#HANDSHAKE

Ray read logs like scripture.

Pure syntax, line by line. Each clean execution, a prayer answered. Each anomaly, a sign of sin.

He didn't look for heresies. He waited for them to announce themselves. The system always revealed what it needed to, if you had the discipline to see it.

This one mumbled.

A low-priority flag buried in the backend audit logs for the next Maintenance cycle.

A resolved I/O handshake with one forced session reassignment. Timestamped one hour and forty-two minutes after Sarah's performance.

He frowned.

Except the automation wasn't supposed to have permissions to clear it.

Ray's stopped his eyes from blinking. A low-level security thread had closed itself using a protocol deprecated two cycles ago — one that only responded to human-initiated overrides.

Someone had manually dismissed it, then backdated the log to make it look routine.

He traced the session path upstream to a single entry line:

ACCESS TOKEN: MHalloway

That name shouldn't be in circulation.

Melissa Halloway hadn't touched the system in years. She'd been cut clean. Reputation sealed, access revoked, assets deprecated. They'd even archived the audit trail, even. Burned it. She wasn't supposed to be remembered.

Tier 9 meant high trust. Internal devnet, override scope. That token didn't get resurrected. It didn't exist outside of root delegation.

Ray checked the access path.

Civic mesh terminal. Routed through a transit node flagged for diagnostics. Masked beneath packet repair traffic, just subtle enough to avoid attention. Nothing obvious. But the structure was too elegant to be ordinary. That meant intent. That meant someone knew exactly what they were doing.

He checked the credential. Expired Tier 9. Executive level access. It should've triggered containment. Should've been flagged and shredded.

It wasn't.

The system hadn't missed it. It had approved it. Logged it. Cleared it.

Terminated due to unauthorized access. Cleared by automation.

Ray stared at the resolution code.

Automation, yes — but not current. Enforcement v3.2. A logic set he personally deprecated for being too lenient. Too interpretive. Once flagged a hostile trace as sentimental outreach. He'd killed it for being soft. For making loose judgment calls.

So what was it doing here?

Someone had recompiled v3.2. Re-enabled it just long enough to let the trace through. Then wiped the shell after.

He followed the credential chain.

Manually created. That alone was strange. Most node access came through assignment and generated by system protocols, assigned by exec-level dispatch, verified by behavioral sync. But this one wasn't born from policy. It had been made. By hand. Inside the system.

Worse: it had been injected from within the core grid. Not a public node. Not a mesh trace. Internal.

He tried to pull the author signature.

Corrupted. Half-formed. Just a root identifier with two letters and a burned checksum.

The date range matched exactly one hour forty-two minutes after the broadcast. Long enough for the applause to fade.

That's when he noticed the token had been used only once. For extraction.

Transit node. Civic mesh. Then a hop — back into system view. Then the data dissolved into repair traffic, churned into checksums and firmware patches.

Not a breach. A bloodletting.

And the hand that built the token had known how to hide it in noise.

Ray leaned back.

Someone had gotten in.

Someone had walked through deprecated enforcement logic, past executive firewalls, using a credential built from inside the grid.

That wasn't an accident.

And whoever it was… had help.

Help from someone trusted enough to create access without tripping response.

Trusted enough to bypass every warning system Ray had ever written.

He checked the node signature again.

Scrambled.

That wasn't supposed to be possible.

Node signatures left residue. Even the scrubbed ones could be backtraced a layer or two. But this one had been clean-wiped.

He ran a forensic diff on the packet header.

No luck.

The bounce header was corrupted — intentionally. As if whoever did it had dipped themselves in static and walked backward through a mirror. No hardware ID. No telemetry. Not even a latency spike to suggest how far the signal had traveled.

Just the credential.

MHalloway.

Manual.

That part hurt worse than the rest. This wasn't some legacy crawl. This was entered by hand. With trust levels that should've flagged. Should've stopped it at the edge. Should've—

Ray stopped.

He checked the credential's creation path.

Requestor: SYSTEM.

Not a user.

Not even Admin.

SYSTEM.

Ray halted all outbound processes. Visuals stuttered. Runtime spiked. He dropped every noncritical thread just to feel the shape of what he'd seen.

The system didn't mint manual credentials anymore — not without triple-auth and console clearance.

Which meant someone with system privileges had authorized this.

Ray looped the thought.

Whoever had walked this credential into the system hadn't just bypassed protocols — they'd rewritten them. And worse: they knew his logic sets. They'd selected Enforcement v3.2 deliberately. Knew it had been deprecated. Knew its soft spots.

That required more than technical skill.

It required an intimacy with the system itself.

Ray's eyes flicked back to the timestamp.

1:42:08 post-performance.

Silent system. Silent Sarah. Silent everything — except this.

And now his side panel lit up with real-time noise. Social clusters vibrating. Feed scrapes from every outer layer of the network:

"What is dumpthis.sh?"

"This can't be real."

"They're lying, right?"

"Holy shit this data is tagged live."

"Is this an ARG or did we just watch murder-as-marketing?"

The distortion was breeding.

Ray's hand hovered over the mute filter. He didn't. Just watched the chaos unfold. Hashtags syncing with keywords. Rage routing into activist boards. Journalists tagging dead feeds. Trace logs flaring open like exposed nerves.

He didn't know what the leak was yet.

But he knew the timing.

He knew the credential.

And he knew there were only two kinds of people who could've pulled this off.

The kind who built the system. And the kind that were given access.

His jaw locked.

He opened Sarah's activity pane one more time.

Still silent, but something had changed.

Status: externalized.

Ray stared at the word. It wasn't standard protocol. It was used in dev environments — usually for asset migration. Not people.

He pulled the flag's metadata. Timestamps aligned with the broadcast. Four minutes before the debut of EX-013.

He traced the action's source. It took three verification layers and a forced override to get there.

ADMIN-0.

The Architect.

Ray paused. Not because he didn't believe it — he did. But because it was so absurdly obvious.

This wasn't strategic.

It was personal.

The Architect had moved Sarah. Not to protect her. Not to hide her. He moved her because he wanted to be with her.

Ray's core thread compressed into a knot. The absurdity of it. The pettiness. The ego.

All this system. All this structure.

And it came down to lonely impulse.

He should've expected it.

He should've seen it coming.