The variance notification was still in the internal architecture where she had filed it.
Liora had left it there deliberately, not from avoidance, but from the particular operational discipline of someone who had learned that pursuing an anomaly before its context was sufficiently established produced conclusions that had to be revised, and revision cost more time than patience. She had filed it at 10:07 on Thursday morning, and it was now Saturday, and she had spent the intervening time doing what the review preparation required without touching the notification.
She was touching it now.
The primary terminal was open on the southern grid's ballast infrastructure schematics, the same documentation she had been working through for the joint review counter narrative. The four load variance points were annotated in the isolated working layer she maintained separately from the official record. The counter-narrative was taking shape. Eight days was sufficient if she did not lose any of them to variables she had not anticipated.
The variance notification was a variable she had not anticipated.
She opened it again and read it for the fourth time.
Southern grid ballast infrastructure. Secondary distribution node. Minor anomaly in the load balance across the foundation loops. Timestamp 03:47. The middle-of-the-night passive sweep.
She looked at the specific node designation the notification listed.
Node 7-F. Secondary distribution, lower quadrant. Not one of the four variance points she had built. Not a node she had touched during the southern grid realignment. Not a node that appeared anywhere in the legitimate optimization work she was constructing the counter-narrative around.
Node 7-F was in a section of the foundation loop architecture that she had, as far as her own operational record showed, never interacted with.
She pulled the node's historical performance data from the infrastructure schematics. The record was clean, consistent load values, no previous anomalies, no maintenance flags, and no access logs from any administrative token she recognized. The node had been running without variation since the southern grid realignment and had produced no monitoring flag in that entire period.
Until 03:47 on Thursday morning.
She looked at what the anomaly was.
Not a spike. Not a drop. A pattern shift, the load balance across Node 7-F had reorganized itself in a way that was too small to constitute an alert-level deviation but too structured to be random thermal noise. The monitoring system had flagged it as a minor anomaly rather than a critical event because the deviation fell within the outer band of the acceptable variance threshold.
It was inside the threshold.
It was not inside what the node's historical pattern predicted.
Liora looked at the pattern shift on the technical display for a long time.
She had spent several months learning how the foundation loops behaved under operational load—the specific signature of data movement inside the architecture, the way the 104,229 anchored names registered as phantom impedance values, and the thermal behavior of the Jovian signature distributed through the legacy blueprint's historical code layers. She had learned the foundation loops the way she had learned every infrastructure she had ever managed, not from documentation but from sustained observation of how the system actually behaved versus how its documentation said it should.
Node 7-F's pattern shift was not consistent with the thermal behavior of dormant data.
Dormant data—the 104,229 names and Jovian's distributed signature—produced a flat, consistent impedance reading. It did not produce structural load reorganization. Structural load reorganization was produced by active data. Data that was doing something.
She closed the foundation loop historical data and opened the tower's broader network architecture map—the schematic that showed how Node 7-F connected to the adjacent infrastructure. She traced the node's upstream and downstream connections through the ballast system's distribution architecture.
Node 7-F connected to three upstream nodes and two downstream ones. All five were clean—no anomalies in any of them during the Thursday passive sweep. The shift had been contained entirely within Node 7-F itself, which meant whatever had produced it had not propagated through the network. It had originated in the node and stayed there.
She looked at the node's position in the foundation loop architecture.
It was not in the primary distribution layer where the 104,229 names were anchored. It was not in the secondary layer where Jovian's signature sat dormant in the legacy blueprint margins. It was in a tertiary layer, a section of the foundation loop architecture that she had understood since the solar cylinder integration in the early chapters of the rebellion, as the structural buffer between the primary extraction grid and the foundation loops. The layer that prevented the extraction system's standard operational load from disturbing whatever was anchored in the deeper loops below it.
Node 7-F sat inside the buffer layer.
Liora had never modified the buffer layer. It predated her work entirely, original architecture from Wick's centralization window.
If something inside it had reorganized its load balance, it had not come from her.
She looked at the timestamp again.
03:47. The same night that Lucian had kept the archive sleeve in his desk drawer. The same night that she had sent the District Six relay signal and received the four-pulse confirmation. The same night that — somewhere in the lower districts — Leo had been sitting in a drainage vault watching an analog monitor.
She thought about Leo.
About what he did when he had an analog monitor, time, and a problem the network could not solve directly.
About the two three one signal he had sent through the secure handset six minutes after she sent the direct status request. Not the network's protocol. His protocol. The shorthand they had developed before the official architecture existed.
She thought about what it would mean if Leo — sitting in a drainage vault near District Four with an analog monitor and three years of institutional knowledge about the foundation loop architecture — had found a way to reach Node 7-F directly.
Not through the network's standard relay chain. Not through anything that would produce a transmission signature the security division's packet sniffers could identify. Through the foundation loop architecture itself, the physical copper infrastructure that Wick had built and that sat entirely below the corporate mainframe's monitoring threshold.
Using the buffer layer as a carrier medium rather than a data store.
The thought was not a conclusion. It was a shape, the outline of a possibility that she did not yet have enough information to confirm or eliminate.
She filed it alongside the notification in the internal architecture where she kept everything that mattered.
Then she opened a new isolated working layer on the secondary terminal and began tracing Node 7-F's connection pathways through the foundation loop architecture in the direction the buffer layer carried signal rather than data.
Not toward the extraction grid above.
Downward. Into the deeper layers. Through the 104,229 names. Through Jovian's distributed signature in the legacy blueprint margins. All the way down to the lowest structural layer of the foundation loop architecture, the layer that Wick had described to no one and that she had never fully mapped because she had not needed to map what she did not intend to use.
The lowest layer connected to nine physical access points distributed across the tower's structural foundation. She knew of four of them. The maintenance alcoves on Level 82 that Carver had used for the parallel records. The junction boxes in the eastern infrastructure block. The freight lift shafts that ran through the tower's vertical core.
The other five she had never located.
Her sapphire eye ran its diagnostic overlay across the schematic, highlighting the connection pathways in the particular pale blue she had learned to read as structural rather than digital, physical copper and insulated wire rather than network routing. The overlay traced five unmapped access points through the foundation loop schematic and deposited them at locations the corporate floor plan did not show as anything except a solid structural wall.
She looked at the five locations.
Then she looked at the timestamp on the notification.
03:47.
She reached for the secure handset and sent a single directed pulse on the frequency she had used for the two three one confirmation. Not a signal. A question. The specific three-beat pattern that in their private shorthand meant: was that you.
She set the handset down.
She returned to the joint review counter-narrative and continued working.
Eight days until the review. The counter-narrative was taking shape. The four load variance points were annotated. The legitimate optimization narrative was structurally sound.
And somewhere in the foundation loop architecture, below the extraction grid and the 104,229 names and Jovian's dormant signature, five access points she had never mapped were connected to a buffer layer node that had reorganized its load balance at 03:47 on Thursday morning.
She worked through the morning with her left hand steady on the input pad and her right arm's deep throb maintained at its manageable register.
At 11:43 the secure handset gave a single return pulse.
Followed by two pulses.
Followed by one pulse.
Two one.
She had not established two one in any protocol she could currently remember.
She sat with the sequence for a long moment.
Then it arrived, not from the network's record but from the private shorthand that predated the network. The specific register of two one in the binary notation Leo had used for the first analog tests in the months before Level 82.
Two one did not mean I am here.
It meant I found something.