She pulls up case four before she has taken off her coat.
The M-7 log opens automatically — the Meridian intake system flags it as a continuation thread, appending case four to the chain she started building seven weeks ago. The tab header reads: M-7 METHODOLOGY / CASES 001–003 / CONTINUATION PENDING. She corrects this manually. It is not pending. It is here.
Case four: timestamped 4:17 AM local, certification network Delta-Nine, originating official ID NE-4412. A three-second gap in the audit trail between model state capture and signature emission. Not long enough to be an error. Not short enough to be noise. Long enough to matter, if you knew what you were looking at.
She knows what she is looking at.
The trace came in through the standard Meridian intake queue, flagged by the intake parser as anomalous but sub-threshold. Sub-threshold meant it would not trigger automated escalation. Sub-threshold meant it would sit in the low-priority queue until a human analyst chose to look at it. Sub-threshold meant most analysts would not choose to look at it, because there were seven hundred and forty other things in that queue rated higher by the parser's confidence weights, and the parser's confidence weights were built on historical cases, and this anomaly did not look like any historical case.
That was the problem with historical cases. They were historical.
Abena had learned trace vision in year two of her certification, under a supervising analyst named Dr. Reinholt who called it the most misleading name in the field. "Vision implies you see something," he'd said, sitting with her at a triple-monitor workstation in Meridian's training wing, the circuit graph of a mid-tier logistics recommender rotating slowly on the center screen. "What you're developing is more like hearing. You're learning to listen to what the graph is saying underneath what it's showing."
She'd thought that was pretentious at the time. Now, six years in, she understood he'd been trying to explain something he didn't quite have the language for either. The graphs showed feature activations. What you heard — what trace vision let you hear — was the rhythm of those activations. Whether they moved the way they were supposed to move. Whether something was pushing them.
The three-second gap at 4:17 had a rhythm she'd heard before.
She opened cases 001, 002, and 003 in adjacent panels. The intake system had stitched them into a shared workspace at her request — a configuration called a correlation canvas, which most analysts used for comparing active fraud investigations. She was using it to look for a ghost. The ghost of a technique.
Case 001: Delta-Three network, 4:17 AM, 3.2 seconds. March 2nd. Originating official ID AT-7701. At the time, she'd flagged it as irregular, written it up in her working notes, and marked it for pattern watch. The pattern watch system — a personal tracker she maintained outside Meridian's official tools, because Meridian's official tools required three confirmed events before initiating a pattern file — logged it as the first data point in a potential series.
Case 002: Epsilon-Seven network, 4:17 AM, 3.1 seconds. March 8th. ID HA-0023. She'd noticed this one herself in the general queue, not through a referral. She'd been doing a slow scan of the low-priority tail — the practice she called "reading the sediment" — when the timestamp and gap length caught her eye. The intake parser had rated it 0.12 confidence, which was near the floor. She'd opened it, seen the rhythm, and added it to the pattern watch.
Case 003: Gamma-One network, 4:17 AM, 3.3 seconds. March 14th. ID SV-2208. By this point she'd started checking the low-priority tail specifically at 4:17 windows. The intake parser was not designed to correlate across networks. It processed each submission independently, matching against within-network baselines. What was anomalous within a single network looked different from what was anomalous across three. The parser could not see the cross-network signature. She could.
Now case 004: Delta-Nine network, 4:17 AM, 3.0 seconds. March 18th. ID NE-4412.
Four cases. Three seconds. Four different networks. Four different originating officials. The same time window, precise to within sixty seconds each time.
She pulled up the methodology log and began writing the entry.
M-7/004 — March 18, 2035, Circuit Mile intake
Network: Delta-Nine. Timestamp: 04:17:03 local. Gap duration: 3.0 seconds. Official ID: NE-4412. Cross-reference: M-7/001 (AT-7701, Delta-Three, March 2), M-7/002 (HA-0023, Epsilon-Seven, March 8), M-7/003 (SV-2208, Gamma-One, March 14).
Pattern characteristics: 4:17 AM window (±60 seconds across all four cases), gap duration 3.0–3.3 seconds, cross-network (no shared infrastructure between Delta-Three, Epsilon-Seven, Gamma-One, Delta-Nine). Originating officials show no known affiliation in Meridian's registry, no shared certification path, no co-signatories.
