Aaron Reiss called on a Monday morning, three days after the shadow layer deployment, with news that was good and timing that was inconvenient.
"The term sheet is signed," Reiss said. "My team is ready to start the data transfer on the historical supply chain dataset."
Marcus ran through the implications. The Reiss data transfer would add significant volume to Threadline's data infrastructure at exactly the moment when that infrastructure was running in a hardened, semi-manual mode while the shadow validation layer was live and the dependency audit's security recommendations were being implemented.
"I need to push the transfer by two weeks," Marcus said.
A brief pause. "We're on a timeline for the strategy deployment."
"I understand. Two weeks doesn't affect your Q2 launch window." He had Reiss's timeline memorized. "But the transfer needs to go into a clean environment and my infrastructure team is currently mid-implementation on a security upgrade." He paused. "I'd rather run the transfer clean than fast."
Reiss was quiet for a moment with the quality of a man doing math. "Two weeks," he said. "Not three."
"Two weeks," Marcus agreed.
The call ended. He noted it in the project tracker and went back to watching the shadow validation layer's logs.
The layer had been running for three days with no discrepancies. This was expected — Sorokin had said weeks, not days, and an operation that had been in preparation for eight months was not going to rush the final execution. But Marcus checked the logs four times a day anyway, with the same methodical attention he brought to everything.
On day seven, the logs showed the first anomaly.
Not a corruption — a probe. The validation library's dependency resolution path was queried in an unusual sequence, the kind of query that was consistent with a pre-attack reconnaissance: confirming the library was loaded, confirming its position in the dependency chain, confirming the attack surface was still present and not patched.
Marcus forwarded the log to Elaine with a timestamp and a one-line annotation: *Reconnaissance phase. Attack execution likely within 48-72 hours.*
She replied in six minutes: *Confirmed. Joint technical team standing by. Continue monitoring.*
He told Yuki. She was already watching.
"When it comes," he said, "I want full logging on every modification attempt. Not just the outputs — the intermediate states."
"Already configured," she said.
He looked at her. "You anticipated this."
"You told me the attack was coming and you told me the vector." She looked at her screen. "The intermediate state logging was obvious."
He thought about what it meant to have someone on his team for whom the obvious things were the things he would have done himself. He thought about Yuki's equity refresh agreement, which she had signed the same day she received it, without questions.
"Good," he said.