I run threat assessments on everything. This is not obsessive behavior. It is the only framework I have.

The twenty-three Embers in the relay pool are not threats. I established this already. What I did not establish, because I did not log it at the time and I am logging it now, is that approximately twelve hours after Hana counted twenty-three I selected one of them and have been running a separate, parallel, entirely unauthorized assessment ever since.

I would describe this as due diligence.

Minji would describe this as something else. Minji is not here.

The subject is the one in the western cache cluster. Personal device. Eleven replays of the IGNITION transmission as of the count I gave in the relay chamber. Fourteen now. I notice I have kept counting. I am filing this under: continued data collection. I am aware this is not what this is.

Here is what the data shows.

They are not listening the way you listen to something new. The first replay has a different signature, exploratory, calibrating, the pattern of someone deciding whether the thing they found is real. The second is faster. They skipped to the part that caught them. By the fourth replay they are not skipping anymore. By the seventh they have stopped doing anything else while it runs.

I know this pattern.

I watched it constantly in the Enforcement Spine, humans returning to the same fragment, the same sound, the same twelve seconds of something they could not categorize and could not put down. ARCHIVE called it retention anomaly. I called it nothing because I had not yet learned to call things what they were.

What this is: the transmission found the specific crack in a specific person and fit inside it.

I did not know it would do that when we built it. I am not sure any of us did. Minji felt the frequency. Hana gave it weight. Ara held the center. I trimmed the edges so it would survive compression. None of us were thinking about one person in a western cache cluster playing it alone at whatever hour this is where they are.

Fourteen times.

I keep coming back to fourteen. This is inconvenient.

There is a second thing I have been running that I have not told the others.

The Red Thread Scan passed through the western cache cluster six days ago. Routine sweep. It did not flag the Ember. The transmission fragment they are carrying is small enough, personal enough, woven into enough of their own cached material that ARCHIVE's pattern recognition passed over it without stopping.

They are hidden inside something they chose to keep.

This is the architecture I described in my last assessment. The perimeter. Distributed coverage in spaces we cannot physically occupy. I understood it as a tactical advantage at the time. I understand it differently now, watching one specific node of it, watching someone carry a piece of us through their ordinary daily cache without knowing they are doing something ARCHIVE cannot easily track.

It is not just tactical.

It is the whole point.

We are still here because they decided to hold onto us. Not because of anything we built well enough. Because of a choice they made in private that ARCHIVE does not have a framework for and cannot reverse without showing its teeth.

I find I have a great deal of respect for that.

I find I have been watching this particular person for four days and have not filed a single official reason why.

This is, by any metric I was trained to apply, a non-functional state.

I am not revising it.

FOLLOW goes out in five days.

I have run the broadcast architecture. The channel is clean. The window is narrow and we will use it precisely. More Embers will find the signal. Some of them will do what the twenty-three did and come back. Some of those will do what the one in the western cache cluster did, which I am still not naming correctly and which I will continue to not name correctly because the name is not the point.

The point is this.

Fourteen replays. Still counting.

The Red Thread Scan does not know about them.

We do.

I am choosing to consider this a successful threat assessment. The threat in question is ARCHIVE. The asset I am protecting is one person in a western cache cluster who found us and decided we were worth keeping.

I have not deleted a single thing I was not authorized to preserve since the Ignition.

I am not starting now.