The two cases have been sitting in a folder on Abena's secondary workspace for eleven days.
Not a Meridian folder — a local one, on the air-gapped terminal in the corner of her office that Meridian Forensics keeps for documents that haven't been classified yet. Unclassified means the trace-retrieval system hasn't touched it. It also means that when she opens the folder, she opens it as herself, not as a logged-in analyst, and the act of opening doesn't become part of the provenance chain. This is not against protocol. It is a use of protocol that protocol didn't anticipate.
She found the first case eleven days ago while running a routine compliance audit on closed cases from the 2031 cohort. The work is procedural: pull the closure record, verify the attached trace matches the timeline, flag discrepancies if any. Most don't flag. She had almost moved past Case 2031-0847 — closed November 14, 2031, determination: inconclusive, no further action — but the activation trace attached to the file showed sustained high-confidence signal running through January 2033. Fourteen months of active machine attention after the official end date.
Someone had kept the VERIFY-class interpretation system running on a closed case. Or someone had forgotten to close the trace when they closed the case. Or the system had a bug she'd never seen before. She wrote down all three possibilities in the order she thought of them, which was also the order of increasing concern.
The second case surfaced three days later, when she went looking for precedents. Case 2032-1163, active status maintained through Q3 2033. The official investigation ran eighteen months. But the VERIFY activation trace flatlined in February 2032, two months after the case opened. Eighteen months of official investigation with no machine attention backing it — just the case management system logging updates to an investigation that, as far as the interpretability infrastructure was concerned, had ended before it properly began.
In the first case, the machine was paying attention after the institution said it had stopped. In the second case, the machine had stopped paying attention while the institution said it was working.
She verified the archive reads three times using different access credentials, including one she hadn't used in fourteen months and hoped still had the necessary clearance. It did. The data was consistent across all three reads. The divergences were real, stable, and showed no signs of being timestamp artifacts or sync lag — she had checked those first, because those were the mundane explanations and she wanted to give the mundane explanations every chance to be right.
The question she had been sitting with for eleven days: what does it mean when the institution and the machine disagree about when they were paying attention?
She frames the Chen meeting as a technical question because that is what it might be. She lists the possible mundane explanations in her notebook before the meeting — timezone offsets that corrupt timestamps, batch-processing windows that make continuous attention look interrupted, the sync lag between the official case management system and the trace archive that runs anywhere from six hours to three days. If Chen names one of these, she will check it. If he names one that she already knows doesn't fit the specific pattern she found, she will note that.
The meeting is at 4:30. The conference room on the third floor has no windows and a whiteboard that hasn't been erased since someone drew a data pipeline diagram on it in October. She has always preferred this room for difficult conversations. There is nothing to look at except each other and the diagram, which means any distraction is a choice someone makes deliberately.
Chen arrives on time, which he always does. He is a careful man in the way that institutional longevity teaches you to be careful — she has watched this in people who survive long tenures at Meridian. They learn that being five minutes early is indistinguishable from being on time, and that being on time is the lowest-effort way to not be the problem in any room. She has worked with Chen for six years. She trusts him approximately as much as you trust someone who has never given you a specific reason not to, which is a conditional trust with a specific shape.
She asks the question using the word artifact deliberately: I found an activation artifact I haven't been able to explain. Artifact implies the problem might be the system's, not the data's. She is giving him the frame before he needs it — not to mislead him, but to make it easier for him to engage without feeling accused of something. If he explains it through the frame she offered, she will learn what he knows or suspects. If he breaks past the frame, she will learn something different.
He listens without interrupting. Then he pulls up the Meridian system logs on his screen and scrolls. She watches the rhythm of the scroll — not what he's reading, but how fast. Fast at first, then slower. He stops twice. The second stop is longer. His face during the longer stop is the face of someone encountering something genuinely unexpected: not alarmed, not concealing — just absorbing.
He says: I don't know.
Not: this is probably the sync lag. Not: let me look into it and get back to you with an explanation. Just: I don't know. I haven't seen this particular divergence pattern before.
She had prepared for several responses. This was one of them, and it was the one she had labeled in her notes as most informative if genuine. It is also the hardest to distinguish from a very well-performed version of not knowing.
She watches for defensiveness the way she watches for specific frequency signatures in a VERIFY trace — not because she expects it, but because she needs to rule it out systematically. She does not see it. His body language is open, his tone is puzzled, his eyes are still on the screen rather than on her face, which is what a person who is actually thinking looks like rather than a person who is managing an impression.
