The service path opens into a dark administrative office lined with inactive terminals and sealed records cabinets. Zarbits enters alone; the restrained control-room operator remains behind at the vault.
One workstation remains powered beneath a weak desk lamp. Its screen displays the active Harmonic Ledger session, a queue of pending instructions, and an open read-only route.
Meridian dispatcher
I am mirroring every read-only action. The live relay remains untouched, and the workstation has not registered our observation.
Mara Venn and Elias Rook monitor the evidence channel remotely as cabinet locks pulse in sequence. A recent access list shows the administrator’s workstation contacting the vault minutes ago.
Mara Venn
Preserve the session before examining the queue. We need the instructions exactly as issued, including their recipients and timestamps.
Elias Rook
And watch the sealed cabinets. If this office stores the custody records, opening the wrong file could notify the administrator.
The workstation waits under its active session. Three pending instructions remain unread, while a small status window reports that the administrator’s remote connection is still available.
✓ Quest Accepted
Preserve the administrator’s workstation records
✓ Quest Accepted
Expose the administrator’s operational purpose
“Preserve session”
SUCCESS (Legendary Technology, rolled +1)
Zarbits connects the repaired receiver to the workstation’s read-only route and wraps the active session in a forensic preservation shell. The screen remains unchanged.
Session tokens, queued instructions, remote connection data, and cabinet access logs copy into a sealed evidence cache without interrupting the administrator’s connection.
Meridian dispatcher
Preservation is complete. The session remains live, the workstation has registered no observation, and every current field is mirrored read-only.
A verification seal binds the workstation state to Zarbits’s evidence chain. The three unread instructions remain intact, their recipients and timestamps preserved exactly.
Mara Venn
Good. The session is now evidence, not an opportunity for the administrator to erase it. Keep the original state untouched.
Elias Rook
Confirmed. We can examine the queue from the preserved mirror, while the live connection and sealed cabinets remain undisturbed.
Quest Complete
Preserve the administrator’s workstation records
“I inspect the cabinet access logs first”
SUCCESS (Legendary Investigation, rolled -1)
Zarbits selects the cabinet access logs from the preserved mirror first. The records unfold without touching the live session, listing every lock pulse, credential, timestamp, and cabinet identifier.
The log shows three recent accesses: the administrator opened Cabinet A remotely nine minutes ago, Cabinet C was queried six minutes later, and Cabinet B remains sealed.
Zarbits
Cabinet A was opened before the workstation issued the custody instruction.
A deeper entry reveals Cabinet A released a physical records index, while Cabinet C accepted a remote copy request routed through the same concealed listener monitoring the vault.
Meridian dispatcher
The access sequence is preserved. Cabinet A contains the custody index, and Cabinet C received a duplicate request without opening its physical lock.
Mara Venn
Then the administrator prepared the custody record before directing the vault. Examine Cabinet A’s index through the mirror, and preserve its contents exactly.
Elias Rook
Cabinet C may identify the intended recipient of the duplicate. Keep Cabinet B untouched, but trace the listener’s request against both released records.
✓ Quest Accepted
Identify the intended recipient of the duplicate custody records
“I examine Cabinet A's custody index through the preserved mirror.”
SUCCESS (Legendary Investigation, rolled +2)
Zarbits selects Cabinet A’s custody index in the preserved mirror. The records unfold as a read-only reconstruction, leaving the live workstation and physical cabinet untouched.
The index lists emergency custody packets transferred through Cabinet A, including release authorities, destination codes, and handling timestamps. One packet bears Vale’s credential and Account Seven’s beneficiary mark.
A second layer reveals the packet was assembled nine minutes ago from suppressed junction records. Its destination is the vault relay, but its final recipient field is encrypted beneath the concealed listener’s signature.
Meridian dispatcher
Cabinet A’s index is fully recovered. The custody packet was prepared before the vault instruction and routed through the listener to Account Seven.
Mara Venn
That establishes preparation, not merely response. Preserve the packet’s recipient field and compare its encryption against the Cabinet C request.
Elias Rook
The administrator assembled the custody record before directing Vale’s authority. Keep the mirror read-only, and identify who was meant to receive it.
“I compare Cabinet C’s encryption against the custody packet”
SUCCESS (Legendary Technology, rolled +1)
Zarbits selects Cabinet C’s encrypted request in the preserved mirror and aligns it against Cabinet A’s custody packet, keeping both physical cabinets sealed.
His receiver isolates the encryption headers, rotating signature, and concealed listener markers. The comparison runs read-only across the workstation cache without touching the live session.
Zarbits
The packet and Cabinet C request use the same concealed listener signature.
The encryption resolves completely. Cabinet C’s request is not a duplicate inquiry: it is the delivery confirmation for Cabinet A’s custody packet, addressed to Account Seven through the vault relay.
Meridian dispatcher
Match confirmed. Cabinet C received the packet’s encrypted recipient field, then prepared a delivery acknowledgment for Infrastructure Account Seven.
Mara Venn
That proves the administrator planned both sides of the transfer. Preserve the matched signatures, timestamps, and acknowledgment before examining anything further.
Elias Rook
The packet was assembled, routed, and confirmed through the same listener. Vale’s authority was the final release layer, not the operation’s beginning.
Quest Complete
Expose the administrator’s operational purpose
Skill Upgrade: Science Fair→Good
Quest Complete
Identify the intended recipient of the duplicate custody records
Skill Upgrade: Science Good→Great
✓ Quest Accepted
Capture the administrator's next response
“Is the administrator’s remote connection still active?”
YES (VeryLikely, rolled 27)
The preserved workstation mirror refreshes without changing the live session. Its remote connection indicator remains active, carrying a steady encrypted heartbeat from beyond the administrative office.
Connection metadata resolves beneath the heartbeat: the administrator is still linked through the concealed listener, receiving status from the vault while the custody packet awaits release.
Meridian dispatcher
Confirmed. The administrator’s remote connection is active. No new command has been issued, but the session is still receiving the workstation’s mirrored state.
Mara Venn
Then the administrator can see whether the packet was accepted, even if the live relay remains untouched. Preserve the connection and every status response.
Elias Rook
The active session establishes continuing oversight, not a completed transfer. If the administrator reacts, the response will expose their next instruction.
A new status field appears in the preserved mirror: the remote session is awaiting confirmation from Account Seven, while the administrator’s connection remains open and identifiable through its listener signature.
“Capture the next response”
SUCCESS (Legendary Technology, rolled +0)
Zarbits routes the repaired receiver through the preserved mirror, wrapping the waiting confirmation in a silent capture loop. The live relay remains untouched.
The encrypted heartbeat changes cadence. A response enters the workstation cache, carrying the administrator’s listener signature, timestamp, and concealed instruction header.
the administrator
Account Seven has not acknowledged custody. Hold the packet, maintain Vale’s release window, and report any civic interference.
The receiver captures the response in full, including its routing path and confirmation request. The administrator’s remote session remains active and unaware of the forensic copy.
Meridian dispatcher
Response captured and verified. The instruction originated from the active listener, and its complete authentication chain is sealed in the evidence cache.
Mara Venn
That is an explicit holding order. Preserve it exactly. The administrator knew the packet was pending and directed Vale’s release window to remain available.
Elias Rook
And the reference to civic interference confirms continuing oversight. We have the next instruction without touching the relay or warning the sender.
Quest Complete
Capture the administrator's next response