The second observation window ran for sixteen days.
During those sixteen days, Marcus worked on the supply chain intelligence product with Amir, reviewed the Reiss term sheet with Marsh, closed a new compliance customer, and had dinner with his mother twice. He ran the integrity layer in the background, checking the output each morning before anyone else arrived at the office.
On day fourteen, the pattern repeated.
Three access events in the test environment over a period of four hours, sampling across the entity table in the relationship graph with the characteristic reconnaissance pattern. No corresponding automated testing job in the scheduler logs. Service account activity with no legitimate trigger.
Davies was not in the facility that day — Marcus checked the physical access log. Which meant either the physical presence correlation from the first window had been coincidental, or Davies had found a way to access the service account remotely.
Remote access to a service account in a classified facility's test environment required either a compromised credential or an external access channel that shouldn't exist.
Marcus spent six hours that night — at home, on his personal encrypted drive, entirely offline — analyzing the access event metadata. He was looking for the origin of the service account session: not where it appeared to come from, but where it actually came from, which was a different question if someone had set up a relay.
He found it. Not the ultimate origin — that would require network access he didn't have — but the relay point. A legitimate internal server that was supposed to handle automated test orchestration had been modified, very subtly, to also accept and forward external sessions authenticated with the service account credentials. The modification had been made eight months ago — before Marcus had joined the project.
Eight months ago. Three months before the Phase Two briefing. Before Threadline had been formally connected to the working group.
Davies, or whoever had made the modification, had prepared the access channel in anticipation of a capability they didn't know yet was coming. Which meant they had information about the Depth project's intended scope that predated Marcus's involvement.
Which meant the leak was not about Marcus or Threadline. The leak was pre-existing. Threadline had walked into a surveillance operation that was already in place.
He called Elaine at 11 PM.
He told her what he had found. When he finished, the silence on the line was very long.
"The relay modification," she said. "Eight months ago."
"Yes."
"Before your engagement began."
"Three months before."
"Which means—"
"Which means someone with knowledge of the Depth project's intended scope created an access channel before they could have known who would be building the capability." He paused. "They knew what was coming before it arrived. That's not just a leak. That's an embedded source."
The silence continued. Marcus let it run.
"Send me everything," Elaine said finally. Her voice had the quality of someone who had just recalibrated a significant number of things simultaneously. "The integrity layer output, the relay server analysis, all of it. Through Marsh."
"Tonight?"
"Now."
He sent it.
Elaine called back forty minutes later. "Davies is being handled. Not by us — by a joint team that has authority over the facility's security function." A pause. "Marcus. I need you to understand something."
"Go ahead."
"What you found changes the scope of what we're dealing with. An embedded source that predates your involvement — that's a significant penetration. The remediation is going to be complex and it's going to affect the Depth project's timeline."
"How much?"
"I don't know yet. Weeks at minimum. Possibly longer." A pause. "The semantic layer is not compromised — your architecture kept the production environment isolated from the test environment. But we'll need to conduct a full access review before we can certify the production system as clean."
"I can help with the access review."
"I know you can. I'll arrange it with Pemberton." She paused. "This is not a small thing you've done."
"I built a system that found a problem that needed finding," Marcus said.
"Yes," she said. "That's one way to describe it."