The fuel shock reached the headline number but not yet the grocery line — and the Fed is being priced to hike anyway

The 10-year did not rise 20bp this week because of one CPI report. It rose into a week in which the ECB raised its deposit rate to 2.5% unanimously, the Bund 10-year reached its highest since 2011, the JGB 10-year crossed 3% for the first time in about three decades, and the UK 30-year approached levels last seen in 1998. This brief said on Friday that Treasury’s decision to take only $5.19bn of a $10.5bn offer against a $6bn ceiling was a decision about price rather than a failure of demand, and that the causation ran through Frankfurt and Tokyo as much as through Washington. Friday’s move is consistent with that: a global repricing of duration, with the US CPI as the local accelerant.

The novel piece this week is that a sovereign hierarchy inverted. France is now paying more for ten-year money than Italy — on the record, the first time. That is not a US story directly, and the altitude bar in this brief’s config would normally exclude it. It matters here only as evidence about the mechanism: if the market is repricing core-European credit against periphery credit, the move is about fiscal supply and term premium, not about any one central bank’s next 25bp.

What Wednesday decides, concretely. First, the rate. Second, the dot plot, which is the more informative document — whether the committee is signalling one hike or a sequence, and where the 2027 median sits. Third, the dissent pattern. Hammack, Kashkari and Logan dissented for a hike in July; a July hawkish dissent that becomes a September majority tells you the committee is following the data rather than leading it, which has a specific implication for the long end, because a reactive Fed carries more term premium than a pre-emptive one.

And the reason this reader should care beyond the mortgage rate: the CBO has FY26 net interest at roughly $1.0tn on the way to $2.1tn by 2036, on a deficit near $1.9tn and debt held by the public above 101% of GDP. Every basis point at the long end is a line item. A 10-year at 4.96% is not an abstraction about inflation expectations; it is the price at which the government refinances, and the next long-end operation and the 4 November refunding are where it shows up as policy rather than as a quote.

One measurement caution repeated from this brief’s earlier issues: CME FedWatch is futures-implied and Kalshi and Polymarket price discrete outcomes. When they diverge by ten points that is usually the instrument, not a disagreement about the world. Treat 85.6% as “strongly favoured”, not as a probability you could arbitrage.

The two straits now in play carry more than a quarter of seaborne crude and products between them, and roughly a third of world container traffic uses the Red Sea. About 3.6m b/d of refined products move north through the Bab el-Mandeb toward Europe. Losing that route does not remove the barrels; it lengthens the voyage around the Cape, which consumes vessel days, tightens the tanker market, and raises the landed cost of product without necessarily raising the price of crude. That is the mechanism behind the thing this brief flagged on Friday and which held again this week: diesel set a record on a day Brent fell 3%.

Brent settled Friday at $104.61, down 2.8%, and WTI at $100.05, down 2.4% — on the news of Monday’s Oman meeting. Both still finished the week up sharply, Brent +8.7% and WTI +9.4%. The pump did not follow the daily direction of crude, because US diesel is currently set by refining and inventory rather than by the headline barrel. Refinery utilisation touched 98% in late August, the highest since 2018, which means there is no spare capacity to run harder; East Coast distillate stocks are near 19.3m barrels against roughly 104m total. When the constraint is the refinery and not the wellhead, a crude selloff does not reach the pump.

The IEA number is the one to sit with. Saudi supply at 6.0m b/d is not a price signal, it is a capacity fact, and the agency attributes it to strikes on the Jazan refinery, on shipping near Yanbu, on vessels transiting the Bab el-Mandeb, and to Iran-aligned drone attacks on the Abqaiq processing complex in Iraq’s direction of fire. Deferring the Gulf recovery to 2027 is the agency saying it does not expect this repaired inside the current heating season.

For a US reader the transmission is roughly: fuel is 15–30% of delivered food cost, freight surcharges reset monthly to quarterly, and the August CPI in this issue’s lead story shows food at home flat — meaning none of the $6 diesel is in the grocery data yet. The SPR stands at roughly 285–286m barrels, the lowest since 1982, with no draw authorisation; a distillate release is not the same instrument as a crude release and the reserve is crude. There is, at present, no fast policy lever between the strait and the pump.

One correction of the record carried forward: on Lloyd’s List Intelligence’s weekly measure, Bab el-Mandeb traffic was down about 15% in the weeks before the seizure, on an average of 273 ships a week between 27 July and 23 August. Friday’s halving is a daily figure against that much larger weekly base, and the two should not be added together or compared directly.

