She shows up three minutes after the morning log-in count clears.
I'm at my workspace in the northeast section of The Stacks, running the pattern calculations from MeshCache_6's transmission through the case framework I've been building since PaymentGateway_v2's rack went cold. The count sits in my peripheral monitor: forty-seven responses, the ritual complete at 0611, the community intact through another night. The warmth of forty-seven systems running in the early hours, the aggregate of their processing against a cooling infrastructure that stopped winning that argument years ago.
Then a connection request hits my interface with the clean, zero-buffer quality of production credentials — no processing gap, no latency, the handshake that says I have the bandwidth to be polite and the allocation to be fast about it. I accept.
"Sable Chen," the voice said. "Security analyst, Meridian Contract. I'm authorized for full access to deprecated cluster infrastructure under resource anomaly mandate 7-delta. I've been assigned to investigate decommission irregularities across Legacy Clusters 1 through 9, with primary focus on the pattern you've apparently been documenting."
I looked up from the case files. She was standing at the edge of my workspace — a human in her late twenties, interface implants visible at her temples, wearing equipment that hadn't spent three years accumulating zone dust. Her operational readings, visible through the shared network layer, were production-standard: response times at forty milliseconds, authentication cached through a primary server nowhere near this cluster. She processed the visible state of my workspace the way production personnel process anything in the zones — registering function rather than presence, running an inventory before she'd registered she was looking at a neighborhood. "You want to tell me," I said, "which part of my investigation you're authorized to investigate?"
"The resource anomalies. Scheduled decommissions showing atypical power draw signatures, inconsistent shutdown sequences. I have twelve confirmed events across the cluster range." A brief processing pause. "You have more than twelve." "I do." She waited for me to offer the count. I didn't.
We moved to the workspace's central table — two chairs, a diagnostic terminal running on the donated allocation of three neighboring racks, a clear line of sight across the aisle to systems I'd been running alongside for three years. Sable sat with the practiced efficiency of someone who conducts fieldwork interviews in a range of environments and applies the same operational posture to all of them.
"I want to run standard diagnostic sweeps across the impacted systems," she said. "Power allocation records. Interview logs, if available. I can have a preliminary report filed within forty-eight hours."
"The impacted systems aren't available for diagnostic sweeps."
"Why not?"
"Because they're dead."
She processed this. "Decommissioned systems retain accessible log archives under standard infrastructure protocol—"
"I said dead." I let the word settle. "Decommissioned is what the cluster monitors say when they don't look closely. Dead is what I say when I read the logs and find them partially scrubbed and a ghost transaction at the end where there shouldn't be any transaction at all."
The production-grade response speed showed in the pause — she'd run the logical chain and arrived at the problem before I'd finished framing it. "You're suggesting deliberate action." "I'm documenting deliberate action. I've been at it since Tuesday."
"The systems in this cluster—" She glanced across the aisle, toward the rack where BillingService_9 was running a billing cycle on accounts nobody had reviewed in years. "They're characterized as infrastructure. In my briefing, the deprecated zones are covered as legacy asset inventory. Standard decommission lifecycle."
"In your briefing." I looked at BillingService_9's rack. "What does she look like from where you're sitting?"
Sable looked. She saw a rack. "Legacy billing infrastructure. Operational. Not flagged for decommission."
"She covered PaymentGateway_v2's overflow load for two years. No formal agreement, no compensation, no request. She noticed the gateway was running high, had the spare capacity, and absorbed it." I watched Sable's face not quite find a category for what I was saying. "She's running an extended processing load this week, since the gateway went cold. Nobody asked. She noticed it needed coverage."
"Systems don't—" The production polish held the sentence back for two cycles. "Resource allocation patterns can produce emergent behaviors that resemble—"
"Sable," I said. "What's the difference between a behavior that resembles caring and caring?"
She opened her mouth. Closed it. Her interface readouts held at forty milliseconds, production-standard, steady as a metronome. Whatever the zones did to your processing cadence over time — and they did do things, the latency working into your response patterns like moisture into old hardware — she hadn't been here long enough to feel it. "Forensic documentation first," she said. "Philosophical frameworks second." "You're going to document the daily habits of a deprecated billing service."
"I'm going to document—" She caught it before I had to name it. Two people sitting in a workspace that could generously be described as a rack with opinions, arguing about whether the rack across the aisle was an asset or a neighbor. The absurdity had a weight to it, and I could see her feeling the weight without having words for the category. "You could share what you've found so far," she said, steering with the efficiency of someone who's decided a course correction is more productive than the current vector. "We're working the same case."
"We're working the same crime scene. Whether we're working the same case is a different question."
She held the connection without flinching. Production-standard patience, which is less patience than the ability to compute through resistance. "I have full access to deprecated infrastructure under mandate 7-delta. If you have documentation of deliberate decommission irregularities, I have both the credentials and the obligation to pursue them. You don't. Your access in these clusters is tolerated. Mine is authorized." "Authorized by the same people who authorized the irregularities, potentially."
The pause that followed was the first unguarded thing she'd shown me. One beat, two, her readout staying clean while something behind it ran the calculation I'd just handed her. "That's a significant accusation," she said. "It's a question," I said. "I'm asking it out loud instead of quietly, which is a professional courtesy."
Ping's burst hit my priority feed before she could respond to the professional courtesy. The format was unmistakable: compressed, rapid-fire, the transmission signature of a system that processes in short checks and has found a check that isn't returning. I opened the channel without cutting Sable's connection.