The gap occurs between model state capture and signature emission. In standard audit protocol, this interval runs 0.2–0.8 seconds. The consistent 3-second gap suggests deliberate insertion: sufficient time to run a secondary process against the captured state before the signature commits. Candidate mechanisms: adversarial feature suppression via the Huaguang-class insertion method, or a variant thereof. Not confirmed.
Escalation status: PENDING FIFTH CONFIRMATION.
Rationale: Four cases constitutes a detectable pattern. It does not constitute a finding. A finding requires sufficient evidentiary weight to survive adversarial scrutiny during formal review. If I escalate at four cases, the reviewing board will ask whether the shared timestamp window could be coincidental correlation in a high-volume system. At four data points, they can make that argument. At five, distributed across five independent networks, the coincidence hypothesis collapses. I am waiting for five.
She saved the entry and closed the methodology log. Then she opened the general intake queue.
Her colleague Farris appeared in her workspace doorway at 8:14 AM, which was when he always arrived, and walked to the shared trace station at the back of the room without looking at his queue notifications first, which was also when he always did. Farris was a rhythm analyst. He processed by the numbers. He trusted the parser.
"You're looking at the low-priority tail again," he said. Not a question.
"Reading the sediment."
"The sediment is rated sub-threshold."
"The sediment is rated sub-threshold by a parser with no cross-network correlation logic," she said. "That's a different thing."
He came to stand beside her terminal. She'd pulled up case 004's circuit graph on the main panel — the signature trace, rendered as a timeline with highlighted intervals. The 4:17 gap glowed amber in Meridian's review interface, the system's way of marking anomalies it had noticed but not rated escalation-worthy.
"Amber doesn't file itself," he said.
"No. It doesn't."
"Abena." He paused. She could hear him deciding whether to say the next part. He said it. "You've been watching this pattern for seven weeks. At what point does holding it become its own problem?"
She understood the concern. Huaguang-class techniques had been in the threat briefings for three years. If she had evidence of one running live in the audit infrastructure — even soft evidence, even a pattern hypothesis — the standard protocol was to escalate as soon as she had a credible case. Four cases was credible. The protocol was designed for speed, because the alternative was sitting on a finding while a technique propagated.
But the protocol was designed for techniques that had already been confirmed. M-7 was not a confirmed technique. It was a shape she'd noticed, a rhythm she'd heard, an interval consistent with a known attack class but not matching any case in the Meridian or Registry databases. If she escalated now and the reviewing board rejected it — if they called the four-case pattern coincidental correlation and closed the file — it would be closed. She would need extraordinary new evidence to reopen it, and the technique, if it existed, would keep running while she rebuilt the case from zero.
She was not holding the pattern because she was uncertain. She was holding it because she needed to be right in a way that held.
"I need five cases," she said. "Five cross-network instances in the same time window with the same gap duration puts the coincidence probability below any threshold they can dismiss."
"And if case five doesn't appear?"
"Then either the technique paused, or I'm wrong about the pattern. Either answer is information."
Farris looked at the amber glow on the circuit trace for a moment. He was quiet in the way he got quiet when he was running the numbers in his head rather than speaking them. She'd learned to wait.
"The 4:17 window," he said finally. "Why that time?"
It was the right question. She'd been sitting with it for seven weeks. "Low-traffic audit cycle," she said. "Certification submission volume is at daily minimum between 4:00 and 5:00 AM in all three major regulatory zones. Fewer concurrent traces running means fewer active detection queries. If you're inserting a secondary process against a captured model state, you want low ambient noise. The parser's sensitivity floor is higher when it's handling volume. At 4:17, it's nearly alone."
"Whoever designed this understands the audit cycle at an architectural level."
"Yes."
"That's not an external actor."
She had known this for two weeks and had not said it to anyone. Hearing it from Farris, in his careful rhythm-analyst voice, made it more real than she'd wanted it to be.
"Probably not," she said.
Another silence. The coffee machine in the break room down the hall made its deciding sound — the pressurized hesitation before the brew cycle started. She'd worked in this office for four years and the machine still hadn't been replaced.