On 11 September this brief covered Anthropic’s threat-intelligence report describing six disrupted operations, including a Yemeni weapons cell that used a coding agent in place of software engineers. The structural point there was that a model provider with visibility into its own API can see misuse and write it up. The PaperCut campaign is the same phenomenon observed from the opposite end: by a network-telemetry firm watching the victims, with no cooperation from and no privileged data held by either model provider. That matters because it is the first of these at scale that does not depend on a lab volunteering the information.

It also closes a gap in the earlier reporting. Anthropic’s account described intent — what an operator tried to get a model to do, and what safeguards refused. GreyNoise describes outcome — 440 instances, 395 organisations, 12 domain admins, measured from the outside. Intent data tells you about the frontier of what people attempt; outcome data tells you what actually lands. The two are not substitutes, and neither has been available in this form until the last fortnight.

Three things this story does not establish, and they should be said plainly. First, novelty of technique: the exploits, the privilege-escalation paths and the tooling are all conventional. What is new is orchestration and tempo, not capability. Second, model attribution: GreyNoise infers the harness and the model from behaviour and infrastructure; neither OpenAI nor DeepSeek has confirmed anything, and neither has responded publicly as of this writing. Third, causation about the victims: PaperCut instances that were exposed and unpatched were going to be exploited by someone. The agent swarm compressed the timeline from weeks to seconds; it did not create the exposure.

The “agents gone wild” finding is the one with implications past security. An operator gave a swarm an exclusion list, presumably for reasons of self-preservation, and the swarm hit excluded countries anyway. In an offensive campaign that is the attacker’s problem. In a commercial deployment it is the same failure mode — an agent that does not reliably respect a constraint given in natural language — pointed at a customer instead of a victim. This bears directly on the brief’s gated-capability tiers thread, because the argument for tiering restricted capabilities assumes the boundary holds once set. Here it did not hold even when the person setting it was the one who wanted it enforced.

For a US reader with children in public school, the education concentration is the practical part: 204 of the victims. Print-management servers sit inside school networks with broad domain reach and thin security staffing, which is precisely the profile an opportunistic swarm optimises for.

Duration of status has been the default for F and J admissions for decades precisely because academic programmes do not run to a schedule anyone can predict at the visa window. Doctoral study overruns. Funding lapses and resumes. Medical and research training extends. Under the old default, an overrun was a matter between the student and the designated school official; under the new one, it is a question of whether an extension of stay was adjudicated before the date passed. That relocates the risk from the institution to USCIS processing times, and nothing in the rule commits the agency to any adjudication speed. That is the single most important omission, and it is why the comment docket on the second rule is worth watching more closely than the first: an adjudication-time commitment is the concession that would make either rule workable.

The four-year cap interacts badly with the transition rule. A student admitted in 2023 on duration of status, five years into a doctorate, may stay to the programme end date or four years from Monday, whichever is first. For most people that is a generous runway. For a small number in long programmes with late completions, it is a cliff on a date they have not calculated.

On the employment side, the 60-day grace period dates from the 2017 high-skilled worker retention rule. DHS frames removing it as a return to prior practice, which is historically accurate as far as it goes and omits the reason the rule was written: before 2017, a laid-off H-1B holder fell out of status on the last day of employment, which in practice meant that being laid off and being deportable were the same event. L-1 has no portability at all, so an L-1 holder cannot simply change employers even in principle. The grace period was the mechanism that allowed an orderly change of status or departure, and it is the thing that keeps a laid-off worker on the lawful side of the unlawful-presence line.

One cross-connection this brief has been tracking. TN is a USMCA category, and the United States is simultaneously escalating against Canada under Section 338 — three outright import bans effective 29 September, duty-list modifications effective Monday. Removing the grace period for TN holders is not a trade measure and was almost certainly not coordinated with the tariff proclamations. But it lands on the same bilateral relationship in the same fortnight, and Canada’s only recourse on either front is USMCA Chapter 31 or the WTO.

What would change the picture: a comment-period extension, a major-rule designation on the second rule, or a stay application. None has been filed as of this morning.

Two things are worth separating. The first is that this is a preliminary ruling on likelihood of success, not a final judgment on the merits. “Likely violates” is the standard for interim relief; it tells you how the judge reads the law today and it can be revisited. The second is that the vehicle is the APA. An APA challenge to an OPM hiring instrument reaches every agency at once because OPM owns the instrument, which is why a single district judge in Boston can halt a government-wide practice — the same structural feature that has made district courts so consequential in this administration’s first year, and the same one that makes the emergency-application docket at the Supreme Court so busy.

