The Mechanism of Manipulation: A Theory of Dynamically-Stabilized Certainty Traps, Predatory Ambiguity, Meta-Communication Suppression, and Cumulative Vulnerability

This paper develops a theory of post-action evaluation control against adaptive learners. The setting is a repeated principal–agent interaction in which a strategic Sender selects an evaluative frame after observing the Receiver's action — a structure that captures discretionary subjective performance review, opaque platform moderation, algorithmic reward shaping, preference labeling in RLHF, and other institutions where the map from action to experienced payoff is itself a strategic object. The Receiver is modeled as an adaptive non-Bayesian learner (primarily a tabular bandit Q-learner, with extensions to linear function approximation and pairwise preference learning), and the running illustration is a creator on a platform whose proprietary "quality score" is assigned only after posting. The motivating gap is that canonical influence models — signaling, cheap talk, Bayesian persuasion — all study pre-action communication while holding the action-to-payoff map fixed; here that map is what the Sender controls. The central object is a dynamically-stabilized certainty trap (DSCT): a stable regime in which the Sender pins the Receiver's learned engagement value at the outside-option indifference point, so that engagement persists with positive frequency even as systematic surplus is extracted. The implementability theorem reduces stabilization to a convex-reachability condition via drift cancellation: by mixing frames the Sender sets the conditional expected prediction error to zero at the target, and stabilization is feasible if and only if the indifference target lies in the closed convex hull of Receiver rewards reachable under feasible frame mixtures. The Sender's payoff-maximizing stabilizer solves a linear program; with a single mean-stabilization constraint, an optimal stabilizer can be chosen to randomize over at most two frames (a bang-bang result), and additional binding linear constraints expand the support in a sharply bounded way. With switching costs, a shrinking-band hysteresis policy prevents chattering while preserving convergence and drives long-run average switching costs to zero. Several structural extensions locate the result within a broader landscape. Partial regulation of feasibility — removing interior frames while preserving extremes — can strictly reduce risk-averse Receiver welfare by forcing bang-bang variance inflation, even though Sender extraction is weakly lower; the support bound is a hazard, not a blessing, for the regulated. The DSCT is robustly implementable against Q-learners but not robustly implementable against Bayesian Receivers with correct priors, since at exact indifference a Bayesian best response is indeterminate and arbitrary small payoff perturbations flip it to exit; this learning wedge is the formal falsifier — manipulation via post-action frame control is distinctively powerful against adaptive, not Bayesian, agents. Under linear Q-learning, drift cancellation couples across actions through the feature map and produces a sharp identifiability-failure corollary when feature supports overlap. When feasibility varies with an exogenous ergodic state, reachability generalizes to a Minkowski average weighted by the stationary distribution. In the RLHF extension, a strategic labeler with feasibility constraints over pairwise queries can induce DSCT in a Bradley–Terry-learned linear reward, yielding a non-identification result for preference-based reward learning under strategic labeling. The final three extensions reconnect the mechanism-design theory to the published Bateson Game (Fathi 2025). The ambiguity trap is formalized as the non-stationary counterpart to DSCT: the Sender keeps the Receiver inside an indifference-persistence band while forcing non-convergence of the engagement Q-value. For a two-threshold band-cycle class, implementability is governed by the diameter of the reachable set inside the persistence band, threshold-crossing times have logarithmic closed forms, and the Sender's optimal destabilizing cycle is solved explicitly. Adding a Question action with payoff qq − κq restores Bateson's tertiary injunction; question suppression is endogenous under Q-learning and occurs only above a strictly positive learner-specific threshold κq* = qq − q^† + Δq, whereas the Bayesian suppression cliff sits at κq = 0 — a learning-theoretic wedge with institutional consequences for penalty windows. Finally, the indifference-persistence parameter is promoted from a fixed primitive to a slow stochastic-approximation state driven by cumulative prediction-error variance: under persistent DSCT or ambiguity-trap exposure, vulnerability is non-decreasing and the behaviorally implementable target set expands monotonically, so prior exposure compounds exploitability. Exit freezes vulnerability; reduction requires an exogenous reset of the Receiver's (θ, Q) state, since the vulnerability recursion has no negative drift. Numerical verification corroborates each claim, and a closing policy section discusses safeguards for platform governance, meta-communication channels, cumulative-vulnerability reset interventions, and AI systems trained from feedback. The scope is stated explicitly: the cumulative-vulnerability recursion is a stylized structural model rather than an empirically calibrated clinical law, and the full characterization of arbitrary history-dependent ambiguity-trap policies is left open.