered sofa.

GasBuddy's Patrick De Haan calls it a "silent killer" for the economy and estimates Americans are spending about $700 million more per day on gas and diesel than a year ago. Gasoline prices, he notes, have never been this high this late in a year.

The inflation-adjusted comparison is the one the administration will reach for, and it is legitimate as far as it goes: 2022's $5.82 record would be about $6.56 in today's money, and the pre-2008 peak of $4.74 works out to roughly $7.20. By that measure diesel is expensive rather than unprecedented.

It is also true that the people hauling freight and planting fields do not settle their fuel bills in inflation-adjusted dollars. They pay $6.05, and the surcharge that is supposed to reimburse the owner-operator runs on last week's index, which is the mechanism by which a rising price becomes an uncompensated one.

The August CPI print came in at 3.4 per cent headline, driven by an energy index up 16.3 per cent on the year. Core sits at 2.4 per cent. The Fed meets Tuesday and Wednesday.

If you drive for a living, or buy fuel by the tankful for a farm or a fleet, write and tell us what your last fill cost and what you have stopped doing to cover it. We will print the numbers.

Every major festival has a personality it sells. Cannes sells the jury — thirteen days of elite taste, delivered by people whose names are on the poster. Sundance sells discovery. Berlin sells politics. Toronto, uniquely, sells you.

The People's Choice Award, launched in 1978, is voted by the audience, and the reason distributors care is that the audience has been right with a frequency that embarrasses professional critics. *Chariots of Fire*. *The Princess Bride*. *Slumdog Millionaire*. Most recently Chloé Zhao's *Hamnet*, which ran from a Toronto crowd vote to Jessie Buckley's Best Actress win at this year's Academy Awards. That is the whole brand: a city full of ordinary ticket-holders as the most reliable early indicator in the awards calendar.

This year, the fifty-first edition — running 10 to 20 September, 293 feature films, 45 shorts, 32 premieres — launched TIFF: The Market at the Metro Toronto Convention Centre, with new venues including the John Bassett Theatre folded into the footprint.

A market is a room where rights are sold. Cannes has had one since forever; the Marché du Film is arguably the actual Cannes and the red carpet is its lobby. Berlin has the EFM. Toronto spent five decades conspicuously not having one, and the absence was the point: the deals happened anyway, in hotel bars and screening rooms, downstream of what a paying audience in a 2,000-seat hall did with a film at ten in the evening.

Building the market is not a scandal. It is an admission, and admissions are more interesting than scandals.

## What the admission says

It says the audience signal has stopped being sufficient collateral.

A People's Choice win used to be a financial instrument. It converted a crowd reaction into a distribution bet, an awards campaign, a P&A budget. That conversion assumed a distribution business with enough buyers, enough theatrical slots, and enough patience to underwrite a film on the strength of one enthusiastic Sunday. Fewer of those conditions hold each year. When the conversion gets less reliable, a festival that has only the signal and not the counter has to build the counter.

The opening night selection is a good tell in the other direction. Siân Heder's *Being Heumann*, with Ruth Madeley as the disability rights organiser Judith Heumann, is precisely the film Toronto's audience-first identity exists to launch: a biographical drama with no built-in genre audience and everything to gain from a thousand people standing up at Roy Thomson Hall. Meanwhile Midnight Madness opens with a slasher, closes with Duncan Jones's *Rogue Trooper*, and hosts Anna Biller's long-delayed follow-up to *The Love Witch*. The galas carry Anton Corbijn, John Madden, Chris Rock, Hur Jin-ho and Tim Blake Nelson.

That is a healthy, catholic, genuinely well-curated program. It is also a program that now runs alongside a floor where the actual outcomes are decided by people with term sheets rather than ballots.

Awards are announced the morning of Sunday 20 September, livestreamed. The crowd will still pick something. I will still care what it picks. But the honest thing to notice is that for the first time in Toronto's history, the crowd's verdict has a competitor in the same building, and the competitor has better coffee and worse taste.

The word everyone reached for on Friday was *failure*. Iraq failed to secure its territory. Yemen's government failed to hold its coast. Lebanon failed, Libya failed, Somalia failed years ago and is used mainly as an adjective now.

The word is wrong, and its wrongness is load-bearing, because it lets the rest of us describe a structural arrangement as somebody else's shortcoming.

Consider what Baghdad actually did this week. Drones launched from Maysan disabled Saudi Arabia's last functioning export route. Iraq confirmed the origin, sacked its operations commander in the province, and opened an investigation. Saudi Arabia declined to retaliate and offered to support Iraq's efforts to prevent future launches.

That is not a failure. That is a performance, executed competently by all parties, of a script everyone knows. Iraq's assigned role is to remain a valid postal address: sufficiently a state that there is somebody to telephone and somebody whose foreign ministry can be thanked, not so much a state that anyone is obliged to find out who in Maysan has the launchers and what happens if Baghdad is ordered to go and take them.