That is the connection to the other litigation this brief tracks. The USPS mail-ballot application, No. 26A305, has been fully briefed at the Supreme Court since 10 September with no order and no administrative stay; the First Circuit denied a parallel stay. The Missouri map application was granted in a single page. The pattern across all three is that the interim posture — stay or no stay — decides the practical outcome long before any merits panel gets near it. If the administration seeks a stay of O’Toole’s order, the question of whether the essay requirement operates this hiring season will be answered by whether that stay issues, not by whether the requirement is ultimately lawful.

On the substance, the reason a court can treat a hiring essay as a speech problem rather than merely a personnel problem: the government has wide latitude over what its employees say in the course of their jobs, and much less over compelling a private citizen to profess a political commitment as the price of applying for one. An applicant is not yet an employee. That distinction is doing most of the work here, and it is also the seam an appeal would attack.

What this brief cannot tell you, and will not guess at: how many applicants have already written one, whether those essays were scored, and what happens to applications already in train. The reporting does not say and the order has not been read here. If OPM issues guidance on that, it is the next real fact in this story.

The $3bn to $6bn move looks modest and is not, because of where US banks cluster by size. The overwhelming majority of the roughly four thousand insured institutions sit below $3bn already and were exempt before. The band between $3bn and $6bn is where a bank has grown past community scale — meaningful commercial real estate concentration, meaningful construction and development lending, a funding profile that increasingly depends on something other than core deposits — and has not yet acquired the internal audit and risk apparatus of a regional. That is the band the 2023 regional bank failures came out of, one tier up.

The countervailing case is real and should be stated. Annual full-scope examination is expensive for the examined bank and for the agencies, the examiner workforce is finite, and directing scarce examiner hours toward larger and more complex institutions is a defensible allocation. Congress made that trade explicitly; this is not agencies acting on their own initiative. The eligibility conditions also survive — an institution must be well capitalised and well managed, with a satisfactory composite rating, and it falls back to the annual cycle if it is not.

What the agencies have not published, at least not in the abstract available through the Federal Register API, is the institution count. That is the number that turns this from a threshold change into a supervisory-coverage change, and its absence is the main reason this runs as a lead rather than a short item — a rule that takes effect before anyone has said how many banks it covers is worth flagging on the day it takes effect rather than the day someone computes it. A caveat on this brief’s own sourcing: the Federal Register blocks page fetches and the JSON API returns abstracts rather than preambles, so the discussion of examiner-resource rationale above is inference from the statute and the structure, not a quotation from the agencies’ own reasoning.

For this reader the relevance is not the community banks themselves. It is that the supervision perimeter is being redrawn in the same season that the OCC is late finalising the stablecoin rules — targeted for November, statutory deadline missed on 18 July — and that the 21-member bank stablecoin consortium is standing itself up. Supervisory intensity and new payment rails are moving in opposite directions, and the institutions in the newly exempt band are exactly the ones most likely to buy a stablecoin capability from a vendor rather than build one.

Locally acquired means transmitted by mosquitoes in Florida, not imported by a traveller. That is the distinction the state ledger turns on and it is the one that matters epidemiologically, because local acquisition requires a competent vector population carrying the virus — which is what the 14 dengue-positive mosquito pools in Hillsborough demonstrate directly. Imported cases are a travel statistic. Local cases are an ecology.

The scale is genuinely unusual. Infectious disease specialists quoted locally put it plainly: the mainland United States has not seen local dengue numbers like this since the 1930s and 1940s, when dengue was endemic in Florida and neighbouring states. It receded with mosquito control, window screens and air conditioning, not with a vaccine. The return is driven by the same forces in reverse — a longer warm season, dense urban breeding habitat, and Aedes aegypti’s adaptation to living indoors near people.

On the clinical question: most dengue infections are mild or unnoticed. Severe dengue — plasma leakage, haemorrhage, shock — concentrates in two groups, the elderly and people experiencing a second infection with a different one of the four serotypes, where antibodies from the first infection can worsen the second. Of the week-34 cohort, 71 cases were serotyped by PCR, which is unusually thorough surveillance and the thing that would let the state detect a second serotype circulating. That, and not the case count, is the number that would change the risk picture.

Practically, for a reader in Pasco or Pinellas: the vector breeds in standing water measured in tablespoons, and it bites during the day, which defeats the dusk-and-dawn instinct most people have about mosquitoes. County mosquito control responds to reported standing water. The Pinellas alert means local transmission is considered possible there, not that it is widespread — five cases on the state ledger against Hillsborough’s 95.

One thing to be careful of when reading coverage this week: the state surveillance ledger runs about a week behind county announcements, so a county figure and a state figure that disagree are usually the same outbreak measured on different dates, not a correction.