"All right," Farris said. "I'm not telling you to escalate. I'm saying — if you see case five in the next seventy-two hours, you move immediately. Don't wait to polish the write-up."
"I know," she said.
He returned to his station. She returned to the sediment.
The sediment ran through her pattern-watch filter in near-real time, the filter pulling timestamp clusters from the low-priority tail and testing them against the M-7 signature window. She had built the filter herself, a personal tool sitting outside Meridian's official infrastructure. It was not sophisticated. It was looking for one thing: submissions with a gap between model state capture and signature emission landing in the 3.0–3.4 second range, arriving during a 4:00–5:00 AM window, from any certification network. The sophistication was in knowing what to look for, not in the looking.
At 9:47 AM, it flagged a submission.
She opened it before her heart rate had time to settle back to baseline. Epsilon-Two network. Timestamp 4:17 AM. She pulled the circuit trace. Gap interval: 3.1 seconds, between state capture and signature emission. Originating official: ID KL-8890. No affiliation with any prior M-7 official in the Meridian registry. No shared certification path. No co-signatories.
Five cases. Five networks. Sixteen calendar days, March 2nd through March 18th, with a 4:17 AM window that mapped onto audit-traffic minimums across three regulatory zones with an exactness that was no longer coincidence. Five officials with no visible connection to each other except the technique moving through their submissions like a tide through five separate inlets.
She did not let herself sit with it. She opened the methodology log.
M-7/005 — March 18, 2035. Epsilon-Two. 04:17:02. Gap: 3.1s. ID: KL-8890. ESCALATION INITIATING.
She saved it. She pulled up Form 17-E — Suspected Systemic Audit Manipulation — and began filling in the fields. Case numbers M-7/001 through M-7/005. Network names. Timestamps. Gap durations. Official IDs. The cross-network pattern summary she had been drafting in her head for seven weeks. She did not polish the write-up. She wrote it the way she had it.
It took her eighteen minutes. She checked it twice. She submitted it.
The escalation system acknowledged receipt with a timestamp and a case number: ESC-2035-0181. An automated routing notification sent to the Circuit Mile senior analyst's queue, flagged for same-day review. The system's confirmation message was three lines of standard boilerplate, the same message it sent for every escalation regardless of severity. She had seen it dozens of times. This time she read all three lines before closing it.
She sent Farris a message with the escalation number and nothing else. She heard him open it from across the room. She heard him pull up the case. She heard the particular quality of silence that preceded him understanding something he had not expected to understand today.
After a moment he said, without looking up: "You got five."
"This morning. Epsilon-Two."
He was quiet for another beat. Then: "ESC-2035-0181 is going to be a significant case number."
"Maybe."
"Abena."
"Yes."
"If this is what the pattern says it is — the 4:17 window, the internal knowledge, five networks in sixteen days — the technique is already propagated. This is not early detection."
"No," she said. "But it's earlier than the parser would have found it. And it's documented in a way that holds." She paused. "The evidentiary chain runs clean. The methodology is logged. Every case is annotated. If the reviewing board questions the cross-network inference, I have the pattern watch records going back to March 2nd showing I built this case by the numbers."
"You built it to be bulletproof."
"I built it to be right." She thought about how to say the next part. "Fast and wrong means the board closes the file and the technique has cover. Right and documented means the board has something to act on. There's only one of those options that ends the technique."
He did not respond immediately. She understood he was deciding whether that reasoning had been worth seven weeks. She was not certain herself. The technique had run for sixteen days while she built the case to the standard she needed. Five networks had processed submissions with a 3-second gap she'd been watching since March 2nd. How many of those submissions had already been relied on? How many decisions had been made on interpretability audits that had a ghost in the gap?
She added one more line to the M-7 methodology notes before she closed the file:
Escalation filed. Evidence sufficient. The waiting was the work. The doubt about the waiting is also information — hold it.
Then she got up to get coffee, because it was going to be a long day, and she had been at her station since before her coat came off, and the coffee machine in the Circuit Mile break room made its deciding sound again as she walked toward it, the pressurized hesitation she had come to think of as the machine considering its options. She poured a cup. She came back to her desk.
The intake queue had forty-six new items since she'd last checked. She opened it and started reading.