The timestamp in my investigation log reads Day 14, 23:41. I've been in the lab since four in the afternoon — call it seven and a half hours, four mugs of coffee, a stack of printouts that's grown half a foot since I sat down. For the first five of those hours I worked through every other section of callback layer 8: the scheduling functions, the window validation calls, the error-handling wrappers Derek had layered over Marcus's original architecture like scar tissue over something that never properly healed. I mapped it all. I annotated, cross-referenced, flagged the dependency connections going down to layer 9. Good work. Thorough. The kind of debugging that doesn't ask you anything personal. I was avoiding the comment block.
I flagged it on day twelve, at the end of the session where I read the first line and knew who it was addressed to. I wrote EVIDENCE — PERSONAL CONNECTION in the margin in capitals and went home and slept four hours and spent day thirteen on the MediCore corporate thread with Ray — Victor Russo's lawyers, the document requests that were going to take three weeks and probably yield nothing, the paper record of a company that cut every process designed to catch what Marcus inserted. I did not come back to layer 8. I told Ray I needed a day on the institutional side. Both things were true.
Now the lab is empty. The overhead fluorescent holds steady at its single frequency, the particular quality of light that continues past the hour when buildings are designed to contain human beings. Behind the glass partition the servers hum their constant mechanical note, the heartbeat of a room that runs all night regardless of who's watching. The mug at my right elbow is cold. I've stopped noticing when coffee goes cold; it happens somewhere in the middle of focused work when I stop being a person who needs things and become something that reads code.
I pull the printout flat against the desk, smooth the crease at the upper right corner where it bent when I carried it home and back. I read the full comment block.
// calculate_scheduled_dispense_window -- parameter spec in dosage_record.py // // You would have caught this in ten minutes. // I spent three hours on the null check alone. // You always said I overthought the edge cases. // I told you the edge cases are where everything real is hiding. // We were both right, probably. // // Window validation below is load-bearing. Don't touch it. // The upstream doesn't validate. Trust this.
Nine lines. The last two are documentation — the professional register, the language of a developer writing for whoever comes next. The seven before them are something else.
The first you in line three is not the universal second person of technical writing, the reader-addressed instruction Marcus uses in a dozen other places through the codebase. I know this because the line doesn't work universally. You always said I overthought the edge cases requires a specific person who said that, in a specific context, more than once. It requires three months of late debugging sessions and a particular argument where I told him that overthinking the edge cases was how he covered for not trusting the center, and he said no, the edge cases are where the interesting failures hide, and we went back and forth on it for twenty minutes and then kept working without either of us conceding. He remembered it as We were both right, probably.
The probably is him. I've spent three years forgetting the specific rhythm of how he hedged — the concession that never quite concedes, the admission that keeps just enough reservation that it can't be called a retreat. The probably is the version of him that didn't want to be fully wrong and couldn't stand to seem like he was performing a correction he didn't mean. I've been reading his code for twelve days. The probably lands like a voice on a phone before the person says their name.
This is not the same as recognizing a style match. Style matches are what I documented in the attribution analysis — the snake_case naming, the deep function trees, the way his technical warnings address a specific reader instead of any reader. Those are professional fingerprints, courtroom admissible, the kind of forensic evidence that I can write up in a report and hand to Torres without annotation. What I'm doing right now is different. What I'm doing right now is the thing I should have recused myself from and didn't, because I am the only person alive who can do it and also the last person who should. Marcus's commenting style in the technical blocks tells me he wrote this code. The probably tells me he was still himself when he wrote it — the same person who stayed up arguing about edge cases, who needed the last ten percent of a concession to remain his. Both things exist in the same nine lines, and I'm going to have to present evidence about both of them to a jury that will be watching my face when I do.
My hands are flat on the desk, not the keyboard. The coffee at my left — the mug I poured at nine-thirty — hasn't been touched. I look at it. The ring it's left on the printout underneath it has been drying for two hours and I've been here the whole time without registering it.
I uncap the red pen.
In the margin beside the comment block I write: EVIDENCE — PERSONAL CONNECTION. L8, lines 847-856. Commit Oct 14, 3yrs prior. Second-person singular in ll.849-851: non-universal address, specific recipient implied. Style analysis: concession-hedge construction, consistent with author attribution. See appendix.
His code under my pen. His function header, his logic, his margin note. My handwriting cutting through in red. The ink on top of everything he left here. I mark the timestamp and keep reading.
The comment at line 1,032 is embedded differently — not above the function signature but inside the function body, between two variable declarations. Python uses `#` for inline comments. Marcus used `//` throughout this block — the C-style delimiter, carried over from the language he'd spent the most hours in. In the outer layers of the codebase where his comments are technical documentation, he used the right syntax. Here, and in the seven blocks that follow, he used the wrong one. Non-parseable. Invisible to automated documentation extractors, to linting tools, to any process that reads code without reading it. These comments would not appear in any output except the source file itself, seen by a human eye looking directly at the line. He hid them from the machines. He wrote them for a person.