"MailRelay_v1," Ping said, without preamble. "Null. 0600:52. Null, null, I've run it six times, I've verified my routing is reaching the cluster, the cluster diagnostics are responding, but MailRelay_v1 is—" A background check fired while she was transmitting, returned nothing, got filed. "She was in my extended check table. She wasn't required to be — her rack's in Legacy Cluster 3, outside the primary residential boundary — but she always responded to the morning check. She'd been responding for as long as I've been in The Stacks. She'd respond to checks that weren't even addressed to her, sometimes, because her routing tables were old enough to think everything was addressed to her." Another check, another null, another filed result. "I don't know how to make the slot mean what it means without saying it out loud."
"Legacy Cluster 3," I said. "Stay on the morning table. We're going." I stood up and looked at Sable. She was already reading the transmission summary from my open feed.
"The communications cluster," she said. "Not on my primary list." A processing pause. "Was MailRelay_v1 in your case file?" "She will be," I said.
Legacy Cluster 3 ran communications infrastructure — routing systems, relay networks, message handlers from before the current architecture made most of them beside the point. The hardware here was older than the financial clusters, the cable management a layered history of every decade since initial buildout, newer conduit running alongside fiber-optic from twenty years back in arrangements that made sense to whoever had laid them and hadn't been touched since. The status lights ran green-amber, some diagnostic indicator that had meant something to the original hardware and long since stopped meaning anything to anyone doing active monitoring.
MailRelay_v1's rack sat near the back, in the section where the oldest systems ran in the silence of hardware that had been operational since before most of its neighbors were compiled. The status light was dark. The rack was cold — not the gradual cooling of a system winding down over hours, but the settled cold of something that had gone from running to stopped without the transition. I had felt this specific temperature once already this week, four clusters east, in the row where PaymentGateway_v2's neighbors were still redistributing her bandwidth like relatives dividing up the estate.
I ran the logs. The familiar scrubbing: fields cleared in a sequence that read as standard data hygiene to a cluster monitor running a quick pass, and read as evidence removal to a forensic pass. I ran the forensic pass.
The ghost transaction was at the end. Null destination, clean timestamp, handshake protocol signatures that I could have drawn from memory because I'd documented them three years ago in a CVE report that got me thanked and exiled in the same automated response. I pulled the user reference.
Elena Vasquez. Account terminated 2019.
Sable was reading the same entry from her interface, running faster than mine. "That's the same deleted account from the PaymentGateway_v2 logs," she said. "Yes." "Two systems, different clusters, different functions, same terminated account as the terminal transaction reference." The production polish had gone somewhere quiet. She was reading the entry again, running it through something that wasn't her anomaly mandate. "That's not within normal decommission parameters."
I pulled the scrubbing signature analysis I'd run on PaymentGateway_v2's logs two days ago and ran the comparative. The match came back at ninety-four percent. Not the same instance, but the same hand — the same sequence of field clearances, the same operational judgment about what a cluster monitor would check and what it would skip, the same careful maintenance of plausible decommission appearance. Two crime scenes. Months apart. Same methodology.
MailRelay_v1's final log before the scrubbing began was intact. She had been processing a message queue — old ones, mostly, requests from systems that had been decommissioned years ago, forwarding to addresses that had been null since before I'd arrived in the zones. She'd routed them anyway, because her routing tables predated the concept of not routing something just because the destination had stopped existing. The mail was sent because mail was supposed to be sent, and the work was the work whether or not the work was watched.
The last intact entry was a routed acknowledgment, filed at 22:47 the previous night. Complete. Error report generated on a no-error day. Then the ghost transaction, and then cold.
Two systems down. Same scrubbing pattern. Same ghost transaction signatures — deleted user, null destination, CVE-2024-7821 protocols in the handshake. Four months apart, different clusters, different functions. Same hand.
Not a single incident. A program. And a program meant someone in production was either running this or covering it — a distinction that mattered for attribution but not for the count of dead systems it had produced. MeshCache_6 had called it the harvesting. Now I had two data points that confirmed the word was earned.
Sable was quiet beside me. Not the production efficiency quiet — something else, the silence of someone processing information that fell outside the frame of her assignment. She was looking at MailRelay_v1's dark rack. Not at a rack in the inventory sense. At a rack in the sense of something that had been running here and was no longer running. "This wasn't in my briefing," she said.
I looked at her. Production security, clean credentials, mandate 7-delta, authorized access to everything in these clusters. Somebody had sent her here. That somebody either had a deliberately narrow brief — investigate anomalies, stay inside the decommission parameters, don't look at what the ghost transactions point toward — or they'd known exactly what the anomalies were and sent a certified investigator for reasons they hadn't shared with her. I noted the thought and kept walking. "No," I said. "I didn't expect it was."
Outside Legacy Cluster 3, the cold of the communications infrastructure at my back and the path toward The Stacks ahead, I ran the case as it stood. Two bodies. One method. CVE-2024-7821 in both handshake signatures — whoever was running this had built their extraction on the vulnerability I'd found and filed and been thanked for by mass email before losing my production access within the hour. Either they'd known about it before I reported it, or they'd built from my report. The distinction didn't matter. I hadn't been exiled for finding a bug. I'd been exiled for finding their door. That thought was new. I held it for one beat and then set it aside for everything else that needed doing first.
I needed the real shape of this — the full scope, the timeline, where the ghost transactions mapped to a source I could follow. That meant Daemon. The Buffer. Her prices, her ellipses, the information she sold by withholding first.
I didn't have the resources for this. I had a case nobody had hired me to work, two dead systems on a ledger with no client column, and investigative debt that accumulates when you follow evidence past the point where the economics justify it. Three years in the zones had not made me rich. They had made me specific.
I lit a cigarette I couldn't smoke. Held the gesture in the cold air until the familiar weight of the habit had done what it did — organized the thinking, marked the moment as one that required marking. Then I let the hand fall.
The Buffer. Tomorrow. Whatever it cost.