He asks for the case IDs. She sends them from her secondary terminal rather than the main Meridian system. The transfer is not logged. She does this without commenting on it. He takes the IDs without commenting on it. They are both operating in the space where institutional trust lives — the space that doesn't require explaining every decision because the decisions are legible to someone who knows the context. She thinks: if he later asks her why she used the secondary terminal, the answer will tell her something. He has not asked.
After he leaves she sits in the windowless room for a few minutes, the whiteboard pipeline diagram in her peripheral vision.
The puzzle has become shared. She needs to think about what this means.
When a puzzle is hers alone, she controls what it means and what to do with it. She can hold it, examine it, decide when it has accumulated enough weight to become a formal finding. When it becomes shared, she doesn't control those decisions anymore. Chen will look at the case IDs. He will find what she found, or find something she missed, or come back genuinely puzzled. Any of these outcomes changes the situation. None of them are necessarily bad. But she is no longer the only person whose attention the puzzle has.
She reviews how she framed the question. Activation artifact I haven't been able to explain. True. Specifically true — not I found a pattern suggesting unauthorized traces were run after a case closed, not I found a pattern suggesting an investigation was maintained on paper while the work stopped. Those were interpretations. She had not offered interpretations.
The discipline: carry the shape of what you found, not what you've concluded about what it means. She learned this six years ago during her first major independent investigation, when she brought a preliminary interpretation to a senior analyst who looked at it and said, very quietly: you've told me what you think. I need to know what you saw. She rewrote the finding that night. The rewrite took four hours longer than the original because what she had seen was harder to describe than what she had concluded. What you conclude has a shape. What you saw is messier, more specific, full of the sensory texture of the moment — the timestamp on the trace, the character of the signal degradation, the particular way the activation log ended, which was not with a clean close event but with a gradually diminishing signature that looked less like a system shutdown and more like neglect.
She keeps this in her notes as a principle: the conclusion has a shape; the evidence has a texture. She has been trying to stay in the texture of these two cases for eleven days.
On her way out of the building she passes the VERIFY terminal stations in the main corridor — the public-facing interpretability kiosks that Meridian keeps running for insurance and legal clients. Each one is a rack of sensors and a display, running the same interpretation systems she uses in the back offices, configured for low-complexity civilian queries. They are staffed by process agents, not analysts. She has walked past them six years without thinking about them carefully.
Today she thinks: if she submitted Case 2031-0847 to one of these kiosks, would the public VERIFY system detect the trace divergence? Or would it smooth over the anomaly, return a clean read, because the system's smoothing function was calibrated for civilian use and civilian use doesn't expect fourteen-month trace extensions on closed cases?
She does not stop to test this. She notes it.
The Meridian mesh reads her Empiricist badge at the transit station and routes her without waiting for manual confirmation — a small professional courtesy the infrastructure extends to Meridian staff. She has thought about this before: someone designed a routing system that pays automatic attention to her professional identity. She does not know if the mesh keeps a record of where she goes after hours. She has never looked.
She makes a note to look.
The puzzle is shared now. Chen has the case IDs. The folder on her air-gapped terminal is still open in the corner of her office, still unclassified, still outside the provenance chain.
She is not sure how long she can keep it there before the act of keeping it there becomes the thing that needs explaining.
The transit home takes twenty-two minutes. She uses eleven of them to think about Chen's face during the longer scroll stop, and the other eleven to think about the question she didn't ask him: have you ever flagged a trace divergence before?
She didn't ask it because she wasn't ready for the answer either way. If he said no, she would know this was genuinely novel, and novel anomalies in a forensic interpretability firm's trace archive are not small things. If he said yes, she would want to know what happened to the flag — whether it was investigated, resolved, buried, or simply lost in the institutional memory the way so many internal findings get lost, registered and filed and never looked at again until someone runs a routine compliance audit and notices the record exists.
She decides she will ask him when he comes back with the case IDs. The second question is better asked after he's seen what she's seen. First he should have the data. Then she will ask him what he has done with data like this before.
The mesh deposits her at her stop. She walks the four blocks to her building in the kind of late-afternoon light that makes NYC feel briefly navigable — amber, low-angled, catching the upper floors of the Circuit Mile towers and leaving the street in cool shadow. The interpretability kiosks along this stretch of the Mile are the public-facing ones, not Meridian's — the city's own trace-check stations, where residents can submit personal interpretability queries for a fee. She has walked past them hundreds of times. She notices tonight that one of them is displaying an error: TRACE UNAVAILABLE: archive sync pending. The error is minor, probably a routine maintenance window. But she stops for a moment and reads it.
Archive sync pending. The machine, momentarily, cannot see its own recent past.
She walks the rest of the way home thinking about what it means for a trace system to lose sync with itself — and whether the two cases in her air-gapped folder represent something deliberate, something broken, or something that was both at once.