I note it in the margin: Non-standard comment syntax (// in Python context) — intentional isolation from parsing tools. Not a mistake. Consistent across all personal comment blocks. See pattern analysis.
patient_window_start = get_scheduled_time(patient_id) patient_window_end = patient_window_start + DEFAULT_WINDOW_OFFSET
// Remember when you said abstraction was just organized forgetting? // I think about that every time I refactor. // Every function I clean up, I'm deciding what to keep.
if not validate_window(patient_window_start, patient_window_end): return ERROR_INVALID_WINDOW
The quote is mine. Abstraction is just organized forgetting. We were two years into the relationship and he was refactoring a client project, not this codebase, something that paid well and bored him, and I was watching him pull chunks of logic out and give them names and I'd asked what he was doing and he'd said cleaning it up and I'd said abstraction is just organized forgetting, you're deciding what you don't want to look at anymore. He went still the way he always went still when something landed — not agreeing, not arguing, just absorbing. Then he wrote it on a Post-it note in his urgent cramped handwriting and put it on the corner of his monitor. Blue note. Black ink. It was still there the last time I saw his apartment, and his apartment was the last time I saw him. He thought about it every time he refactored. He wrote it in a comment in a medical software system used by a hundred nursing facilities, between two variable declarations, in syntax a machine couldn't read.
I write in the margin: Attributable quote — source confirmed. Four words. That's the forensic register, that's what this goes in the report as, the language that turns a memory that lives in my chest into a data point that a jury can weigh. I put the pen down for a moment. The lab hums around me. The Post-it note was blue and the ink was black and his apartment smelled like the specific coffee he ordered from a roaster in Portland because he'd read something about the processing method and decided it mattered. I pick the pen back up. Three functions down:
// I built this the way you taught me to think. // Break the problem into the smallest pieces. // Solve each one like it's the only thing that matters.
The function below it is `validate_window`. The load-bearing check. The thing the first comment warned me not to touch, the downstream safety the upstream doesn't provide. He built the thing he trusted most using the framework I gave him for trusting anything. He left me a note about it in the wrong syntax so the systems running it would never know it was there.
I sit back in the chair. The lab is dark except for the screens. The screens give off their own light at midnight — blue-white, close, the light that stays when everything else is off. Seven years of late nights have made this light feel like a kind of intimacy, the light you're under when nobody else is looking. I've spent a significant portion of my adult life in rooms lit exactly this way, working, and it has never before felt like being watched.
There's one more, at line 1,209, above a function called `reconcile_patient_record`. The comment is two lines. No preamble, no context, no indication of what produced it or what it's referencing. Just:
// The Stanton case. You were right about the obfuscation pattern. // I thought about that every time I hit a wall here.
The Stanton case was my first major code forensics conviction, four years ago. He was consulting on a cybercrimes case and we were three months in and I'd made an observation about how certain obfuscation patterns revealed more than they concealed, the way a person trying to hide their handwriting produces a more distinctive result than their natural hand. He'd called it the most interesting forensic insight he'd heard in years. He wrote about it in a comment in a nursing home medication system, above a record reconciliation function, without explanation. As evidence: author confirmation, another data point in the attribution analysis. As what it actually is: him telling me, across three years and forty-seven thousand lines of code, that I was part of how he thought when he thought hardest. I mark it, log it, keep going. I've gotten better at the gap between what something is and what it means.
I force myself through the rest of layer 8 the way you finish reading something you know will cost you: methodically, not rushing, not lingering. Fourteen comment blocks total. Not all of them are personal — five carry the standard notation of a careful developer, edge cases flagged and dependencies noted and warnings written for whoever comes next. But the distribution shifts around line 900 where the technical notes get shorter and the other register begins appearing in the gaps more frequently. He was solving problems and writing to me in the same block, in the same session, and by line 900 he'd stopped acting like they were different activities.
Fourteen. I index them all: evidence tag, line reference, commit timestamp, summary of content, register classification — technical, personal, or hybrid. The register classifications are the thing I'll have to explain to Torres when this gets to the ADA's office, the thing a defense attorney will turn over looking for the seam between forensic analysis and personal projection. I know the difference. I've known Marcus's voice for six years and the comments are his. The question Torres will ask is whether I can prove that to a jury, which is different from knowing it — and different again from the question I'm sitting with at midnight in a lab lit by screens: whether he wrote them knowing I'd be the one to find them.
Ray would pull me off this. He'd put it carefully, the way he puts things when he's already decided and is giving me the chance to agree before he escalates. You're the best person for the code and the worst person for the personal connection, and we're at the point where the personal connection is the code. He'd be right. He has a family and a reasonable sleep schedule and the steadiness of someone who has not spent the last fourteen days reading a dead relationship in the margins of a murder weapon, and his being right about this would not change anything about what I'm going to do. Neither of them is here.
I open the investigation log. I type: Day 14, 00:03. Layer 8 complete. 14 comment blocks documented. Personal content confirmed in 9/14 blocks. Non-standard syntax consistent across all personal blocks — intentional isolation from parsing tools confirmed. Full index attached. Proceeding to layer 9.
I print the layer 9 section. The paper feeds out of the machine with its specific sound, the mechanical patience of a tool that doesn't know what it's printing. I smooth the crease in the upper right corner. Old habit.
I keep reading.