The technical term for an entity that holds title to an asset it does not operate is a lessor. Iraq holds title to Maysan. Someone else operates it. And the international system, which has spent eighty years insisting that sovereignty is indivisible, has quietly become extremely comfortable with a sovereignty that is split between a nameplate and a switch — because the split is load-bearing for everyone.

It is load-bearing for Iran, which gets effect without attribution. It is load-bearing for Saudi Arabia, which gets an off-ramp from a retaliation it cannot afford. It is load-bearing for Washington, which can continue to have an Iraq policy. It was load-bearing in New Delhi this weekend, where eleven governments affirmed "the sovereignty and territorial integrity of the States" in a document that named no state, because naming one would have required someone to say which of the sovereignties in the room was currently being operated by a tenant.

This is not the fashionable anti-Westphalian point. The lease is not a decline from some earlier era of real sovereignty; that era was mostly empire in a better suit. It is a genuine innovation, and it is stable, and the stability is the problem. Stable arrangements do not get renegotiated. They get extended.

What it produces is an inventory of places with all the ceremonial properties of statehood — flags, seats, ambassadors, the right to be respected in paragraph 47 — and none of the operational ones. It produces the situation in which Yemen's government loses its entire Red Sea coast in a week while its principal ally's aircraft do not come, and the response is to argue about whose intelligence was wrong rather than to ask what that government was ever the government of.

And it produces a world in which nobody is liable. A sovereign that cannot control its territory also cannot be held responsible for what departs from it — and a sovereign that is not responsible cannot be deterred. Deterrence requires an addressee who can comply. We have built an order full of addressees who can only apologise.

Saudi Arabia understood this on Friday better than any commentator. It did not demand that Iraq control Maysan, because it knows Iraq cannot, and a demand that cannot be met is just a countdown. It asked for a commander's job and a phone call and it took the loss.

That is not weakness. It is an accurate reading of the lease. What should worry you is that the accurate reading is now the sophisticated position — that the grown-up move, the one the serious people applaud, is to accept that the map is a courtesy.

I have no better order to propose this morning. I have a request: stop saying *failed*. Say *leased*. Then ask who the tenant is, who collects, and what happens at the end of the term. Those questions have answers. *Failure* has none, which is why we keep using it.

I want to be clear about my position before I complain, because the complaint is easy to mistake for the opposite argument.

Tiering access to dual-use capability by verified user is correct. A single global refusal policy calibrated to stop the worst actor necessarily blocks tens of thousands of legitimate researchers, and the record of blunt refusals in biology has been embarrassing — models declining to discuss vaccine adjuvants with vaccinologists, which is not safety, it is theatre with a compliance budget. The reported 85 per cent reduction in safeguard activations on benign life-sciences queries fixes a real problem. If you had to design this, you would design roughly this.

So: good instrument. Now look at what kind of instrument it is.

Since the Coordinating Committee days, export control has had a physical premise. The controlled thing was a thing: mass, a serial number, a tariff heading, a port of exit. Control meant a licence, an end-use certificate, and a customs officer who could in principle open the crate. That premise generated everything else — statutory authority, published control lists, appeals, allied harmonisation, and the slow grinding accountability of a system whose decisions leave paper.

Project Glasswing has no crate. The weights for the permissive configuration and the restricted one are identical, shipped the same day, priced the same, served from the same clouds. What distinguishes a user who can do dual-use biology work from one who cannot is an enrollment record — created through a verification program whose first participants were enrolled in partnership with the US government, currently available to a set of US organizations, with expansion described as a matter of coordination with that government.

Think about the properties of that control surface compared with the old one.

It is instantaneous. A licence takes months; a row takes milliseconds. It is silent — there is no manifest, no port call, nothing a journalist can count. It is perfectly revocable, which is a genuine safety virtue and also means access can be withdrawn from an institution, a sector or a country between one request and the next, with no notice period and no forum. It is unappealable in any sense a lawyer would recognise; the published route is to contact your account team. And it is geographically tiered by default, which means the operative unit of technology policy has quietly become nationality plus paperwork.

None of that is a scandal. All of it is new, and almost none of it has been legislated.

The genuinely unresolved part is who can see the frontier. For thirty years the argument for open scientific exchange rested on a claim that surveillance beats secrecy: if a dangerous capability exists, you want the maximum number of competent, non-malicious people looking at it. The verification programs invert that deliberately. The permissive configuration goes to vetted defenders; everyone else — including every competent researcher in every country not yet coordinated with — gets the constrained one. The bet is that concentrated defender advantage exceeds the inspection loss.

That may well be the right bet. It has not been argued in public, and it cannot be evaluated from outside, because the list of who is on the list is not published.

One more thing worth sitting with. The capabilities of the restricted configuration already reach a wide commercial population, repackaged as a security product available to all enterprise customers of the vendor. So the gate is on the raw model, not on the capability's distribution. The frontier is not being withheld. It is being sold through a different door, with an interface in front of it.

That is a policy. It is a defensible policy. It was set by a company, in consultation with one government, and announced in a blog post.

Somebody who is not a company and not that government should have a view. Not to overturn it — to write it down, so that the next revision is something other than a documentation update.