Yuki found the intrusion on a Tuesday.
It was not dramatic. She came to Marcus's desk in the late afternoon with a laptop and a specific expression — not alarmed, but focused, in the way that a person was focused when they had found something they didn't fully understand yet and wanted to understand before they reacted.
"Network traffic," she said, turning the laptop so he could see. "I've been running passive monitoring on our infrastructure since I started. Force of habit." She pointed to a section of a log file. "These requests are coming in against our internal API, not the public-facing one. The internal API is not documented anywhere. It's not in any public-facing codebase."
Marcus looked at the log. The requests were sparse — three over four days — and each one was malformed in a specific way: they were probing an endpoint structure that didn't exist yet, but that Marcus had designed in an architecture document that existed only in two places. His local encrypted drive and the secure facility.
"They're not finding anything," Yuki said. "The endpoints don't exist. But whoever this is, they have access to documentation that shouldn't be accessible."
"Where's the documentation?"
"That's what I can't figure out." She looked at him. "I've checked every external-facing surface. The architecture doc isn't published. It's not in any repo. It's not in our team wiki." A pause. "Unless someone has access to your local machine or the secure facility."
Marcus absorbed this carefully.
"You know about the secure facility," he said. It was not an accusation.
"I noticed your schedule," she said, equally flat. "Three mornings a week, consistent hours, you're not reachable. I asked Jin, he said he didn't know either. I didn't push it." She paused. "But if someone has access to docs from that facility—"
"It's a different threat surface," Marcus said. "I'll handle that piece."
Yuki looked at him. She was twenty-three years old and she had the self-possession of someone who had been underestimated often enough that she had stopped waiting for permission to be correct.
"What do you want me to do about this?" she said.
"Keep monitoring. Log everything. Don't close the vulnerability — I want to understand what they're looking for before we shut the door."
"You want to let them probe."
"I want to understand the shape of what they think we have before I tell them we can see them."
She looked at him for a moment. Then she nodded, with the specific nod of someone who understood an operational decision even if they hadn't fully reasoned through it yet.
"Okay," she said. "I'll build a logging layer."
---
He called Marsh that night.
He described the intrusion without mentioning the secure facility by name. She was quiet for a moment after he finished.
"There are two plausible sources," she said. "The first is the same law-firm-adjacent party from the Monitor story. They may have escalated to an active technical approach after the third story. The second is someone who has a different interest in what you're building — not hostile to Threadline specifically, but wanting to understand the technical approach."
"There's a third," Marcus said.
Marsh was quiet.
"Someone connected to the Northern Virginia engagement," Marcus said carefully. "Assessing whether what I'm building there has applications outside the agreed scope. Or assessing whether I'm building anything outside the agreed scope."
"That's a significant inference," Marsh said.
"I know."
"Do you have evidence for it?"
"The endpoint structure they're probing corresponds to something in documents that have limited distribution. The law firm wouldn't have them. A competitor wouldn't have them."
A silence.
"I'll need to make a notification to the facility," Marsh said. "Carefully worded. This falls under the security incident reporting requirement in the engagement agreement."
"I know."
"You're not alarmed," she said. It was an observation rather than a question.
"I'm paying attention," Marcus said. Which was, as he had told Priya months ago, a different thing.
He hung up and thought about Pemberton and Dr. Chen and the forty-three analysts and the relationship graph growing in the secure facility's workstation. He thought about who in that structure might have a reason to look sideways at what he was building.
Then he opened a blank document and started writing a security protocol for the Depth project that was considerably more rigorous than what he had been using.
He wrote until midnight.
The System updated at 11:47:
---
**Exploit Intuition Lv. 4 → Lv. 5** *(multi-vector threat surface analysis performed, preemptive countermeasure designed)*
**Third Gate: 68% complete.**
---
Sixty-eight percent. He was more than halfway into a room he hadn't been invited into, and someone in that room had just noticed.